Edit tour

Windows Analysis Report
svchostinter.exe

Overview

General Information

Sample name:	svchostinter.exe
Analysis ID:	1564408
MD5:	61f3c4028bb365ed68eccb303b411043
SHA1:	46b41e18817579f95dfc7efaf8ae799337129b39
SHA256:	c30fc17df989f401a1518088a58bef58c6e0ee7b91960452a547c87af9cda957
Tags:	CobaltStrikeexemalwareuser-Joker
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found API chain indicative of debugger detection

Performs DNS queries to domains with low reputation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

svchostinter.exe (PID: 6176 cmdline: "C:\Users\user\Desktop\svchostinter.exe" MD5: 61F3C4028BB365ED68ECCB303B411043)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "632313373.xyz,/api/3", "HttpPostUri": "/api/4", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": "Host: 632313373.xyz\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x32760:$a39: %s as %s\%s: %d 0x41be2:$a41: beacon.x64.dll 0x33970:$a46: %s (admin) 0x328d8:$a48: %s%s: %s 0x3278c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x327b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x339d9:$a51: Content-Length: %d
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1956a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1a89b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1a4ca:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x1986e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x31b30:$a39: %s as %s\%s: %d 0x7cb30:$a39: %s as %s\%s: %d 0x40fb2:$a41: beacon.x64.dll 0x8bfb2:$a41: beacon.x64.dll 0x32d40:$a46: %s (admin) 0x7dd40:$a46: %s (admin) 0x31ca8:$a48: %s%s: %s 0x7cca8:$a48: %s%s: %s 0x31b5c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31b88:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x7cb5c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x7cb88:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x32da9:$a51: Content-Length: %d 0x7dda9:$a51: Content-Length: %d
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1db0c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 0x68b0c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1973a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1aa6b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x6473a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x65a6b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1a69a:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x6569a:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 8B 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 71 F2 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF 50 0x19a3e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ... 0x64a3e:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
Process Memory Space: svchostinter.exe PID: 6176	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: svchostinter.exe PID: 6176	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: svchostinter.exe PID: 6176	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: svchostinter.exe PID: 6176	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x12675:$a39: %s as %s\%s: %d 0x19bdf:$a39: %s as %s\%s: %d 0x5c595:$a39: %s as %s\%s: %d 0x16243:$a41: beacon.x64.dll 0x1d7e4:$a41: beacon.x64.dll 0x60163:$a41: beacon.x64.dll 0x12a19:$a46: %s (admin) 0x12a99:$a46: %s (admin) 0x19f83:$a46: %s (admin) 0x1a003:$a46: %s (admin) 0x5c939:$a46: %s (admin) 0x5c9b9:$a46: %s (admin) 0x12793:$a48: %s%s: %s 0x19cfd:$a48: %s%s: %s 0x5c6b3:$a48: %s%s: %s 0x1268f:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x126b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1283b:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x19bf9:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x19c22:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x19da5:$a50: %02d/%02d/%02d %02d:%02d:%02d
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.svchostinter.exe.2300000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.svchostinter.exe.2300000.1.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x17d6a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1909b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.svchostinter.exe.2300000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.svchostinter.exe.2300000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30d60:$a39: %s as %s\%s: %d 0x401e2:$a41: beacon.x64.dll 0x31f70:$a46: %s (admin) 0x30ed8:$a48: %s%s: %s 0x30d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x30db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x31fd9:$a51: Content-Length: %d
0.2.svchostinter.exe.2300000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.svchostinter.exe.2300000.1.raw.unpack	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1896a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19c9b:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
0.2.svchostinter.exe.2300000.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
Click to see the 8 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://632313373.xyz:8443/api/3r	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/34	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/I	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3I	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3a	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3u	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/B	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3.xyz:8443/api/3	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3L	Avira URL Cloud: Label: malware
Source: https://632313373.xyz/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/332	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3G	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3d06B	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/-	Avira URL Cloud: Label: malware
Source: 632313373.xyz	Avira URL Cloud: Label: malware
Source: https://632313373.xyz:8443/api/3ed	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 8443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "632313373.xyz,/api/3", "HttpPostUri": "/api/4", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": "Host: 632313373.xyz\r\n"}

Multi AV Scanner detection for submitted file

Source: svchostinter.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 632313373.xyz

Performs DNS queries to domains with low reputation

Source:

DNS query: 632313373.xyz

Source: Joe Sandbox View

IP Address: 172.67.175.230 172.67.175.230

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 632313373.xyz

Source: svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1515190279.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624542805.000000000016A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121349990.000000000017C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/PCUeQViQlYc.crl0
Source: svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1515190279.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624542805.000000000016A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121349990.000000000017C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/lk00%
Source: svchostinter.exe, 00000000.00000003.2202385626.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000116000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/
Source: svchostinter.exe, 00000000.00000003.2202385626.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000116000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz/B
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/-
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/I
Source: svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3.xyz:8443/api/3
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/332
Source: svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/34
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3G
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3I
Source: svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3L
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3a
Source: svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3d06B
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3ed
Source: svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3r
Source: svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://632313373.xyz:8443/api/3u

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.svchostinter.exe.2300000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.svchostinter.exe.2300000.1.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: Process Memory Space: svchostinter.exe PID: 6176, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_004020B0	0_2_004020B0
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00403170	0_2_00403170
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00460360	0_2_00460360
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00401B20	0_2_00401B20
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_004603A8	0_2_004603A8
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02321264	0_2_02321264
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232AAB0	0_2_0232AAB0
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02310334	0_2_02310334
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02320374	0_2_02320374
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232C397	0_2_0232C397
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232239C	0_2_0232239C
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02321928	0_2_02321928
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02325914	0_2_02325914
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0230916C	0_2_0230916C
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0230CE3C	0_2_0230CE3C
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232E600	0_2_0232E600
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02309680	0_2_02309680
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232C680	0_2_0232C680
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02316F38	0_2_02316F38
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232B7B0	0_2_0232B7B0
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0232CFF0	0_2_0232CFF0
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0231F5A8	0_2_0231F5A8
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0257D280	0_2_0257D280
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02567B38	0_2_02567B38
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0257DBF0	0_2_0257DBF0
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_025701A8	0_2_025701A8
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02571E64	0_2_02571E64
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02572F9C	0_2_02572F9C
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02572528	0_2_02572528

Source: svchostinter.exe

Static PE information: Number of sections : 18 > 10

Source: 0.2.svchostinter.exe.2300000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.svchostinter.exe.2300000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: Process Memory Space: svchostinter.exe PID: 6176, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: svchostinter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\svchostinter.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: svchostinter.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\svchostinter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: svchostinter.exe	Static PE information: section name: .xdata
Source: svchostinter.exe	Static PE information: section name: /4
Source: svchostinter.exe	Static PE information: section name: /19
Source: svchostinter.exe	Static PE information: section name: /31
Source: svchostinter.exe	Static PE information: section name: /45
Source: svchostinter.exe	Static PE information: section name: /57
Source: svchostinter.exe	Static PE information: section name: /70
Source: svchostinter.exe	Static PE information: section name: /81
Source: svchostinter.exe	Static PE information: section name: /92

Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0045F9A0 push rax; retf	0_2_0045F9A1
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0233776C push 0000006Ah; retf	0_2_02337784
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0255A35D push edi; iretd	0_2_0255A35E
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_025803FC push ebp; iretd	0_2_02580401
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0257B84F push ebp; iretd	0_2_0257B850
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0257B86F push ebp; iretd	0_2_0257B870
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0257B898 push ebp; iretd	0_2_0257B899
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0255C91C pushad ; retf	0_2_0255C91D
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_02560901 push ebx; iretd	0_2_02560902
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0255A71E push cs; retf	0_2_0255A71F
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0255BD58 push ebp; iretd	0_2_0255BD59

Source: C:\Users\user\Desktop\svchostinter.exe TID: 5100	Thread sleep count: 44 > 30			Jump to behavior
Source: C:\Users\user\Desktop\svchostinter.exe TID: 5100	Thread sleep time: -2640000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\svchostinter.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\svchostinter.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\svchostinter.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000125000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000125000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000125000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\svchostinter.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-39461

Source: C:\Users\user\Desktop\svchostinter.exe

Code function: 0_2_0040D110 free,IsDebuggerPresent,RaiseException,

0_2_0040D110

Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,	0_2_00401180
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00409020 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00409020
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_00460498 SetUnhandledExceptionFilter,	0_2_00460498
Source: C:\Users\user\Desktop\svchostinter.exe	Code function: 0_2_0040F182 SetUnhandledExceptionFilter,	0_2_0040F182

Source: C:\Users\user\Desktop\svchostinter.exe

Code function: 0_2_00408F40 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00408F40

Source: C:\Users\user\Desktop\svchostinter.exe

Code function: 0_2_02565E28 GetUserNameA,strrchr,_snprintf,

0_2_02565E28

Source: C:\Users\user\Desktop\svchostinter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0.2.svchostinter.exe.2300000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchostinter.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: 0.2.svchostinter.exe.2300000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
svchostinter.exe	53%	ReversingLabs	Win64.Trojan.CobaltStrike

Source	Detection	Scanner	Label
https://632313373.xyz:8443/api/3r	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/34	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/I	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3I	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3a	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3u	100%	Avira URL Cloud	malware
https://632313373.xyz/B	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3.xyz:8443/api/3	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3L	100%	Avira URL Cloud	malware
https://632313373.xyz/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/332	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3G	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3d06B	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/-	100%	Avira URL Cloud	malware
632313373.xyz	100%	Avira URL Cloud	malware
https://632313373.xyz:8443/api/3ed	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
632313373.xyz	172.67.175.230	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
632313373.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://o.pki.goog/s/we1/lk00%	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/api/3u	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/34	svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/we1.crt0	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/api/3r	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/I	svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/r/gsr1.crl0	svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1515190279.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624542805.000000000016A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/api/3	svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3a	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3.xyz:8443/api/3	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3L	svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz/B	svchostinter.exe, 00000000.00000003.2202385626.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000116000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3I	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://c.pki.goog/we1/PCUeQViQlYc.crl0	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000167000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/gsr1.crt0-	svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337667539.000000000016B000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1515190279.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121273627.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624542805.000000000016A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://c.pki.goog/r/r4.crl0	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121349990.000000000017C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz/	svchostinter.exe, 00000000.00000003.2202385626.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000116000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000116000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/332	svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3ed	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i.pki.goog/r4.crt0	svchostinter.exe, 00000000.00000002.2497226681.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202540563.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121381909.0000000000172000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1624562389.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000166000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000168000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677824633.000000000016F000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000163000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.000000000009C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.000000000017A000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1677883739.0000000000164000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000101000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2121349990.000000000017C000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1337719902.0000000000169000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.2202385626.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1487257380.0000000000167000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000002.2498638037.0000000000770000.00000004.00000020.00020000.00000000.sdmp	false		high
https://632313373.xyz:8443/api/3d06B	svchostinter.exe, 00000000.00000003.2202385626.0000000000103000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/api/3G	svchostinter.exe, 00000000.00000002.2497226681.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://632313373.xyz:8443/-	svchostinter.exe, 00000000.00000003.1433002391.0000000000132000.00000004.00000020.00020000.00000000.sdmp, svchostinter.exe, 00000000.00000003.1768761266.0000000000132000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.175.230	632313373.xyz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564408
Start date and time:	2024-11-28 09:53:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	svchostinter.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: svchostinter.exe

Simulations

Behavior and APIs

Time	Type	Description
03:54:06	API Interceptor	44x Sleep call for process: svchostinter.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.175.230	installer.exe	Get hash	malicious	LummaC	Browse
	d3d9.dll	Get hash	malicious	LummaC	Browse
	vdCC5gzAn6.exe	Get hash	malicious	LummaC	Browse
	vercath63.b-cdn.ps1	Get hash	malicious	LummaC, Go Injector	Browse
	Fluxus_Installer.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	KEie4St7Tt	Get hash	malicious	Unknown	Browse
	Linux_x86	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	104.21.57.248
	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.222.69
	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	104.21.86.60
	https://www.google.rs/url?q=160CHARtTPSJ3J3wDyycT&sa=t&esrc=TYsrCFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/aloperdehatti.com/on/wTARVgfa92/%61%6C%65%73%73%69%61%2E%64%61%6E%69%65%6C%65%40%74%6F%6E%69%6E%63%61%73%61%2E%69%74&ugs=n8CoFFz5hZ4Yaxn3ZJryvKlaQxQ-BOyvjZ0GlahI9shjnWfTZ1du_w==	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	A27D-Pikolinos Digital Advertising Strategy.docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	hnsdfs2711.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	HNsuunto27.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	https://pixmar.co.za/.well-known/.js/	Get hash	malicious	Unknown	Browse	104.18.95.41

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.194735838511048
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	svchostinter.exe
File size:	474'329 bytes
MD5:	61f3c4028bb365ed68eccb303b411043
SHA1:	46b41e18817579f95dfc7efaf8ae799337129b39
SHA256:	c30fc17df989f401a1518088a58bef58c6e0ee7b91960452a547c87af9cda957
SHA512:	2ef11da22537f071bec58015248597d8747b7de62989262568376a15d61bb3e328271ea950488f5dcbb1913556119fbb37898d704d884558a58581e400495548
SSDEEP:	12288:jVzXVcGcT62x/JtPCAw5UHsOWgnZK/LI+tmiV/+1Edh:JzXA62x/i1OTnZi3V/+1Edh
TLSH:	E4A4AD637FA5CF59D8057338A6DB9528573AF0ED03120F0A5623AA33FE53880759EB64
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...V.6g.Z........'...........................@............................................... ............................

File Icon


Icon Hash:	13170f0f8f060c0c

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x6736F756 [Fri Nov 15 07:25:10 2024 UTC]
TLS Callbacks:	0x409150
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5b928a8f4e4a094efc0701738c18f7f0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0005B7F5h]
mov dword ptr [eax], 00000001h
call 00007F909886291Fh
call 00007F909885AB5Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0005B7C5h]
mov dword ptr [eax], 00000000h
call 00007F90988628EFh
call 00007F909885AB2Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call 00007F9098863FA4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F909885AE79h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [ecx+08h]
dec eax
test eax, eax
dec eax
mov esi, ecx
dec eax
mov ebx, edx
je 00007F909885AED8h
dec eax
mov edi, dword ptr [eax]
dec eax
mov eax, dword ptr [edx]
dec eax
cmp dword ptr [edx+08h], eax
jle 00007F909885AF20h
dec eax
lea edx, dword ptr [esi+08h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60000	0xe28	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0x1398	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5d000	0xf0c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5c5e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x60358	0x308	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe498	0xe600	fbb9c0438dc4c2127087b7049c66376e	False	0.5271059782608696	data	6.216214437930655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10000	0x4b360	0x4b400	5cdfe59af8f8c6baaf8ece22d0516dd8	False	0.6853100342607974	data	7.433537548333141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5c000	0xd10	0xe00	a96f5fdad948cc7cde991fd1050d7d9d	False	0.40625	data	4.583284955248966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x5d000	0xf0c	0x1000	22ebade26ebc9960ca8250e61716ffb4	False	0.46728515625	data	4.673330528241354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x5e000	0xd90	0xe00	bc35f906da09210655f49331958d3ca6	False	0.22433035714285715	data	4.042408256669859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x5f000	0xae0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x60000	0xe28	0x1000	faf38979b5e556d3af7021a8a6208319	False	0.29931640625	data	3.961484142958882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x61000	0x70	0x200	9188999fffb8b4aab400a7e227e96594	False	0.076171875	data	0.3242125245953951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x62000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0x1398	0x1398	f2be25bf0967f068e9e7e30e3472b29c	False	0.2458133971291866	data	3.911829265260592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x65000	0x80	0x200	e66e45f53d54b7b6505ca6e8f0aa7290	False	0.103515625	data	0.39435882474477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x66000	0x475e	0x4800	95b0ff65c5b67c59d55e116eb7438553	False	0.3928493923611111	data	5.967488568036755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x6b000	0x500	0x600	376602388f36e2131f481e79b13268c6	False	0.3111979166666667	data	4.2370580733237615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x6c000	0x704	0x800	719659a21f2b0018949cdb1b4e93d25e	False	0.43505859375	data	5.113895082808044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x6d000	0x130	0x200	2a0e45445341847b4184e143318fed09	False	0.375	data	2.655788533516559	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x6e000	0x12c	0x200	da6bb64456072fa6a17880b326fe66d6	False	0.375	data	3.8316609167251707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x6f000	0x74e	0x800	a8b47f9f9dccfbe27b4a40e1d68fd415	False	0.21728515625	data	1.7520776596242025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/92	0x70000	0x1f0	0x200	86fa71369197029a259ef41e9e0d6f40	False	0.193359375	data	0.9967668471309872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x630f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.1977016885553471
RT_GROUP_ICON	0x641a0	0x14	data	English	United States	1.1
RT_MANIFEST	0x641b8	0x1ca	XML 1.0 document, ASCII text, with very long lines (456), with CRLF line terminators	English	United States	0.5764192139737991

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _fileno, _fmode, _initterm, _onexit, _setjmp, _setmode, _strdup, _ultoa, abort, calloc, exit, fflush, fprintf, free, fwrite, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strlen, strncmp, vfprintf
USER32.dll	MessageBoxA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 09:54:04.289431095 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:04.409523964 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:04.409706116 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:04.418823004 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:04.538726091 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.544615984 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.544680119 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:05.544694901 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.544706106 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.544737101 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:05.544797897 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:05.648535967 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:05.768392086 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.971488953 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:05.971564054 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:05.979470968 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:06.099384069 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:07.277800083 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:07.277879000 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:07.398835897 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:07.518814087 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:07.518886089 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:07.519221067 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:07.639065027 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:08.700182915 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:08.700783014 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:08.701337099 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:08.702585936 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:08.821243048 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:08.822529078 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:10.080346107 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:10.082700014 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.196095943 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.196527958 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.316430092 CET	8443	49699	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:10.316477060 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:10.316507101 CET	49699	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.316559076 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.316842079 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:10.438766003 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:11.406970978 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:11.407038927 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:11.412343979 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:11.413758039 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:11.532299042 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:11.533624887 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:12.720530033 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:12.720705986 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:12.835832119 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:12.844260931 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:12.956413984 CET	8443	49700	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:12.956526995 CET	49700	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:12.964236975 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:12.964317083 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:12.964660883 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:13.084481001 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:14.216970921 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:14.217076063 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:14.217531919 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:14.218924046 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:14.337394953 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:14.338790894 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:16.891623974 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:16.891690969 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.007782936 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.008599043 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.128093004 CET	8443	49701	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:17.128206968 CET	49701	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.128643036 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:17.128720045 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.129060030 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:17.248940945 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:18.263674021 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:18.263770103 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:18.264144897 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:18.265197992 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:18.384203911 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:18.385086060 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:19.595813990 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:19.595885038 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.710870981 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.711380005 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.831072092 CET	8443	49703	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:19.831135988 CET	49703	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.831295013 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:19.831362009 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.832046986 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:19.951996088 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:20.921863079 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:20.921920061 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:20.922615051 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:20.924720049 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:21.042562008 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:21.044692039 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:22.266448975 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:22.266527891 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.369194031 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.379525900 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.489453077 CET	8443	49714	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:22.489528894 CET	49714	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.499509096 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:22.499588013 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.500169992 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:22.620039940 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:23.681529999 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:23.681623936 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:23.683171988 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:23.683171988 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:23.803093910 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:23.803412914 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:25.042820930 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:25.042923927 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.160135984 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.160620928 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.280333996 CET	8443	49718	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:25.280422926 CET	49718	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.280581951 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:25.280766964 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.281197071 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:25.401055098 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:26.460211039 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:26.460454941 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:26.461137056 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:26.464593887 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:26.594803095 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:26.594822884 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:27.783818960 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:27.786150932 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:27.929637909 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:27.930407047 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:28.049928904 CET	8443	49724	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:28.050151110 CET	49724	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:28.050333977 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:28.050515890 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:28.052980900 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:28.172838926 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:29.138639927 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:29.138859987 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:29.139276981 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:29.140486002 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:29.260293961 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:29.261224031 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:30.479065895 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:30.479198933 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.585968971 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.593130112 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.706304073 CET	8443	49733	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:30.706450939 CET	49733	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.715555906 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:30.715663910 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.716047049 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:30.835988998 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:31.848298073 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:31.848444939 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:31.848886967 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:31.850207090 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:31.968867064 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:31.970091105 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:33.149585009 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:33.149645090 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.259219885 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.259820938 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.379482031 CET	8443	49740	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:33.379538059 CET	49740	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.379734039 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:33.379796982 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.380172968 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:33.500255108 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:34.515358925 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:34.515461922 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:34.515965939 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:34.517162085 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:34.635858059 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:34.637010098 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:35.858922958 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:35.859031916 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:35.961133003 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:35.961592913 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:36.081696033 CET	8443	49747	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:36.081840038 CET	49747	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:36.081980944 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:36.082056999 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:36.082458973 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:36.202491999 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:37.305840969 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:37.305896997 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:37.306211948 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:37.307260036 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:37.426122904 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:37.427215099 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:38.710068941 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:38.710161924 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:38.820346117 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:38.820804119 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:38.940648079 CET	8443	49753	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:38.940768957 CET	49753	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:38.940783978 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:38.940855026 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:38.941175938 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:39.061047077 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:40.074929953 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:40.075012922 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:40.075396061 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:40.076385975 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:40.195285082 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:40.196346045 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:41.414092064 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:41.414185047 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.523464918 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.527374029 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.643659115 CET	8443	49758	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:41.643740892 CET	49758	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.647425890 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:41.647499084 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.647835970 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:41.767693043 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:42.753256083 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:42.753401041 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:42.754143953 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:42.755213976 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:42.874034882 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:42.875096083 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:44.027632952 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:44.027693033 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.132750988 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.133266926 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.253290892 CET	8443	49766	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:44.253459930 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:44.253525972 CET	49766	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.253582954 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.253931046 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:44.373773098 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:45.386734962 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:45.386811972 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:45.390239000 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:45.399108887 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:45.512600899 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:45.521526098 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:46.741605997 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:46.741691113 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:46.851644993 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:46.859826088 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:46.972023010 CET	8443	49774	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:46.972089052 CET	49774	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:46.979757071 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:46.979842901 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:46.980182886 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:47.100049973 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:48.198847055 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:48.198929071 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:48.211241007 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:48.219610929 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:48.331634045 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:48.339591026 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:49.566291094 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:49.566469908 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.679835081 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.680309057 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.800174952 CET	8443	49780	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:49.800268888 CET	49780	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.800393105 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:49.800465107 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.800754070 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:49.920598030 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:50.949328899 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:50.949420929 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:50.949834108 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:50.950864077 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:51.069783926 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:51.070751905 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:53.187223911 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:53.187298059 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.289236069 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.289736986 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.409431934 CET	8443	49787	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:53.409507036 CET	49787	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.409600019 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:53.409859896 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.410141945 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:53.531193972 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:54.497344017 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:54.497530937 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:54.498003960 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:54.499047041 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:54.618000031 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:54.618935108 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:55.832390070 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:55.832463026 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:55.945410013 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:55.954467058 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:56.065690994 CET	8443	49793	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:56.065807104 CET	49793	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:56.074717045 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:56.074812889 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:56.075134039 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:56.195029974 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:57.254997969 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:57.255078077 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:57.260839939 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:57.263169050 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:57.381059885 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:57.383105993 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:58.595587969 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:58.598731995 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.711074114 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.711524963 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.831320047 CET	8443	49802	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:58.831396103 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:58.831497908 CET	49802	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.831533909 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.831845045 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:58.951724052 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:59.987442970 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:54:59.987550020 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:54:59.988725901 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:00.001776934 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:00.108617067 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:00.121891022 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:01.323395014 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:01.323504925 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.430150986 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.430653095 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.550734043 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:01.551234007 CET	8443	49808	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:01.551384926 CET	49808	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.551744938 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.551744938 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:01.671843052 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:02.696099997 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:02.696177006 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:02.696611881 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:02.703886986 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:02.816859007 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:02.823966026 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:04.035514116 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:04.035617113 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.148621082 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.149056911 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.269022942 CET	8443	49815	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:04.269057989 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:04.269078970 CET	49815	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.269146919 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.269450903 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:04.389477968 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:05.403137922 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:05.403211117 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:05.403628111 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:05.404613018 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:05.523521900 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:05.524703979 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:06.775496960 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:06.775557041 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:06.882894993 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:06.883347988 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:07.065737009 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:07.065753937 CET	8443	49821	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:07.065830946 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:07.065853119 CET	49821	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:07.066148043 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:07.186002970 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:08.153637886 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:08.156689882 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:08.157059908 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:08.158009052 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:08.276937962 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:08.277887106 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:09.491096020 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:09.491159916 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.601711988 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.602247953 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.721978903 CET	8443	49827	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:09.722135067 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:09.722131014 CET	49827	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.722214937 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.722573042 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:09.843451977 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:10.815428972 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:10.815496922 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:10.815995932 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:10.817084074 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:10.935895920 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:10.937032938 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:12.159091949 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:12.159328938 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.273518085 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.273972988 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.393919945 CET	8443	49834	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:12.393949986 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:12.394022942 CET	49834	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.394078016 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.394428015 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:12.514254093 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:13.534322023 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:13.534409046 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:13.534794092 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:13.535746098 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:13.654694080 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:13.655651093 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:14.855689049 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:14.855746031 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:14.961078882 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:14.961586952 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:15.081357002 CET	8443	49841	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:15.081453085 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:15.081492901 CET	49841	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:15.081557989 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:15.081923008 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:15.201822996 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:16.215038061 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:16.215107918 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:16.215445995 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:16.216538906 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:16.335457087 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:16.336433887 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:17.524642944 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:17.524801016 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.632946968 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.633413076 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.753279924 CET	8443	49849	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:17.753351927 CET	49849	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.753381014 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:17.753446102 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.753751993 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:17.873701096 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:18.887876034 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:18.887960911 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:18.888339996 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:18.889488935 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:19.008277893 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:19.009532928 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:20.206583023 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:20.206722021 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.320461988 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.321000099 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.441258907 CET	8443	49857	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:20.441380978 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:20.441426992 CET	49857	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.441505909 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.442122936 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:20.562165976 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:21.576292038 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:21.576375961 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:21.576874018 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:21.577907085 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:21.696778059 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:21.697781086 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:22.909682989 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:22.909993887 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.023655891 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.024163008 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.145034075 CET	8443	49863	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:23.145081043 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:23.145102978 CET	49863	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.145159006 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.145519972 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:23.265559912 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:24.280180931 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:24.280266047 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:24.280735970 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:24.282211065 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:24.400655985 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:24.402091026 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:25.667638063 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:25.668669939 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:25.773722887 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:25.774252892 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:25.894064903 CET	8443	49870	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:25.894177914 CET	49870	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:25.894185066 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:25.894268036 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:25.894633055 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:26.014544964 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:27.076390982 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:27.076459885 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:27.076890945 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:27.078071117 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:27.196789026 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:27.198095083 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:28.478816032 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:28.478894949 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.586239100 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.586786985 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.706769943 CET	8443	49876	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:28.706860065 CET	49876	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.706891060 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:28.706965923 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.726763964 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:28.846885920 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:29.795109034 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:29.795253038 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:29.795681953 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:29.796736956 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:29.915606022 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:29.920676947 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:31.079591036 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:31.079761982 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.196659088 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.211031914 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.316958904 CET	8443	49882	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:31.317095995 CET	49882	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.331056118 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:31.331166983 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.331547022 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:31.451436043 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:32.465884924 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:32.465949059 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:32.466746092 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:32.468868017 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:32.586780071 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:32.588850975 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:33.808259010 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:33.808347940 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:33.914206982 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:33.914827108 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:34.035518885 CET	8443	49890	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:34.035676003 CET	49890	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:34.035805941 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:34.035892010 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:34.036365986 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:34.156395912 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:35.215848923 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:35.215943098 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:35.216356039 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:35.217516899 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:35.336303949 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:35.337451935 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:36.628254890 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:36.628683090 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.742616892 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.743119001 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.862953901 CET	8443	49897	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:36.863040924 CET	49897	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.863046885 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:36.863132000 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.863500118 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:36.983983994 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:37.996891975 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:37.996953964 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:37.997524977 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:38.004165888 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:38.117526054 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:38.124310970 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:39.307748079 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:39.307843924 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.429905891 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.430486917 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.550261974 CET	8443	49904	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:39.550348997 CET	49904	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.550349951 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:39.550417900 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.550754070 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:39.670692921 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:40.637403965 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:40.637480974 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:40.642781019 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:40.644761086 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:40.762737989 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:40.764813900 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:42.006570101 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:42.006690025 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.117364883 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.117872000 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.237948895 CET	8443	49910	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:42.237987041 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:42.238059044 CET	49910	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.238114119 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.238445044 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:42.358418941 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:43.374982119 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:43.375061989 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:43.405559063 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:43.427143097 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:43.525655031 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:43.547221899 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:44.725574970 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:44.725661993 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:44.836050034 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:44.836590052 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:44.956284046 CET	8443	49918	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:44.956537008 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:44.956621885 CET	49918	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:44.956655979 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:44.957009077 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:45.077080011 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:46.110037088 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:46.110179901 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:46.137954950 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:46.139004946 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:46.258054972 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:46.258979082 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:47.472023010 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:47.473351955 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.586268902 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.587061882 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.706535101 CET	8443	49924	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:47.706980944 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:47.707031012 CET	49924	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.707096100 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.707426071 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:47.827475071 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:48.841393948 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:48.841481924 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:48.869843006 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:48.878221035 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:48.989788055 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:48.998146057 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:50.200254917 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:50.200336933 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.304905891 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.305418968 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.425187111 CET	8443	49931	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:50.425259113 CET	49931	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.425311089 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:50.425375938 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.425643921 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:50.545480967 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:51.517923117 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:51.518052101 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:51.537313938 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:51.540441990 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:51.657248974 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:51.660311937 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:52.932281017 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:52.934743881 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.039432049 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.039938927 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.159593105 CET	8443	49938	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:53.159780025 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:53.159801960 CET	49938	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.159846067 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.160173893 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:53.280004025 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:54.343101978 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:54.343247890 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:54.343586922 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:54.344520092 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:54.463980913 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:54.464433908 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:55.689476013 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:55.689599037 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:55.804894924 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:55.805573940 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:55.925173998 CET	8443	49945	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:55.925231934 CET	49945	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:55.925482988 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:55.925549030 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:55.925822973 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:56.045670986 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:57.146234035 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:57.146332026 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:57.146836042 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:57.147813082 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:57.266809940 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:57.267723083 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:58.475217104 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:58.475322962 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.586188078 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.586756945 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.707041979 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:58.707236052 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.707346916 CET	8443	49951	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:58.707442045 CET	49951	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.708020926 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:58.828412056 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:59.841866016 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:59.841983080 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:59.842489958 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:59.843235970 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:55:59.962338924 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:55:59.963146925 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:01.142056942 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:01.142141104 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.258090973 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.258630037 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.540056944 CET	8443	49956	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:01.540070057 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:01.540169954 CET	49956	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.540216923 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.540501118 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:01.660321951 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:02.673418999 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:02.673562050 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:02.674197912 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:02.675164938 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:02.794028997 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:02.794985056 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:04.010540009 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:04.010777950 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.117486954 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.118254900 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.238147020 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:04.238267899 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.238688946 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.238970041 CET	8443	49963	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:04.239031076 CET	49963	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:04.358616114 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:05.420124054 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:05.420248032 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:05.420742035 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:05.421717882 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:05.540548086 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:05.541798115 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:06.733696938 CET	8443	49977	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:06.734105110 CET	49977	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:06.853046894 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:06.853533983 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:06.973273993 CET	8443	49970	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:06.973418951 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:06.973505974 CET	49970	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:06.973541021 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:06.973970890 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:07.093888998 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:08.110996008 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:08.114834070 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:08.115271091 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:08.116381884 CET	49983	8443	192.168.2.7	172.67.175.230
Nov 28, 2024 09:56:08.235264063 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:08.236386061 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:09.489054918 CET	8443	49983	172.67.175.230	192.168.2.7
Nov 28, 2024 09:56:09.489207983 CET	49983	8443	192.168.2.7	172.67.175.230

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 09:54:03.780816078 CET	64857	53	192.168.2.7	1.1.1.1
Nov 28, 2024 09:54:04.282191992 CET	53	64857	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 09:54:03.780816078 CET	192.168.2.7	1.1.1.1	0xf133	Standard query (0)	632313373.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 09:54:04.282191992 CET	1.1.1.1	192.168.2.7	0xf133	No error (0)	632313373.xyz		172.67.175.230	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:54:04.282191992 CET	1.1.1.1	192.168.2.7	0xf133	No error (0)	632313373.xyz		104.21.80.78	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:54:02
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\svchostinter.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\svchostinter.exe"
Imagebase:	0x400000
File size:	474'329 bytes
MD5 hash:	61F3C4028BB365ED68ECCB303B411043
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2498548092.00000000005E9000.00000004.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	38.6%
Signature Coverage:	9.1%
Total number of Nodes:	430
Total number of Limit Nodes:	28

Executed Functions

Function 00408BF0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 93
memorythreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 00408C4B
memset.MSVCRT ref: 00408C71
memcpy.MSVCRT ref: 00408CC3
WriteProcessMemory.KERNELBASE ref: 00408D04
VirtualProtect.KERNELBASE ref: 00408D28
CreateThread.KERNELBASE ref: 00408D50

Strings

H`, xrefs: 00408BF1
mE4kqO, xrefs: 00408C5B

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Virtual$AllocCreateMemoryProcessProtectThreadWritememcpymemset
String ID: H`$mE4kqO
API String ID: 3644383868-3654040606
Opcode ID: 6c35c4c5ada221d234b817fabaf15d9911ba988956b9acc0885e402b2b6c1c8f
Instruction ID: cac0480153a59e5539352c914c10efc6add790a6aff8883ae4d28b51f5392410
Opcode Fuzzy Hash: 6c35c4c5ada221d234b817fabaf15d9911ba988956b9acc0885e402b2b6c1c8f
Instruction Fuzzy Hash: 063140B1314B488ADB60DB26EC5435A77A1B789FC5F44412ADE4E47BA5EF3CC505C708

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 189
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.MSVCRT ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.MSVCRT ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID:
API String ID: 1640792405-0
Opcode ID: 5254e45e087a85d100be62b4d3bab9730fdab91b635e9821cef48185a4e82a6f
Instruction ID: 9a2f2e1b2e0b8451fe5b4773d30a19c68a0ff2cb1ea9d3261401347fc2407868
Opcode Fuzzy Hash: 5254e45e087a85d100be62b4d3bab9730fdab91b635e9821cef48185a4e82a6f
Instruction Fuzzy Hash: D371AFB1300B4486EB249F56E89076A33A1B745B89F88803BDF49A77E2DF3DC845C709

Function 02565E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02565FEC: malloc.LIBCMT ref: 02566008

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,?,-00000001,?,00000002,0255CC89), ref: 02565EAF
strrchr.LIBCMT ref: 02565EED
_snprintf.LIBCMT ref: 02565F9B

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: NameUser_snprintfmallocstrrchr
String ID:
API String ID: 1238167203-0
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 5de6b090cc77b5ba0bd35e2abd297c0a0c48329da9cf75467490d157f5f17777
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: AA41613071CA090FEB58AB6CE45567976D3FBC9310B54452EE48FC3395DE38D9428B4A

Function 0040B420 Relevance: 15.1, APIs: 10, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0040B43C

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2339723d0187d3eabc9d45bce590a14953fbf5ae0df4cc1581a2d70476cff4e5
Instruction ID: 0e5cfb8bbf21bf0993194779b11267c09d46698be9769d74b1dd0315f579f4f8
Opcode Fuzzy Hash: 2339723d0187d3eabc9d45bce590a14953fbf5ae0df4cc1581a2d70476cff4e5
Instruction Fuzzy Hash: 86316DB26017448BEB209B21E80875B76A0F745BA9F080229DF9E477E1EF3DD085C759

Function 0040B6C0 Relevance: 13.6, APIs: 9, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0040B6FA
CloseHandle.KERNEL32 ref: 0040B732
CloseHandle.KERNEL32 ref: 0040B73D
RemoveVectoredExceptionHandler.KERNEL32 ref: 0040B790
TlsSetValue.KERNEL32 ref: 0040B864

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 12305fd87e03c33788ad1de6dcfd4ff577b8c7d8d3cfc7a1d05ba0b34cfaa2d1
Instruction ID: 838aa30564aa730e25aa4d64eb7e2ecad8494aa8bb4ae8f820d1130e2e8d005c
Opcode Fuzzy Hash: 12305fd87e03c33788ad1de6dcfd4ff577b8c7d8d3cfc7a1d05ba0b34cfaa2d1
Instruction Fuzzy Hash: C3411B61602B0486EB15AF21D86436A3365EB94B58F04413BDE0A673E5EF3D8889C3DF

Function 0040A390 Relevance: 12.1, APIs: 8, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fc4c249f238666dcf3385c487c1139e4bb994c72b2bcde03ce0aaa01f58539
Instruction ID: 8fbd67ef3856b77e9e6fdc80194cadf88c811a842c6d7b08799867114ed892b6
Opcode Fuzzy Hash: c4fc4c249f238666dcf3385c487c1139e4bb994c72b2bcde03ce0aaa01f58539
Instruction Fuzzy Hash: 5F418272602B00A5DA15EF25DC407A93365F744B88F98843B9E4D27795EF3CD966C30A

Function 00408990 Relevance: 9.0, APIs: 6, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 004089A0
signal.MSVCRT ref: 004089B1
signal.MSVCRT ref: 004089C2
signal.MSVCRT ref: 004089D3
signal.MSVCRT ref: 004089E4
InitializeCriticalSection.KERNEL32 ref: 004089F0

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: signal$CriticalInitializeSection
String ID:
API String ID: 2323668733-0
Opcode ID: e2f8b48443e089b7d13c6f23e508881f49eb37b6aa7650f48109c74ef5e911f0
Instruction ID: 2d1d7027c2084158cf9b4c4f3212c8e2d908e6663a49682bb10b384cca9fa99b
Opcode Fuzzy Hash: e2f8b48443e089b7d13c6f23e508881f49eb37b6aa7650f48109c74ef5e911f0
Instruction Fuzzy Hash: 4101F4A0711701B1EB09FB25DC513A82311B794344FD0543BD74D626E5AFBC89AAC31F

Function 0255CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02565FEC: malloc.LIBCMT ref: 02566008

malloc.LIBCMT ref: 0255CB3B

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

Part of subcall function 0256C230: malloc.LIBCMT ref: 0256C29C

Part of subcall function 0256EAA8: malloc.LIBCMT ref: 0256EAF8

Part of subcall function 0256EAA8: realloc.LIBCMT ref: 0256EB07

malloc.LIBCMT ref: 0255CC4A
_snprintf.LIBCMT ref: 0255CCC1
_snprintf.LIBCMT ref: 0255CCE7
_snprintf.LIBCMT ref: 0255CD0E
free.LIBCMT ref: 0255CEC6

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction ID: 2509dfb4256131282d92bc2d0d7fe59381bef826010fca59d5f1056a240ff806
Opcode Fuzzy Hash: fd4b1ce187cf5d2c7b3c7d1d5f2f485ec143d87fcb2d796d9dd721ce5a89571b
Instruction Fuzzy Hash: 5FC1E330718B564BDB58BB78C8A927D72D3FBD8305F50052E984BC3691EF34D9068B8A

Function 0255E68C Relevance: 7.8, APIs: 5, Instructions: 260
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0255E725

Part of subcall function 0256F63C: _errno.LIBCMT ref: 0256F673
Part of subcall function 0256F63C: _invalid_parameter_noinfo.LIBCMT ref: 0256F67E

_snprintf.LIBCMT ref: 0255E7BD
_snprintf.LIBCMT ref: 0255E7D4
InternetQueryDataAvailable.WININET ref: 0255E87A
InternetCloseHandle.WININET ref: 0255E898

Part of subcall function 02562D70: strchr.LIBCMT ref: 02562DD6
Part of subcall function 02562D70: _snprintf.LIBCMT ref: 02562E0C

Part of subcall function 02562C0C: strchr.LIBCMT ref: 02562C69
Part of subcall function 02562C0C: _snprintf.LIBCMT ref: 02562CB3

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _snprintf$Internetstrchr$AvailableCloseDataHandleQuery_errno_invalid_parameter_noinfo
String ID:
API String ID: 1135463719-0
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 19c3d3be73e868561ecdd00b260ff474b4ccb85b00c007989321abd7d733806c
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: 7581D931618A588FDB14EF18D89567AB7E6FBD4315F00052EE88BC3150DF74DA06CB85

Function 0255F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 0255F042
WSAIoctl.WS2_32 ref: 0255F08F
closesocket.WS2_32 ref: 0255F0EE

Strings

_Cy, xrefs: 0255F0A1

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 59ec6e9f4d9e0422959774372c0dd4fb67c39660a833249d4352c887779b065b
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: 7431E33060CA584BCB54EF28989877ABBE1FBE9315F140A3FE88EC3261DB34C5428745

Function 0040BC40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 0040BCBB

Strings

once %p is %d, xrefs: 0040BCB1

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: once %p is %d
API String ID: 383729395-95064319
Opcode ID: 2ad18cde1ff5e43a0f61139fa673d496163d8a26a510f5dd8c97516348e47458
Instruction ID: cd003942fe01fc53c0a5c4bd15a0b3ee817a042379b8fa094bf983745c72ee8e
Opcode Fuzzy Hash: 2ad18cde1ff5e43a0f61139fa673d496163d8a26a510f5dd8c97516348e47458
Instruction Fuzzy Hash: 9D21AE76215B4485EA15AB16E80136AA3A4FB88BD4F48813AEF4D177A5EF3CC581C38D

Function 0255EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0255EB0C
InternetConnectA.WININET ref: 0255EB7A

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction ID: 74b1e5add3b2a9a09fabd7797773ea78d1de902edfab7f48058f3acde357f4ba
Opcode Fuzzy Hash: c02896be98f17698b461471e8597e5ae08ffedd86d74317b17a8770a829ca45e
Instruction Fuzzy Hash: 0941B230718B054FDB49EF28D8AA73977D2FB98305F11042EE48BD7651DB78DA068B4A

Function 023196B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0231977B

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction ID: c8b83c47d9817e739afb3a6aea8b4fb381970040eb8d4b5b2de9bcc4c1c6d0cd
Opcode Fuzzy Hash: 74d038c8b1c51bf1d7765a817c366e135375bbd51fab872694d5e2c19deb3bea
Instruction Fuzzy Hash: 5561AB36219B8486CA64CB0AE49035AB7A4F7C8B94F504525EFCE83B28DF3DD555CB00

Function 02319324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 02319471

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction ID: b83712c66724fbf5ccbef8ae7081ef7219d7f746a06754e28db4b2874859f63d
Opcode Fuzzy Hash: 614a4b05fd2fcf958961d58200ae62ff8fa006310eb0dba3dbba10185b0029ad
Instruction Fuzzy Hash: 4C41C272628B8487CB64CB1AE49171AB7A1F3C8B94F101225FACE83B68DF3CD4518F00

Non-executed Functions

Function 0232239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 023223FD

Part of subcall function 02320A00: _getptd.LIBCMT ref: 02320A16
Part of subcall function 02320A00: __updatetlocinfo.LIBCMT ref: 02320A4B
Part of subcall function 02320A00: __updatetmbcinfo.LIBCMT ref: 02320A72

_errno.LIBCMT ref: 02322402

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_fileno.LIBCMT ref: 0232242F

Part of subcall function 02324E54: _errno.LIBCMT ref: 02324E5D
Part of subcall function 02324E54: _invalid_parameter_noinfo.LIBCMT ref: 02324E68

write_multi_char.LIBCMT ref: 02322A6B
write_string.LIBCMT ref: 02322A88
write_multi_char.LIBCMT ref: 02322AA5
write_string.LIBCMT ref: 02322B04
write_string.LIBCMT ref: 02322B3B
write_multi_char.LIBCMT ref: 02322B5D
free.LIBCMT ref: 02322B71
_isleadbyte_l.LIBCMT ref: 02322C42
write_char.LIBCMT ref: 02322C58
write_char.LIBCMT ref: 02322C79
_errno.LIBCMT ref: 02322D7C
_invalid_parameter_noinfo.LIBCMT ref: 02322D87

Strings

@, xrefs: 0232241B
, xrefs: 02322A3F

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: 149cb80c69317d37b6b94d6e1d9a8f9eb178026a8553c04f862245b9fce1d3a3
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: 94422172608AB486EB29CF29DD443BF7BB5F745B88F141006DE4A17AA9DB78C548CB01

Function 02572F9C Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 02571600: _getptd.LIBCMT ref: 02571616
Part of subcall function 02571600: __updatetlocinfo.LIBCMT ref: 0257164B
Part of subcall function 02571600: __updatetmbcinfo.LIBCMT ref: 02571672

_errno.LIBCMT ref: 02573002

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_fileno.LIBCMT ref: 0257302F

Part of subcall function 02575A54: _errno.LIBCMT ref: 02575A5D
Part of subcall function 02575A54: _invalid_parameter_noinfo.LIBCMT ref: 02575A68

write_multi_char.LIBCMT ref: 0257366B
write_string.LIBCMT ref: 02573688
write_multi_char.LIBCMT ref: 025736A5
write_string.LIBCMT ref: 02573704
write_multi_char.LIBCMT ref: 0257375D
free.LIBCMT ref: 02573771
_isleadbyte_l.LIBCMT ref: 02573842
write_char.LIBCMT ref: 02573858
write_char.LIBCMT ref: 02573879
_errno.LIBCMT ref: 0257397C
_invalid_parameter_noinfo.LIBCMT ref: 02573987

Strings

@, xrefs: 0257301B
, xrefs: 0257363F

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction ID: d787592a40c6018d403b519966679071ebbcc61872558a2770955bf57b6677e7
Opcode Fuzzy Hash: 0599035506f01076b605f9026c3628a483f4ccd483033c44f83e2593a1d2db07
Instruction Fuzzy Hash: C0527A70998B499ADB2C8B1CE845379BBE1FB95334F1406ADD8C7C3291DB34D802DB4A

Function 02572528 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02571600: _getptd.LIBCMT ref: 02571616
Part of subcall function 02571600: __updatetlocinfo.LIBCMT ref: 0257164B
Part of subcall function 02571600: __updatetmbcinfo.LIBCMT ref: 02571672

_errno.LIBCMT ref: 0257258E

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_fileno.LIBCMT ref: 025725BB

Part of subcall function 02575A54: _errno.LIBCMT ref: 02575A5D
Part of subcall function 02575A54: _invalid_parameter_noinfo.LIBCMT ref: 02575A68

write_multi_char.LIBCMT ref: 02572BEB
write_string.LIBCMT ref: 02572C08
write_multi_char.LIBCMT ref: 02572C25
write_string.LIBCMT ref: 02572C84
write_multi_char.LIBCMT ref: 02572CDD
free.LIBCMT ref: 02572CF1
_isleadbyte_l.LIBCMT ref: 02572DC2
write_char.LIBCMT ref: 02572DD8
write_char.LIBCMT ref: 02572DF9
_errno.LIBCMT ref: 02572EF3
_invalid_parameter_noinfo.LIBCMT ref: 02572EFE

Strings

, xrefs: 02572BBF

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction ID: f7ed6623839240970a92273354ba52fc505c80c8273caae9024502c7a171d7e9
Opcode Fuzzy Hash: 99560b4e6a3ba651302837abcdacc877c80be0c82fbf8e81c16206e006ab6ccb
Instruction Fuzzy Hash: 5D522A30998B498ADB2C8B5CE855379BBE1FB95314F24462DDCCBC3152DB34D843878A

Function 02321928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02321989

Part of subcall function 02320A00: _getptd.LIBCMT ref: 02320A16
Part of subcall function 02320A00: __updatetlocinfo.LIBCMT ref: 02320A4B
Part of subcall function 02320A00: __updatetmbcinfo.LIBCMT ref: 02320A72

_errno.LIBCMT ref: 0232198E

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_fileno.LIBCMT ref: 023219BB

Part of subcall function 02324E54: _errno.LIBCMT ref: 02324E5D
Part of subcall function 02324E54: _invalid_parameter_noinfo.LIBCMT ref: 02324E68

write_multi_char.LIBCMT ref: 02321FEB
write_string.LIBCMT ref: 02322008
_errno.LIBCMT ref: 023222F3
_invalid_parameter_noinfo.LIBCMT ref: 023222FE

Strings

0, xrefs: 02321D28
-, xrefs: 02321F9C

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 9895dae6e2ed54cce86814d90ca3c7c3bca8bbc3b8d6794cb9e93ae5862d958f
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: 6C3245726087B486EB24CF19DA447BF7B75F741B88F141106DF8A07A6ADB39C549CB00

Function 02325914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0232596A
_errno.LIBCMT ref: 02325971
_invalid_parameter_noinfo.LIBCMT ref: 0232597C

Strings

U, xrefs: 02325EDE

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: e35a0dbdd35af75447294aa6a773b800f3cb5c775c4dbf3170ae33df22d42f4c
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 160212732147A586DB24CF28E48836EB765F788B98F944116EB8A47B58DB3DC24DCB10

Function 004020B0 Relevance: 24.8, APIs: 5, Strings: 11, Instructions: 818COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00404F45

Strings

not in 0 .. , xrefs: 004071AD, 0040727B
IndexDefect, xrefs: 0040704F
RangeDefect, xrefs: 00405053
sysFatal, xrefs: 00405214, 00407300
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 004020E1, 00402640
index , xrefs: 00407153
.. , xrefs: 00404FC2
fatal.nim, xrefs: 0040521F, 00407312
value out of range: , xrefs: 00404EF3
notin , xrefs: 004050F5
notin , xrefs: 00404F57

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: memcpy
String ID: .. $ not in 0 .. $ notin $ notin $00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$IndexDefect$RangeDefect$fatal.nim$index $sysFatal$value out of range:
API String ID: 3510742995-4272289982
Opcode ID: ac4e633d3e089151b616a83183c5873853405b69fc0888cad64d7c5ea4ac35e2
Instruction ID: 139d7255d6caab5e60f8fe1b97769dcebf786f24b373ad13566b6dae67c42522
Opcode Fuzzy Hash: ac4e633d3e089151b616a83183c5873853405b69fc0888cad64d7c5ea4ac35e2
Instruction Fuzzy Hash: 4A5279B2709B8486CB04CF16E94436EBAA1E785BD4F448137EF996BBD6DA3CC141C709

Function 02567B38 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 02567CA5
_snprintf.LIBCMT ref: 02567D66
_snprintf.LIBCMT ref: 02567D83
_snprintf.LIBCMT ref: 02567FD8
_snprintf.LIBCMT ref: 025680E8
_snprintf.LIBCMT ref: 025681A6
_snprintf.LIBCMT ref: 0256825E
_snprintf.LIBCMT ref: 02568002

Part of subcall function 0256F63C: _errno.LIBCMT ref: 0256F673
Part of subcall function 0256F63C: _invalid_parameter_noinfo.LIBCMT ref: 0256F67E

_snprintf.LIBCMT ref: 02568276
_snprintf.LIBCMT ref: 02568334

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: d63e76d1219a4acc62b8cfb7990155713016bb8a1cbdf859b61aae65f3610daa
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 0C52D02061CE899BE71AAB2CD8456F1F3E0FFA8309F445618D986C7521FB34E587CB85

Function 02316F38 Relevance: 13.0, APIs: 10, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 02317166
_snprintf.LIBCMT ref: 02317183
_snprintf.LIBCMT ref: 023170A5

Part of subcall function 0231EA3C: _errno.LIBCMT ref: 0231EA73
Part of subcall function 0231EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0231EA7E

_snprintf.LIBCMT ref: 023173D8
_snprintf.LIBCMT ref: 02317734

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: f192b28abaa97a7befa3a22c8f6fbe920b7639099d2fc3c37842e47045a9dc08
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: F932B762614E8592EB29CF2DE0012E9F3B1FF98799F446501DF8917B24EF39D2A6C740

Function 00409020 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00409034
RtlLookupFunctionEntry.KERNEL32 ref: 0040904B
RtlVirtualUnwind.KERNEL32 ref: 0040908D
SetUnhandledExceptionFilter.KERNEL32 ref: 004090D1
UnhandledExceptionFilter.KERNEL32 ref: 004090DE
GetCurrentProcess.KERNEL32 ref: 004090E4
TerminateProcess.KERNEL32 ref: 004090F2
abort.MSVCRT ref: 004090F8

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: bb24dcd72ede2996afa9bc0150d18b4d41fca027df9be25fbeb809aa15379045
Instruction ID: 1fa863f79e76734e06136947bea85831ffdf298910a00a75445ae38b2a455a66
Opcode Fuzzy Hash: bb24dcd72ede2996afa9bc0150d18b4d41fca027df9be25fbeb809aa15379045
Instruction Fuzzy Hash: 752134B1210F44D6EB008B61FC8439A33A4F709B9AF44403ADB4E53766EF38C549C709

Function 00408F40 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00408F85
GetCurrentProcessId.KERNEL32 ref: 00408F90
GetCurrentThreadId.KERNEL32 ref: 00408F99
GetTickCount.KERNEL32 ref: 00408FA1
QueryPerformanceCounter.KERNEL32 ref: 00408FAE

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: f81bd6a2d954b141d02c597524e54509314565fd85326cddcb6073b702ce88a5
Instruction ID: 1ab052486b6980cd13c945f267ece4b33b31840eb03ce5e8bfca5b0c136d368b
Opcode Fuzzy Hash: f81bd6a2d954b141d02c597524e54509314565fd85326cddcb6073b702ce88a5
Instruction Fuzzy Hash: E8118C66711B1486FB204B25FC0831673A0F789BB6F081671AE9C53BA4EB3DC8C5C348

Function 0232B7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

<, xrefs: 0232BE6E
, xrefs: 0232BE63
ailure #%d - %s, xrefs: 0232C41F, 0232C498, 0232C511, 0232C58A
e ', xrefs: 0232C405, 0232C47E, 0232C4F7, 0232C570

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 382187fff49568d689fad987d8cd5b25ce7abffcf61c17a4a57327b3fda716f4
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 4B92D2B2325A8087DB58CB1DE4A573AB7A1F3C8B84F44512AEB9B87794CE3CD551CB04

Function 0040D110 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040D18E
IsDebuggerPresent.KERNEL32 ref: 0040D1B3
RaiseException.KERNEL32 ref: 0040D1D9

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: DebuggerExceptionPresentRaisefree
String ID:
API String ID: 462861877-0
Opcode ID: db907abfda9dd41e16d4645478f89d6fbd9f9d8eecfa10e887882d7b24497a4f
Instruction ID: 0d78b2f57df09908e35439bc228b784935e18de2371cc85dad8d2a61f81cdcac
Opcode Fuzzy Hash: db907abfda9dd41e16d4645478f89d6fbd9f9d8eecfa10e887882d7b24497a4f
Instruction Fuzzy Hash: 9321D5727017848BFA258FA5A84035B7694EB487E4F08423A9F4E5B7C1EF3CC949C604

Function 00401B20 Relevance: 2.9, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

IndexDefect, xrefs: 0040704F
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00401B48, 0040205E

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$IndexDefect
API String ID: 0-1475264344
Opcode ID: 987d171a259b67f2fc5e837d494cce35584c05ccefa1364bda7b5a8fcee2f098
Instruction ID: 4487049c97ed80a629223fa68b3a00cad483b1da0384370679db1a397d2c2f51
Opcode Fuzzy Hash: 987d171a259b67f2fc5e837d494cce35584c05ccefa1364bda7b5a8fcee2f098
Instruction Fuzzy Hash: 83D1ACA37096D48BCB25CB27A9003B9BE629399BC5F448133EF8997BE6D53CC502D705

Function 0232C397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

ailure #%d - %s, xrefs: 0232C41F, 0232C498, 0232C511, 0232C58A
e ', xrefs: 0232C405, 0232C47E, 0232C4F7, 0232C570

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 60aae165bfc84964545b7f5beba85bf95fd664ff921401e48698e734981942d6
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: E4510DB62146508BDB14CB0DE49472AB7E1F3CC794F84561AE38B8B768DA3CD745CB40

Function 025701A8 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 025701DC

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction ID: c3bfdbefa136ca24a0ef41226ea53ad0748f40e1e6c8779910a2fdfef584c307
Opcode Fuzzy Hash: c8c90554330dcabd03fa81e8dd660722591610607187a6cda5de2b4df199049a
Instruction Fuzzy Hash: 61A1CC71619A098FEF94FFB5E8989AA37B2F768301321893A904AC3174DBBCD545CF44

Function 0257DBF0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: d2813578896444667d55133aa5b949e9ff813d74310c13b704bcaff42d64bc9f
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 8B520A312286558FD31CCB1CC5B1B7AB7E1FB89340F44896DE287CB692C639DA45CB91

Function 0257D280 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: bd505f3fa0af235cfb62bc91b7ffcb250c32e9cd16b84365ead805b983ab0aa6
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 0752FE312286558FD31CCF1CD4A1E7AB7E1FB8D340F448A6DE28ACB692C639D545CB91

Function 0232CFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: d03e926d629e47d30536953b8627a7c04ed4e7bff3f886876d7d87fc2f732a5f
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: B55240B23149458BDB08CB1DE4A573AB7A1F3C9B80F44852AE7978B799CE3DD654CB00

Function 0232C680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: d7d1ac0ad26b2fdb76843183cc5d5aef81cc6bed68beb4552b474e6eaa9bd14d
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 065251B23149808BD708CF1DE4A573AB7E1F3C9B80F44852AE7868B799CA7DD645CB40

Function 02309680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 40eb80aeda8014e7cd1113d868d1e3bcfe53d9a318e578e84bd941749297ac62
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: CFE19472704A4286DB30DB26E4E03AEA7A6F784B98F900115DE4D87BD9EF38D945CF50

Function 0230CE3C Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction ID: ad2f95aca1f14930b7c4586ad593c89b477db2d3ed4f090e32959f06977ffab3
Opcode Fuzzy Hash: f74bee57ece39a3ee739721ddd6b8b7c874878cbec99e002ba7fd2a6b2694298
Instruction Fuzzy Hash: 2EE1B072B1074587EB28DB75EC9036A63A2F788758F489525CB8E97B91EF3CE142C710

Function 0230916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: f4f68e7f162c3702be3ee408d94be190074e9e9c467ac74cd4ca16bce6447fef
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: C4D1F772304A8692DF20DFA9D4E03AEA766F7C4B98B801112DF4E97AD9EF34C545CB50

Function 00403170 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ab33150dc87537f52f510b2e2ba2788a4a1a4a0e08b5ed49d10625436f39f3
Instruction ID: 130ab9c66f48fc49147ca85b718d939e63edffa8eb978330eb583c533b4ce2b2
Opcode Fuzzy Hash: 26ab33150dc87537f52f510b2e2ba2788a4a1a4a0e08b5ed49d10625436f39f3
Instruction Fuzzy Hash: 14818972710A9942DB299F06D9503BD2A19EB41BC6F54823FDE2A2BBC5CE7CC744E344

Function 02310334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: da8a7b0252b395f43669229ec63b0206e8a7c2e96de3c4745e1e1f70219a61b3
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: E4614732718B4486EB28DF65E88831E73A1F788B94F00552ADE8D83B54DF7DC695CB50

Function 00460360 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddc742aaed828b3c152fccf7f922b45e1de6538d3417b6e85cad7233f89815a
Instruction ID: 176edfa63ab6d7091f41a4adf3b026887b019585281315ecd56fd0d161b059ae
Opcode Fuzzy Hash: 0ddc742aaed828b3c152fccf7f922b45e1de6538d3417b6e85cad7233f89815a
Instruction Fuzzy Hash: 4B4141D7A4EEC44BE3334ABC4D6A16B2F50E5A2E1634E809BC7C046343F95E6C45875B

Function 004603A8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b46f11850a27ad5e7fd551e2bb98776caf15904dae9729d6ef039d5c0aafcff
Instruction ID: 36e8ef160cf6648d11ce99ecd9595eb06e52ad85a45ab5d40c31406b9e80f10e
Opcode Fuzzy Hash: 9b46f11850a27ad5e7fd551e2bb98776caf15904dae9729d6ef039d5c0aafcff
Instruction Fuzzy Hash: 6A311CE794EEC44FE3334AB88D6A16B3F50E5A2E0534E909BC7C042383F95E5846865B

Function 00460498 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b35e1b5f6a629d6a7a56c5a219b4f95b7861e3c92cf6fbf46a5b912a6fa943
Instruction ID: 4f396a1652b34ae0b81d28ae8c1af0f663cbb833eb6d2d48511bb4e892297c7f
Opcode Fuzzy Hash: 08b35e1b5f6a629d6a7a56c5a219b4f95b7861e3c92cf6fbf46a5b912a6fa943
Instruction Fuzzy Hash: 04E07D9B59FBC44BE3724AB84C2612F3F90A592E1534ED05BD7C006357FA5E1C018747

Function 0040F182 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c19b7c04672bdd807de61d25cecd1bb598812f09de83fe84ccece8b14e096b
Instruction ID: 8d6d0f526f5991f3f2719662f04be795b625ebb6f75d0d077600621befd88549
Opcode Fuzzy Hash: d6c19b7c04672bdd807de61d25cecd1bb598812f09de83fe84ccece8b14e096b
Instruction Fuzzy Hash: FCB01263498C4040C3000B34CC113A12734C717213F082820424442102D51EC004D119

Function 00407910 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040796D
memset.MSVCRT ref: 00407995
memcpy.MSVCRT ref: 004079C2
MessageBoxA.USER32 ref: 004079D2
exit.MSVCRT ref: 004079F3
memset.MSVCRT ref: 00407A21
memcpy.MSVCRT ref: 00407A4E

Strings

(bad format; library may be wrong architecture), xrefs: 00407A07, 00407A61
could no, xrefs: 004079A4
could not load: , xrefs: 0040793A
t load: , xrefs: 004079B3
t load: , xrefs: 00407A3F
could no, xrefs: 00407A30

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: memcpymemset$ErrorLastMessageexit
String ID: (bad format; library may be wrong architecture)$could no$could no$could not load: $t load: $t load:
API String ID: 4261093211-3226591272
Opcode ID: 5c3dc128efc428a3275372bf247cbb7ab0254a3da5540f214b369ba6ceb24773
Instruction ID: bc7baa4db96d661a53ad6f20f97c030e1de77e3f49d0b69ef48cc7b89f3fb243
Opcode Fuzzy Hash: 5c3dc128efc428a3275372bf247cbb7ab0254a3da5540f214b369ba6ceb24773
Instruction Fuzzy Hash: 963103A4B10B5096EF24E763E88970E6355F789B88F84003AAF4D17BC5EE7CC601C309

Function 00409540 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(0045F610,00007FFB2B31ADA0,?,?,?,00000001,0040124C), ref: 0040966D

Strings

Unknown pseudo relocation bit size %d., xrefs: 004097DA
Unknown pseudo relocation protocol version %d., xrefs: 004097EE

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 0d52ca2488176759e471788828c9a841f5c47ec2d898bbec25ad29b593758d2e
Instruction ID: 792004d391c2955495595ebe6980ceca82694c3fff85f4de56ca0c4668c473bb
Opcode Fuzzy Hash: 0d52ca2488176759e471788828c9a841f5c47ec2d898bbec25ad29b593758d2e
Instruction Fuzzy Hash: 089148B2B1064087EB289B7AD88071E6351B7957A4F54853BCE09A77E7DA3DCC82C30D

Function 0040CAF0 Relevance: 16.7, APIs: 11, Instructions: 153sleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 0040CB6C
Sleep.KERNEL32 ref: 0040CB81

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 70b18ee85442ce07223aefa82a0f7b74d5afbb088bba213f01f88a6fe24a6a28
Instruction ID: d2c6c81d3b24b5666eb54a8fb0ee2db3d262af85fb7ced23c32579efc86f29e9
Opcode Fuzzy Hash: 70b18ee85442ce07223aefa82a0f7b74d5afbb088bba213f01f88a6fe24a6a28
Instruction Fuzzy Hash: 3B516B72205740C6E7249F31E89476A32A4FB45BA8F14433ADE2A677D8DB3CC886C749

Function 02576E1C Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02576E4E

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 02576E45

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

__doserrno.LIBCMT ref: 02576EAB
_errno.LIBCMT ref: 02576EB2
_invalid_parameter_noinfo.LIBCMT ref: 02576F16

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction ID: aa13b6a051a232ed88e5331b557d59f02270026b3b2e82165244c9650f65856f
Opcode Fuzzy Hash: f569b21a01fad2a92039226acf8a97d91cb16fac7f3924a9cc2c8e1a455bf938
Instruction Fuzzy Hash: D73109712A8F068FD319AF68F88223D37D5FFC2320B51465DD81A872A1D774DC028B9A

Function 02321B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 02321FEB
write_string.LIBCMT ref: 02322008
write_multi_char.LIBCMT ref: 02322025
write_string.LIBCMT ref: 02322084
write_multi_char.LIBCMT ref: 023220DD
free.LIBCMT ref: 023220F1

Strings

, xrefs: 02321FBF

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: 94b457dd8e7faec56a4b1620dba6c5074affa93c8eaf2a0cafe101a06186eaa0
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 73914333608BA486EB20CB65EA043AF7B75F785B98F145106DF8E17B99DB39C549CB00

Function 00409A90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00409AE9
signal.MSVCRT ref: 00409B42
signal.MSVCRT ref: 00409B9E
signal.MSVCRT ref: 00409C53

Strings

CCG , xrefs: 00409AA5

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 0ab87b4a50ea78b41d28c6267fe576f2f59e1723e3c7c2edc2ef254713f30041
Instruction ID: c07ff436305f65fca0d3e9686ad711302059dd880c37d3d19a689c5147771547
Opcode Fuzzy Hash: 0ab87b4a50ea78b41d28c6267fe576f2f59e1723e3c7c2edc2ef254713f30041
Instruction Fuzzy Hash: 04316060B0950045FA789279645533A3161BB9A338F28873BD92AE73E7CD3DACC1821F

Function 0040E4F0 Relevance: 15.2, APIs: 10, Instructions: 201synchronizationCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFB2CE5F230,0040E830,?,?,0040EC9B), ref: 0040E53B
WaitForSingleObject.KERNEL32 ref: 0040E56F
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFB2CE5F230,0040E830,?,?,0040EC9B), ref: 0040E5AA
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFB2CE5F230,0040E830,?,?,0040EC9B), ref: 0040E5FD
ResetEvent.KERNEL32 ref: 0040E775

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID:
API String ID: 654736092-0
Opcode ID: 5f293930599933c415515305ebfb5741409f659763790fc2eeeb6062e36a501e
Instruction ID: 793158b392908c92af3cef7151643e908834b37e5d0ca55c2dd239f64044f790
Opcode Fuzzy Hash: 5f293930599933c415515305ebfb5741409f659763790fc2eeeb6062e36a501e
Instruction Fuzzy Hash: 4A51BF2130420042FB246BABADC136F02499B95798F984D37DF49A67D1E93ECCA7921A

Function 004085F0 Relevance: 15.2, APIs: 6, Strings: 4, Instructions: 155stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408610
memcpy.MSVCRT ref: 00408686
strlen.MSVCRT ref: 004086B1
memcpy.MSVCRT ref: 004087B4

Strings

nhandled, xrefs: 0040863C
excepti, xrefs: 0040864A
Error: u, xrefs: 00408628
on: , xrefs: 00408632

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: memcpy$memsetstrlen
String ID: excepti$Error: u$nhandled$on:
API String ID: 2350177629-1220997370
Opcode ID: 3a188c2db38c1550aa1cc745d18a5f31c053dd965958c4e3028a7b69cc3c6742
Instruction ID: 73d335d02615490dc27db1ba43bc93333880fd435138239ff8f71ef3fda031ca
Opcode Fuzzy Hash: 3a188c2db38c1550aa1cc745d18a5f31c053dd965958c4e3028a7b69cc3c6742
Instruction Fuzzy Hash: 49510522315B4091EE11AF12EA057AA6350F781BC4F98853BEF8A2B785EF3CD555C309

Function 02577C08 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02577C33

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 02577C2B

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

__lock_fhandle.LIBCMT ref: 02577C77
_lseeki64_nolock.LIBCMT ref: 02577C90
_unlock_fhandle.LIBCMT ref: 02577CB3

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction ID: e6f7309843403655be8f651cd065c67d73037e512ae98bd3aaa7ef9d6c77f9dc
Opcode Fuzzy Hash: 1a0056bbafc3a7faafb75a0a5683c60387dc6450d26c6e1c9b28f7a797692c5c
Instruction Fuzzy Hash: 0C213A30698A014FF319AB5CF84233DB6D6FFCE321F55065DE01AC72A1D77458018BAA

Function 02577A90 Relevance: 15.1, APIs: 10, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02577ABB

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 02577AB3

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

__lock_fhandle.LIBCMT ref: 02577AFF
_lseek_nolock.LIBCMT ref: 02577B18
_unlock_fhandle.LIBCMT ref: 02577B39

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction ID: 1d5c35e418e64b2daa104d906177aeaa79c6d4e7ac304a6d2019fe9bec5d1643
Opcode Fuzzy Hash: af586274eb7c0247a5ed565ce490a43ddd2b1adc4c580e4a875ff27a69eb19f0
Instruction Fuzzy Hash: 1F2107316986014FD3196B68FC8237DB7D1FFC6331F15065DD45E87291E77458018BAA

Function 0232621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0232624E

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 02326245

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

__doserrno.LIBCMT ref: 023262AB
_errno.LIBCMT ref: 023262B2
_invalid_parameter_noinfo.LIBCMT ref: 02326316

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 670a99c08a6835d409c155f6bc057a00cf5dd4c728eaafac9100ba41511c25f7
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: 572136323107B486C7266F659E8132D365ABBC1BA0F858129CF69277A2CB78C44ECF50

Function 004075E0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 57stringCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 0040763D
strlen.MSVCRT ref: 0040768E

Strings

SIGFPE: Arithmetic error., xrefs: 00407608
SIGILL: Illegal operation., xrefs: 0040761E
SIGINT: Interrupted by Ctrl-C., xrefs: 004075E4
unknown signal, xrefs: 00407614
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 004075F0
SIGABRT: Abnormal termination., xrefs: 004075FC

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: exitstrlen
String ID: SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$unknown signal
API String ID: 4213389737-3987738871
Opcode ID: 7083bacc55c54cadf4e226d2b89bf412faec1f40c517a61529750faa2a6676d6
Instruction ID: 8a7ee2ab0c04ae1dcaede8fea5fbbab4dc121a1e6145f7c85218f631294eeb7c
Opcode Fuzzy Hash: 7083bacc55c54cadf4e226d2b89bf412faec1f40c517a61529750faa2a6676d6
Instruction Fuzzy Hash: 2911DD62A28F4096EB08CB15F88036A7766F7847C8FC4803AEA4F13BA5DB3CC445C749

Function 0040C610 Relevance: 13.7, APIs: 9, Instructions: 170COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 0040C649

Part of subcall function 0040B420: TlsGetValue.KERNEL32 ref: 0040B43C

SetEvent.KERNEL32 ref: 0040C6A8
SetEvent.KERNEL32 ref: 0040C79F

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Event$HandleInformationValue
String ID:
API String ID: 211894710-0
Opcode ID: 0b33cd9ce3a8a4f4c457f7f3b7084165053afb707c15325a94261b9c8985c2d7
Instruction ID: 1195ec8958e7dcde6adc29c0c82d8ff03a11be5d1b09b5c60e888fe0fd953098
Opcode Fuzzy Hash: 0b33cd9ce3a8a4f4c457f7f3b7084165053afb707c15325a94261b9c8985c2d7
Instruction Fuzzy Hash: EE51D563601A40C6DB25EB35988437A2760EB85BB9F084736DF29673D5EF3DC8859309

Function 0232F150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0232F176
_errno.LIBCMT ref: 0232F16B

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: ca0066228d39cdfa63cd7e5f18f54230c1de6b2a00e18904d15f3f34632c80e3
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 1841397A6203B586DF24AB22D6403B977B1E756FE8FD04221DB9447F85D738D14ACB80

Function 0040E850 Relevance: 13.6, APIs: 9, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0040E7C0: EnterCriticalSection.KERNEL32(?,?,004015EB,?,?,?,0040EC9B), ref: 0040E7F0
Part of subcall function 0040E7C0: LeaveCriticalSection.KERNEL32(?,?,0040EC9B,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E806

TryEnterCriticalSection.KERNEL32 ref: 0040E917
LeaveCriticalSection.KERNEL32 ref: 0040E953

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b80d242db8871881959d63be79deda96f2e820f442738c3c62611786bb3a5a8f
Instruction ID: 8010976068a9ec9b0fe6d1c59ca2451cd508571b3fb02b2a82bd86f65d7e79d4
Opcode Fuzzy Hash: b80d242db8871881959d63be79deda96f2e820f442738c3c62611786bb3a5a8f
Instruction Fuzzy Hash: A731A32370060485DB50EF37EC107AA2350B781BB8F9C4A379E69A73D4DE79C896C319

Function 02576434 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0257645F

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 02576457

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

__lock_fhandle.LIBCMT ref: 025764A3
_unlock_fhandle.LIBCMT ref: 025764DD

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction ID: 5f642d4cf6135f1ae90a2568026df0a053e0bc0e654b06a9657d5c1e51cd6e21
Opcode Fuzzy Hash: c89056d156aae0bb9c491ae48c02d203d405bbf82af9f534bcd04b22b5544d86
Instruction Fuzzy Hash: 57214930A9CE014FE319AB68F89233C36D6FFC2331F15066DD11A87295D7649C018BAE

Function 0040E350 Relevance: 13.6, APIs: 9, Instructions: 84COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0040E37B
CreateSemaphoreA.KERNEL32 ref: 0040E3BC
CreateSemaphoreA.KERNEL32 ref: 0040E3D2
InitializeCriticalSection.KERNEL32(?,0040D7A2,?,00000008,?,0040D83D,?,?,?,0040D8B5,?,?,?,?,0040DD04), ref: 0040E3F7
InitializeCriticalSection.KERNEL32(?,0040D7A2,?,00000008,?,0040D83D,?,?,?,0040D8B5,?,?,?,?,0040DD04), ref: 0040E3FD
InitializeCriticalSection.KERNEL32(?,0040D7A2,?,00000008,?,0040D83D,?,?,?,0040D8B5,?,?,?,?,0040DD04), ref: 0040E403

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID:
API String ID: 2075313795-0
Opcode ID: 7c5b2dee2a6b0f7c37b70cb329606f72fd8f9d31c8e99c7063dea2c181cd0ea4
Instruction ID: 950476c27c72f8ac3162e1b4707e53c95a1688c5878a1ab4cfd70a3a5ba509ee
Opcode Fuzzy Hash: 7c5b2dee2a6b0f7c37b70cb329606f72fd8f9d31c8e99c7063dea2c181cd0ea4
Instruction Fuzzy Hash: 2D21DE3370270086EB699F76F9507AA2290EB45B99F084636CE6D4B3C8EE38C8D5C305

Function 02575C58 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02575C79

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 02575C71

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

__lock_fhandle.LIBCMT ref: 02575CBD
_close_nolock.LIBCMT ref: 02575CD0
_unlock_fhandle.LIBCMT ref: 02575CE9

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction ID: 59954942600dab4e71423586d040b96142bc2d725d16f9f16529a749ef45f2d8
Opcode Fuzzy Hash: d63a0d9a057a00514656f61d256491cfcc4309f98023220473e92bade8306c33
Instruction Fuzzy Hash: 541138325A9E414FD315AB68FC9532C7AD5FFC1321FA60A5CD81B872E1EA7498008B6D

Function 02327008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02327033

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 0232702B

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

__lock_fhandle.LIBCMT ref: 02327077
_lseeki64_nolock.LIBCMT ref: 02327090

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 131e5267e13bd04020953245a3cd981c9c0e5c67077d773fa7004c0a3225ffb8
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 5A1121327102B045EB222F269D0432DFA22B780BB5F49D7289E391B3D2CB3C844DCB65

Function 02326E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02326EBB

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 02326EB3

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

__lock_fhandle.LIBCMT ref: 02326EFF
_lseek_nolock.LIBCMT ref: 02326F18

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: e7f49048673746f419230ba945584e8b485e65d7badd0b483565e3b15d7838e8
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: EF1159327107B056DB22AF25D94132D7666BF80BA1F498124DB59177D1CB7CC84DCF54

Function 0256FF6C Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0256FF9A

Part of subcall function 0256F244: RtlFreeHeap.NTDLL ref: 0256F25A
Part of subcall function 0256F244: _errno.LIBCMT ref: 0256F264

free.LIBCMT ref: 0256FFAF
free.LIBCMT ref: 0256FFD0
free.LIBCMT ref: 0256FFE5
free.LIBCMT ref: 0256FFF9
free.LIBCMT ref: 02570005
free.LIBCMT ref: 02570030
free.LIBCMT ref: 02570051
free.LIBCMT ref: 0257006A
free.LIBCMT ref: 0257009B

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: 8289ecc8051c032a14c44ed9be2487dc4e6569983466467a2f4a9c4a28dde0be
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 31318D30665A0A8FEB64EF58FC98B7476D1F798319FA44069840AC36A0CB6CC945CF18

Function 0231F36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0231F39A

Part of subcall function 0231E644: _errno.LIBCMT ref: 0231E664

free.LIBCMT ref: 0231F3AF
free.LIBCMT ref: 0231F3D0
free.LIBCMT ref: 0231F3E5
free.LIBCMT ref: 0231F3F9
free.LIBCMT ref: 0231F405
free.LIBCMT ref: 0231F430
free.LIBCMT ref: 0231F451
free.LIBCMT ref: 0231F46A
free.LIBCMT ref: 0231F49B

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: aca89c9916bf0bb5a5dffd3f7de9ebe9c3ca45a646917dc76377c36ccea0157c
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: DB312A62302B4581FF2CFF15E8A93282361BB94BA4F8C1A66CD1E4AA61DF3CD645C701

Function 0040C050 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040C065

Part of subcall function 0040B420: TlsGetValue.KERNEL32 ref: 0040B43C

SetLastError.KERNEL32 ref: 0040C0A2
realloc.MSVCRT ref: 0040C0D3
realloc.MSVCRT ref: 0040C0E7
memset.MSVCRT ref: 0040C107
memset.MSVCRT ref: 0040C11D

Strings

DV@, xrefs: 0040C0F4, 0040C10C

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: ErrorLastmemsetrealloc$Value
String ID: DV@
API String ID: 1675512986-317671244
Opcode ID: 79c31ebe7f4bdeecb631282dbcd9b4f8ec3ec40d3a464655e247d68361bb97cb
Instruction ID: aba79bb59176af2bf5a1fb3d79f11858a982568f1b6aeac8b99ea9cbc0595748
Opcode Fuzzy Hash: 79c31ebe7f4bdeecb631282dbcd9b4f8ec3ec40d3a464655e247d68361bb97cb
Instruction Fuzzy Hash: B121A132311740DADB14DF3B988071E2791FB48FA8F4404369E4A17395EE3DC496C789

Function 0257FD50 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0257FD76
_errno.LIBCMT ref: 0257FD6B

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: df4cdaa694a6412fc3302ad7f6120a4fd1c706a9b3630bcb9d3d3a2089dfc6ca
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: 07419B30168E1B4FDB64EB28E4402B977D1FF54325F94026EE89AC7995E734C841C78E

Function 02325834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0232585F

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 02325857

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

__lock_fhandle.LIBCMT ref: 023258A3

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: fb83e5719c6e854ba1394326b2a5c2e18e97bf6c9c704f5b7a28ccaf0553aee4
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 88115932B102B046D7192F25DD4033D7A62A780BA1F898125DA191B3D2CBBCC949CB65

Function 02325058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02325079

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 02325071

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

__lock_fhandle.LIBCMT ref: 023250BD
_close_nolock.LIBCMT ref: 023250D0

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: 09d9bef296c3a15ac2791723105ef42564cc46987399ead0e5dc9d2a0a41914e
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: FC1129327106B445D7296F35ED8432C7A12A780BA1F998634CA5E473D2CB78C54ECB94

Function 0255460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 025546A9

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

malloc.LIBCMT ref: 025546B3

Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F318
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F31D

malloc.LIBCMT ref: 025546BE
free.LIBCMT ref: 0255487E
free.LIBCMT ref: 02554886
free.LIBCMT ref: 0255488E

Part of subcall function 025554F0: malloc.LIBCMT ref: 0255553A
Part of subcall function 025554F0: malloc.LIBCMT ref: 02555545
Part of subcall function 025554F0: free.LIBCMT ref: 0255562C
Part of subcall function 025554F0: free.LIBCMT ref: 02555634

free.LIBCMT ref: 0255489A
free.LIBCMT ref: 025548A7
free.LIBCMT ref: 025548B4

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction ID: c08d54a791e62ffed68687af53f575821a0a2c86d32cb4e138457965053fa312
Opcode Fuzzy Hash: 78c5723810e6e6d18fab4a62d391ea0db65c57382cb75ed74f6abc212771b6cb
Instruction Fuzzy Hash: BC81C430718B994BC729AE6CD86577A77D2FBC5714F44025FD88BC3242EF24D8468A8A

Function 02303A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 02303AA9

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

malloc.LIBCMT ref: 02303AB3

Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E718
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E71D

malloc.LIBCMT ref: 02303ABE
free.LIBCMT ref: 02303C7E
free.LIBCMT ref: 02303C86
free.LIBCMT ref: 02303C8E

Part of subcall function 023048F0: malloc.LIBCMT ref: 0230493A
Part of subcall function 023048F0: malloc.LIBCMT ref: 02304945
Part of subcall function 023048F0: free.LIBCMT ref: 02304A2C
Part of subcall function 023048F0: free.LIBCMT ref: 02304A34

free.LIBCMT ref: 02303C9A
free.LIBCMT ref: 02303CA7
free.LIBCMT ref: 02303CB4

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 00da23a19cd7c5c1e9559288d9132866ef889ec7a64f4a39de076a685b7d1fa2
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: 3561026231478546CF24EF2694A0B6F7B52FB85FC8F444029CE4A87B85DF39C446CB14

Function 00404E00 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00404F45
memcpy.MSVCRT ref: 00404FA7
memcpy.MSVCRT ref: 00405008

Strings

RangeDefect, xrefs: 00405053
.. , xrefs: 00404FC2
notin , xrefs: 00404F57
value out of range: , xrefs: 00404EF3

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: memcpy
String ID: .. $ notin $RangeDefect$value out of range:
API String ID: 3510742995-1184348040
Opcode ID: 45789f6dd39c18b8abe4ad4726f3c1d9abe1c64d6c9238dfd5403cb81f8e4944
Instruction ID: 5f1bf679f3c79b71b9578435cbfc27a5d8f6374eacb1aa8ca9e2611375506ca8
Opcode Fuzzy Hash: 45789f6dd39c18b8abe4ad4726f3c1d9abe1c64d6c9238dfd5403cb81f8e4944
Instruction Fuzzy Hash: DE61EF72710F8096DA04CB12E94475FA7A5F786BC8F458436EF492BB96DB3CC581CB08

Function 00409370 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0040941B
VirtualProtect.KERNEL32 ref: 004094C2
GetLastError.KERNEL32 ref: 004094D0

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00409517
Address %p has no image-section, xrefs: 0040952D
VirtualProtect failed with code 0x%x, xrefs: 004094D6

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: 3f14427b23f8e90e3e2ea69bc41f53ba9030e2cc55926c8a25e8bb2844c5cb9f
Instruction ID: 21e49a613193aac54918af74165f8c44c358ccebf9ace4db484552f77ef38229
Opcode Fuzzy Hash: 3f14427b23f8e90e3e2ea69bc41f53ba9030e2cc55926c8a25e8bb2844c5cb9f
Instruction Fuzzy Hash: 645102B3701A4086DB208F26EC4076E77A4E799BA4F448137DF09677A6DB3CC946C708

Function 0256FE10 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0256FE36

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_invalid_parameter_noinfo.LIBCMT ref: 0256FE42
__crtIsPackagedApp.LIBCMT ref: 0256FE53
_dosmaperr.LIBCMT ref: 0256FE9D

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction ID: cac283e2190cf535b0e13b2bff4bd682e465f528b5ba60f61592f708905e0039
Opcode Fuzzy Hash: cfbfe809ff06962f400f8854e8dfaca57605153f463412cb5835124c7fa4a529
Instruction Fuzzy Hash: 7F31A930A14A0A8FDB44AFBDE8493797AD1FF88315F14455DE44FC3291DB78C8418B46

Function 0040B8D0 Relevance: 10.6, APIs: 7, Instructions: 104sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A750: GetCurrentThreadId.KERNEL32 ref: 0040A784

TlsSetValue.KERNEL32 ref: 0040B913
GetCurrentThreadId.KERNEL32 ref: 0040B919
_setjmp.MSVCRT ref: 0040B93C
CloseHandle.KERNEL32 ref: 0040B976
Sleep.KERNEL32 ref: 0040B9D9
TlsSetValue.KERNEL32 ref: 0040BA76
_endthreadex.MSVCRT ref: 0040BA83

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentThreadValue$CloseHandleSleep_endthreadex_setjmp
String ID:
API String ID: 398069486-0
Opcode ID: b8cc304627b65d474944d2ecb7afef2e8706cde166060d858e39debea6284711
Instruction ID: 6cd1cd227020b8c6ba33d9f8f6700b0e04a8e10d5f9d89813a7f35f434339870
Opcode Fuzzy Hash: b8cc304627b65d474944d2ecb7afef2e8706cde166060d858e39debea6284711
Instruction Fuzzy Hash: D6411AA5200B0485DB14EF26D8513692760EB88BA8F09523B9F1E677A6DF3CC485C789

Function 0257A73C Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0257A755

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__lock_fhandle.LIBCMT ref: 0257A79D
__doserrno.LIBCMT ref: 0257A7D2
_errno.LIBCMT ref: 0257A7D9
_unlock_fhandle.LIBCMT ref: 0257A7E9

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction ID: 6163a831ad5bc7e520757b0c5947af497149ca0414c0c6c8e7acec4ceb57488b
Opcode Fuzzy Hash: 9341880fa3ae8ea43da77f4714028596b22b009dd5c4526b8d460d71b2af8a07
Instruction Fuzzy Hash: 74215730698B024FD314AFA8F8A032D7AA1FF81320F55051CE51BCB291D7789C418B9E

Function 0231F210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0231F236

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0231F242
__crtIsPackagedApp.LIBCMT ref: 0231F253
_dosmaperr.LIBCMT ref: 0231F29D

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 9ff70db9f6f923c5caea99feef8f44b6aceb8e0c419ca18cc2a0a4efbd1db6e7
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: 7621A779310F5086EB28AF66D80432977E6FBC9B94F084624CE8947B95DF3CC2468740

Function 0232EFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0232F004

Part of subcall function 02320A00: _getptd.LIBCMT ref: 02320A16
Part of subcall function 02320A00: __updatetlocinfo.LIBCMT ref: 02320A4B
Part of subcall function 02320A00: __updatetmbcinfo.LIBCMT ref: 02320A72

_errno.LIBCMT ref: 0232F01F
_invalid_parameter_noinfo.LIBCMT ref: 0232F02A

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: a62c7fa7eeb4e9354c40582a7a781908c93d0f9f403483e3efd2beea7e61d8fb
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: E3218D722047A88AD7209F12D58466EB7B5F798FE4F58C221DF9807F45CB74D44ACB00

Function 0040E160 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040E185
fprintf.MSVCRT ref: 0040E1AC
GetCurrentThreadId.KERNEL32 ref: 0040E1C0
fprintf.MSVCRT ref: 0040E1DF

Strings

C%p %d V=%0X w=%ld %s, xrefs: 0040E193
C%p %d %s, xrefs: 0040E1CE

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 1384477639-884133013
Opcode ID: e082a836f88d518aa284b2d747ff834d5c072635b4d2dee90c757491ec476541
Instruction ID: ad4e87abc89a0f6b9defbed01aa5578e25f956962538df905230bc72d6f1c168
Opcode Fuzzy Hash: e082a836f88d518aa284b2d747ff834d5c072635b4d2dee90c757491ec476541
Instruction Fuzzy Hash: 0C017CB7200B449AEA119F26FC407593764B788F99F488036DF4C57B50EB3CC896C709

Function 0040D5E0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040D653
exit.MSVCRT ref: 0040D65D

Strings

(, xrefs: 0040D633
../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 0040D63B
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 0040D642
Assertion failed: (%s), file %s, line %d, xrefs: 0040D64C

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: exitfprintf
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
API String ID: 4243785698-3651547468
Opcode ID: ad7bdae21e051ce0ddf3eb1e8c6626a4c85702f95f6e125b711a76afc4c062d7
Instruction ID: 59e762d400623d30da18e204958f1e099f4dbabddd29c9e07c5cb25b2dad55e8
Opcode Fuzzy Hash: ad7bdae21e051ce0ddf3eb1e8c6626a4c85702f95f6e125b711a76afc4c062d7
Instruction Fuzzy Hash: 180162B2601F0497D700DF69EC543AD7760F744B55F84852ADA0D673A2DB3CC849C749

Function 02570B10 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02570B4C

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_invalid_parameter_noinfo.LIBCMT ref: 02570B57
memcpy_s.LIBCMT ref: 02570C1C
_fileno.LIBCMT ref: 02570C87
_filbuf.LIBCMT ref: 02570CB5
_errno.LIBCMT ref: 02570D05

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 578638ae9232452874beeae991092530b333e58b9258df30cc2807c26c7f84fd
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 985160303ACF094B972C5A2DB859139B7C2F7D5724B15032ED45AC32D5FF60E85686CA

Function 0231FF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0231FF4C

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0231FF57
memcpy_s.LIBCMT ref: 0232001C
_fileno.LIBCMT ref: 02320087
_filbuf.LIBCMT ref: 023200B5
_errno.LIBCMT ref: 02320105

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: 1ce59b59f0b62cf6088145e3df904a37aa900f5ece89b7c3ff5e4fd32c1506a7
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: F751567170477086EB2C8A26990066AB691F7A5FF8F088725AE7D43FD4CB78D09EC740

Function 0040A880 Relevance: 9.1, APIs: 6, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 7db33873ddfc0322ad360cc408ca0fdcc3b2a2f929bddcb0dd8f1c1e46bba93a
Instruction ID: e975f90a3d8c1b139d0e9ed269a964ad108ac021387f4ac7ef1c9ddbb81725fe
Opcode Fuzzy Hash: 7db33873ddfc0322ad360cc408ca0fdcc3b2a2f929bddcb0dd8f1c1e46bba93a
Instruction Fuzzy Hash: 8531A7737013018BEB259F71990072B6261AB44B99F188536CE159B7C4EE7CCC92D34B

Function 0257FBD0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 02571600: _getptd.LIBCMT ref: 02571616
Part of subcall function 02571600: __updatetlocinfo.LIBCMT ref: 0257164B
Part of subcall function 02571600: __updatetmbcinfo.LIBCMT ref: 02571672

_errno.LIBCMT ref: 0257FC1F
_invalid_parameter_noinfo.LIBCMT ref: 0257FC2A

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: __updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808835054-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: 7db4ba59695578f730de30b5f799ed549442ebca6e9bbe372797726c7554def6
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: D331CF7026CB098FC754EF18E08462A77D1FB88320F5106ADE849C7292DB70D840CB8A

Function 02570620 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02570577

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_invalid_parameter_noinfo.LIBCMT ref: 02570582
_getstream.LIBCMT ref: 025705A2
_errno.LIBCMT ref: 025705B4
_errno.LIBCMT ref: 025705C6
_openfile.LIBCMT ref: 025705F4

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction ID: e8fa3df2109e3d3566f3a3cce30c6be03a0bd447a53a5ed1ac07ea3e5150fb24
Opcode Fuzzy Hash: 25a8bf288fd42ce426ab2ae56b53d18e2e8359fd32586f4ae3706e9ff750b65b
Instruction Fuzzy Hash: CB218170698B4A8FE795EB28A40533E77D2FBC9310F45096A9849C7290EF74CC418B9A

Function 0040A750 Relevance: 9.1, APIs: 6, Instructions: 92synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040A784
WaitForSingleObject.KERNEL32(?,?,00000000,00000008,0040BC70,?,?,?,?,?,?,?,0040A3F6,?), ref: 0040A7DD

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentObjectSingleThreadWait
String ID:
API String ID: 1728940165-0
Opcode ID: 0f19003b143cb30aba972b1eb1fd132c39367f1a6850e4a43b036aa409df44fa
Instruction ID: 245e7f55a96ff446a680cc276a055d008e005892f259b8125ff2eccecd31d106
Opcode Fuzzy Hash: 0f19003b143cb30aba972b1eb1fd132c39367f1a6850e4a43b036aa409df44fa
Instruction Fuzzy Hash: 8F318E727013018BEB159F35D800B5B22A1E784B99F18C536CE0A9B3C4EA3DCCA2C796

Function 0231FA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0231F977

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0231F982
_getstream.LIBCMT ref: 0231F9A2
_errno.LIBCMT ref: 0231F9B4
_errno.LIBCMT ref: 0231F9C6
_openfile.LIBCMT ref: 0231F9F4

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: 50eb323b346f3e2688d2135db40f6ea6d3af4ed7d34521b811879636c35a6823
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: 6511C87131479695DB25AF62AD0032EA7A6BB89BC4F884421DE8D97F59EF3CC1518F00

Function 02329B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02329B55

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__lock_fhandle.LIBCMT ref: 02329B9D
__doserrno.LIBCMT ref: 02329BD2
_errno.LIBCMT ref: 02329BD9

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: 6a5b980f406b70d9d70334be14f3ba7b60b884ef6571df1c442bfee6e5911ffc
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: 12115B317007B085DB156FA9D9D433D7655EB80B60F694128DB5A0B391CB7CC849C754

Function 0040C240 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0040B420: TlsGetValue.KERNEL32 ref: 0040B43C

TlsGetValue.KERNEL32 ref: 0040C27B
CloseHandle.KERNEL32 ref: 0040C2A6
_endthreadex.MSVCRT ref: 0040C2BC
CloseHandle.KERNEL32 ref: 0040C2DD
TlsSetValue.KERNEL32 ref: 0040C2FD
CloseHandle.KERNEL32 ref: 0040C310

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CloseHandleValue$_endthreadex
String ID:
API String ID: 3955988603-0
Opcode ID: 4fcd89013ee7740ead3aaae1b05b410178f810bdfb6f070ef027c58e878e45b5
Instruction ID: 59fe88858531d89057f0038b42ecbfead7148b9934fb3b134ebb9677fc831ea9
Opcode Fuzzy Hash: 4fcd89013ee7740ead3aaae1b05b410178f810bdfb6f070ef027c58e878e45b5
Instruction Fuzzy Hash: 20217C72604A44C2EB25DF61D49436A3BA0F785B08F09427ADE0A277D4EF3D8885C38D

Function 0231E3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0231E40F

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

malloc.LIBCMT ref: 0231E41D

Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E718
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E71D

malloc.LIBCMT ref: 0231E43F
_snprintf.LIBCMT ref: 0231E45A

Part of subcall function 0231EA3C: _errno.LIBCMT ref: 0231EA73
Part of subcall function 0231EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0231EA7E

malloc.LIBCMT ref: 0231E475

Strings

dpoolWait, xrefs: 0231E444

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 95d2f6934392299b64dd6ecce08c7b353c7768992b598b8ba9b9b8edc98eae82
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 8A01DE71700B9041DA18DB12B804B19B69AF79CFE0F46822ADFA947BC4CF38C0418B80

Function 00402720 Relevance: 9.0, APIs: 6, Instructions: 34COMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 0040273C
_setmode.MSVCRT ref: 0040274C
_fileno.MSVCRT ref: 00402758
_setmode.MSVCRT ref: 00402761
_fileno.MSVCRT ref: 0040276D
_setmode.MSVCRT ref: 00402776

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: _fileno_setmode
String ID:
API String ID: 66534057-0
Opcode ID: a005025fe765626447aaf941bab582738da3393a7fd71a9516fc9694a18dcf3f
Instruction ID: d395317f33de1d4e6c9ade2b528160413540b4a4ef1efefa68ad39ca44651fe6
Opcode Fuzzy Hash: a005025fe765626447aaf941bab582738da3393a7fd71a9516fc9694a18dcf3f
Instruction Fuzzy Hash: 71F06D10B11A1842FF08B3B2BD2837E0646AF997C0F18803B8D4A473D0EC3DC8424749

Function 025631F4 Relevance: 9.0, APIs: 7, Instructions: 264stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0256322E
strchr.LIBCMT ref: 0256324C
malloc.LIBCMT ref: 02563264
malloc.LIBCMT ref: 02563271
rand.LIBCMT ref: 0256333D
free.LIBCMT ref: 0256345B
free.LIBCMT ref: 02563463

Part of subcall function 0256F244: RtlFreeHeap.NTDLL ref: 0256F25A
Part of subcall function 0256F244: _errno.LIBCMT ref: 0256F264

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$FreeHeap_errnorand
String ID:
API String ID: 3504763109-0
Opcode ID: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction ID: f10dc77ff828592163a92a0ab75cd202577d0aa8db3d298ba93e1bba7b32a581
Opcode Fuzzy Hash: f35e4bf4a30ec4413237561f10dac7197b8990473e0b46e11b580f4fb44e5963
Instruction Fuzzy Hash: 4A71E520628E995BDB6AAB2CE8183FAB7D1FFD9309F0401ADC58AC7151DE34C547CB85

Function 02554170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 025541BD

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

malloc.LIBCMT ref: 025541C8

Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F318
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F31D

free.LIBCMT ref: 025542AF
free.LIBCMT ref: 025542B7
free.LIBCMT ref: 025542BF
free.LIBCMT ref: 025542CB
free.LIBCMT ref: 025542D8

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction ID: bcc5e5daf0e9d50b6c44a52539da43deb51af2029d83e8e80fa2259e02faa257
Opcode Fuzzy Hash: a46d6df1e63736bbf5e6f8efd513222b2720334364c4a35ae3722e37f335d37b
Instruction Fuzzy Hash: 1241E534618F2A4F9759EF2DE85567977D1FB89304B50026EDC4BC3606EF60E8828AC9

Function 023125F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0231262E
strchr.LIBCMT ref: 0231264C
malloc.LIBCMT ref: 02312664
malloc.LIBCMT ref: 02312671
rand.LIBCMT ref: 0231273D
free.LIBCMT ref: 0231285B
free.LIBCMT ref: 02312863

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: 1e52a4d47e206694357a578e2917667d0d2d42bebf52cfd837bb4bcd6a56d62b
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: EF61E662608FD485EA3E9B29A4103EBA7A2EF99B84F085115CF8917B55EF3DC147CB00

Function 02303570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 023035BD

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

malloc.LIBCMT ref: 023035C8

Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E718
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E71D

free.LIBCMT ref: 023036AF
free.LIBCMT ref: 023036B7
free.LIBCMT ref: 023036BF
free.LIBCMT ref: 023036CB
free.LIBCMT ref: 023036D8

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: b3db9f103e062e89054fe2f8458b7c8e6071635ff6d12478824fbb2d9298317e
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: EC413522300B999BEB28EF6699F436E2751F749BC4F8444A4CF5A47B51EF38D022CB00

Function 0231B630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 0231B654

Part of subcall function 0231F84C: _getptd.LIBCMT ref: 0231F854

malloc.LIBCMT ref: 0231B69C
strtok.LIBCMT ref: 0231B700
strtok.LIBCMT ref: 0231B711

Strings

eThreadpoolTimer, xrefs: 0231B6DA

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 11d65264b352f33e3e1b4e967484d2ed30191382d6502773e28a7df1ab33da41
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: F021FBB2610BE485DB18DF52F09866D77AAF794FD4B165216DF5A47740CF34C041C780

Function 0040B2D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040B324
_ultoa.MSVCRT ref: 0040B336
OutputDebugStringA.KERNEL32 ref: 0040B36A
abort.MSVCRT ref: 0040B370

Strings

Error cleaning up spin_keys for thread , xrefs: 0040B30A

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cleaning up spin_keys for thread
API String ID: 4191895893-2906507043
Opcode ID: 00d32fffeff5a360e7874eacd6d00a9cb9be9f0f343a57345a9b6b5a142e938e
Instruction ID: c4990df24cff04e533fb9e0e4671906f4e97169299b23d42e76d0f2cde5e67a3
Opcode Fuzzy Hash: 00d32fffeff5a360e7874eacd6d00a9cb9be9f0f343a57345a9b6b5a142e938e
Instruction Fuzzy Hash: 1311066270474095EB348B24E40432A1A51F346758F684736DE99663E4DB7DC885C30E

Function 0040BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040BAEE
printf.MSVCRT ref: 0040BB1A
GetCurrentThreadId.KERNEL32 ref: 0040BB30

Strings

T%p %d V=%0X H=%p %s, xrefs: 0040BB10
T%p %d %s, xrefs: 0040BB3B

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentThread$printf
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 2165381015-2059990036
Opcode ID: ad1a09b99c0ae016908ff96fce716beeb07053f4782c09f18cf4a96afc51efa6
Instruction ID: 4580a4190a538d95e900a8df13537ab9dd0dd5cd3249cf1cabc42d15cd79edf2
Opcode Fuzzy Hash: ad1a09b99c0ae016908ff96fce716beeb07053f4782c09f18cf4a96afc51efa6
Instruction Fuzzy Hash: 38018073305B089AD6109B27FC4075A6365F788FD5F484036AE4C577A4EB3CD485C748

Function 0040D680 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D6A5
printf.MSVCRT ref: 0040D6DD
GetCurrentThreadId.KERNEL32 ref: 0040D6F0

Strings

RWL%p %d %s, xrefs: 0040D6FC
RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 0040D6B3

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CurrentThread$printf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2165381015-1971217749
Opcode ID: 51ba6a8e622832e596f6f71a37c4c5196533f111eedb683808bd9450df109bc4
Instruction ID: 700d41e2e67a9c0ea3b30cf733aea1998e6b14b9d2d83968939827aac6c33995
Opcode Fuzzy Hash: 51ba6a8e622832e596f6f71a37c4c5196533f111eedb683808bd9450df109bc4
Instruction Fuzzy Hash: 8C01BCB2300A889AE7118F16F84070A7BA4B788FA9F188035EF4C53750EB3DC48ACB04

Function 00407F60 Relevance: 7.9, APIs: 3, Strings: 2, Instructions: 384COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004080E6
memcpy.MSVCRT ref: 00408220
memset.MSVCRT ref: 0040826D

Strings

[[reraised from:, xrefs: 00408478
]], xrefs: 004083DC

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: memcpy$memset
String ID: [[reraised from:$]]
API String ID: 438689982-3653159892
Opcode ID: 1e7e1c4b4bf05be251f585c240d80514a2b3678c1ba4ad613ad3009d5cb25a34
Instruction ID: e54c28d7e5fc909ad3b34ef5ab3c2c625d817787e01b32617cfb8fae09f00219
Opcode Fuzzy Hash: 1e7e1c4b4bf05be251f585c240d80514a2b3678c1ba4ad613ad3009d5cb25a34
Instruction Fuzzy Hash: 70E19F72708B8081CA049B56E54031BAB61F7C5BE4F48852BEED927BE9DFBDC495C708

Function 0230BE74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 023153EC: malloc.LIBCMT ref: 02315408

malloc.LIBCMT ref: 0230BF3B

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

Part of subcall function 0231B630: _time64.LIBCMT ref: 0231B654
Part of subcall function 0231B630: malloc.LIBCMT ref: 0231B69C
Part of subcall function 0231B630: strtok.LIBCMT ref: 0231B700
Part of subcall function 0231B630: strtok.LIBCMT ref: 0231B711

Part of subcall function 023128A0: _time64.LIBCMT ref: 023128AE

Part of subcall function 0231DEA8: malloc.LIBCMT ref: 0231DEF8

Part of subcall function 0231DEA8: realloc.LIBCMT ref: 0231DF07

malloc.LIBCMT ref: 0230C04A
_snprintf.LIBCMT ref: 0230C0C1
_snprintf.LIBCMT ref: 0230C0E7
_snprintf.LIBCMT ref: 0230C10E
free.LIBCMT ref: 0230C2C6

Part of subcall function 0231A144: malloc.LIBCMT ref: 0231A178
Part of subcall function 0231A144: free.LIBCMT ref: 0231A32F

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID:
API String ID: 1314452303-0
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: bf6db0ab826572db4121ee95fbafa771225c362d9174f072b9618fa937e6ada1
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: AEA1D22130178142EB2CFBB6A8A476E7797EB85B85F4069268E5A47784DF3CC506CF60

Function 02561694 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 02565FEC: malloc.LIBCMT ref: 02566008

Part of subcall function 02570620: _errno.LIBCMT ref: 02570577
Part of subcall function 02570620: _invalid_parameter_noinfo.LIBCMT ref: 02570582

fseek.LIBCMT ref: 02561730

Part of subcall function 02570EA4: _errno.LIBCMT ref: 02570ECC
Part of subcall function 02570EA4: _invalid_parameter_noinfo.LIBCMT ref: 02570ED7

_ftelli64.LIBCMT ref: 02561738

Part of subcall function 02570F18: _errno.LIBCMT ref: 02570F36
Part of subcall function 02570F18: _invalid_parameter_noinfo.LIBCMT ref: 02570F41

fseek.LIBCMT ref: 02561748

Part of subcall function 02570EA4: _fseek_nolock.LIBCMT ref: 02570EF5

malloc.LIBCMT ref: 02561788

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

fclose.LIBCMT ref: 02561845

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction ID: c869563e3de82e9d389e3acb39099af4a4709fc025e5f8d9be36931813bdd988
Opcode Fuzzy Hash: f1c4e02295faa99f8843714657dd5281141177bf23df19fa39898597ddf49910
Instruction Fuzzy Hash: 1951C671718A184FD749EB2CE49967973D6FBC8310B50426ED44FC3295EE34D9028BC9

Function 0257A348 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0257A375

Part of subcall function 02573E58: _FF_MSGBANNER.LIBCMT ref: 02573E75
Part of subcall function 02573E58: _NMSG_WRITE.LIBCMT ref: 02573E7F

_lock.LIBCMT ref: 0257A388
_lock.LIBCMT ref: 0257A3E3
_calloc_crt.LIBCMT ref: 0257A49A

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction ID: 6d07eeb0d87cbbbbab5ef1690c9aa2054359285cc8619bda3e3dcf8ee1788a79
Opcode Fuzzy Hash: b1e94c722dda090378a8e761eed7513b06593d91ccd6790d0d4411b736f80c7c
Instruction Fuzzy Hash: 6F511870568B098FDB189F18E885279B7E1FB88310F5146ADDC8AC7261E775D842CBCA

Function 025554F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0255553A

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

malloc.LIBCMT ref: 02555545

Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F318
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F31D

free.LIBCMT ref: 0255562C
free.LIBCMT ref: 02555634
free.LIBCMT ref: 02555640
free.LIBCMT ref: 0255564D

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction ID: c25a6397901e59bae3b04a1ea3c9acdf1b6b01e4c741afe7f4984ccd8cbc01c7
Opcode Fuzzy Hash: 9dd44889f23309e2c133c4e883ac3d7c03cf28f4ebc62bcd805b5d39935d1e2d
Instruction Fuzzy Hash: E0412830318B5E4B9B29AB6C985523A77D5FBD6254B94422EDC87C3212FE20D8078BC9

Function 0257239C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 025723B9

Part of subcall function 02575A54: _errno.LIBCMT ref: 02575A5D
Part of subcall function 02575A54: _invalid_parameter_noinfo.LIBCMT ref: 02575A68

_errno.LIBCMT ref: 025723C9

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_errno.LIBCMT ref: 025723E5
_isatty.LIBCMT ref: 02572446
_getbuf.LIBCMT ref: 02572452

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction ID: 520724ffdb8707e62df77fc043170bdc0540be3b90b299687114ce1ed9c9e8cf
Opcode Fuzzy Hash: c35e8c2de9f02937b40d8dcb44627bb11330896f7d068decc206105344bae12a
Instruction Fuzzy Hash: 6F41E430164A098FDB58EF28E4917657BE2FF88310F5406A9DC5ACB296D774C881CB85

Function 02569220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0256924F

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

_snprintf.LIBCMT ref: 02569267

Part of subcall function 0256F63C: _errno.LIBCMT ref: 0256F673
Part of subcall function 0256F63C: _invalid_parameter_noinfo.LIBCMT ref: 0256F67E

free.LIBCMT ref: 0256927E

Part of subcall function 0256F244: RtlFreeHeap.NTDLL ref: 0256F25A
Part of subcall function 0256F244: _errno.LIBCMT ref: 0256F264

malloc.LIBCMT ref: 025692CE
_snprintf.LIBCMT ref: 025692E6
free.LIBCMT ref: 0256930E

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction ID: 906efdcc9f7248277e40c47ecc7d0c99819b74146aa84afa32b8911526502079
Opcode Fuzzy Hash: faf2166294d0965833cb84c6e7fe882f3c5ed13ceeefabe40a4c11aee224dca5
Instruction Fuzzy Hash: 5531823071CA4C0F97A8AB6CA8197747BD2F789310754969DD08FC3296DE34DC428BC9

Function 02310A94 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 023153EC: malloc.LIBCMT ref: 02315408

Part of subcall function 0231FA20: _errno.LIBCMT ref: 0231F977
Part of subcall function 0231FA20: _invalid_parameter_noinfo.LIBCMT ref: 0231F982

fseek.LIBCMT ref: 02310B30

Part of subcall function 023202A4: _errno.LIBCMT ref: 023202CC
Part of subcall function 023202A4: _invalid_parameter_noinfo.LIBCMT ref: 023202D7

_ftelli64.LIBCMT ref: 02310B38

Part of subcall function 02320318: _errno.LIBCMT ref: 02320336
Part of subcall function 02320318: _invalid_parameter_noinfo.LIBCMT ref: 02320341

fseek.LIBCMT ref: 02310B48

Part of subcall function 023202A4: _fseek_nolock.LIBCMT ref: 023202F5

malloc.LIBCMT ref: 02310B88

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

Part of subcall function 0230C444: malloc.LIBCMT ref: 0230C457

fclose.LIBCMT ref: 02310C45

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 1756087678-0
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 8a768cd871a70eede5f1eb48c8fcd039c445d04518c9424d062344c13dc96288
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: DB41B32231469082DB28EB12E86476EA756F7C9BD0F808626DE5E5BB94DF3CC605CF00

Function 0231FA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0231FA64

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0231FA6F
_flush.LIBCMT ref: 0231FB21
_fileno.LIBCMT ref: 0231FB42
_flsbuf.LIBCMT ref: 0231FB85

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: ebb8f19de017ad4b064700313c3fb500bc8f38606de13aec80fba18b94470708
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: 4231293130075486DE2C9E27655022EB656FB44FE8F18C6248FAA47FE1DB7CD046CB40

Function 023048F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0230493A

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

malloc.LIBCMT ref: 02304945

Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E718
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E71D

free.LIBCMT ref: 02304A2C
free.LIBCMT ref: 02304A34
free.LIBCMT ref: 02304A40
free.LIBCMT ref: 02304A4D

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 5a14584ef960df796ed5be9746539bc02528b5af47f3eaa49da6b8f7922aa0ce
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: 9931012231478586EF25EF2B546472A6B59F794B88F494024CF198BB51EF38C607C724

Function 0255FC64 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0255FC85

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

free.LIBCMT ref: 0255FCC0
fwrite.LIBCMT ref: 0255FD01
fclose.LIBCMT ref: 0255FD09
free.LIBCMT ref: 0255FD16

Part of subcall function 0256F244: RtlFreeHeap.NTDLL ref: 0256F25A
Part of subcall function 0256F244: _errno.LIBCMT ref: 0256F264

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$free$FreeHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 415550720-0
Opcode ID: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction ID: ff1cece8497af390af5d6f5058a975376e119ed4c0648b7630c224d458a5cca0
Opcode Fuzzy Hash: c287650ca013cd6fba82a94b2bfab312077d62521af6d54d1c0599a360ecab3d
Instruction Fuzzy Hash: C9218430628E194BD784FB6CD46467EB6D2FBD8354F50056EA84AC3284EE38C9058B89

Function 02318620 Relevance: 7.6, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0231864F

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

_snprintf.LIBCMT ref: 02318667

Part of subcall function 0231EA3C: _errno.LIBCMT ref: 0231EA73
Part of subcall function 0231EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0231EA7E

free.LIBCMT ref: 0231867E

Part of subcall function 0231E644: _errno.LIBCMT ref: 0231E664

malloc.LIBCMT ref: 023186CE
_snprintf.LIBCMT ref: 023186E6
free.LIBCMT ref: 0231870E

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: c08cd466d8fbec9c496c64edb4ab3d5760f26f7e0bd77c7058c5959d98d272d6
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: BE31911630468145EA2D9B6369187B5AB62B74AFD4F885112CEE907BA5CF3CC3538718

Function 0230F064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0230F085

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

free.LIBCMT ref: 0230F0C0
fwrite.LIBCMT ref: 0230F101
fclose.LIBCMT ref: 0230F109
free.LIBCMT ref: 0230F116

Part of subcall function 0231E644: _errno.LIBCMT ref: 0231E664

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: 11e011c671ea89595b89d9b796da04636fb043265deb742a6df68bd9d1b92125
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: 8F11865170474041DE38E752E06026EA392EBD5BE4F884225DE6E4BFC9DF3DC5068F80

Function 0040E070 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040E086
LeaveCriticalSection.KERNEL32 ref: 0040E0AA
ReleaseSemaphore.KERNEL32 ref: 0040E0CD
LeaveCriticalSection.KERNEL32 ref: 0040E0DF
LeaveCriticalSection.KERNEL32 ref: 0040E0F3

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: f09834c925dac6ef85fba9aec9c5b85908a8a907288cff7ced5317beb65f0088
Instruction ID: fd0f02da3eb3e2c0ed87388dae210e3cfedca7507af44677fc890da320676c38
Opcode Fuzzy Hash: f09834c925dac6ef85fba9aec9c5b85908a8a907288cff7ced5317beb65f0088
Instruction Fuzzy Hash: 7D01A26270562883EB254B6BAD1032A6390AB86FB6F448534CF0E42791ED7D88D7830A

Function 0257A5EC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0257A5FD

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

__doserrno.LIBCMT ref: 0257A5F5

Part of subcall function 02571CA8: _getptd_noexit.LIBCMT ref: 02571CAC

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: e87ea320533ce32177e9faec64d9301a69d8c2206eb0176755783a7ec152e85f
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: ECF0F6319B4D4A4ED719AB74E95136C36A1FF4132AF958694D409CB2E0E77C44418F2A

Function 023299EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 023299FD

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

__doserrno.LIBCMT ref: 023299F5

Part of subcall function 023210A8: _getptd_noexit.LIBCMT ref: 023210AC

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 3d2dd2ce7e628dc51b532f798afa4d43e5ac756344c88e8ad246364c4cc261fb
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 39F02BB272177444EF152F24C98032C72629B80B36FA18321CA7E073D1C73C440D8B14

Function 00403B80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,?,00403F55,?,00000000,?,0040568B,?,?,?,004015EB), ref: 00403C53
printf.MSVCRT ref: 00403C64
exit.MSVCRT(?,00403F55,?,00000000,?,0040568B,?,?,?,004015EB), ref: 00403C6E

Strings

virtualFree failing!, xrefs: 00403C5D

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: FreeVirtualexitprintf
String ID: virtualFree failing!
API String ID: 3269596046-3108117800
Opcode ID: f818d35066984f19e29fd5f82b8b7ed16069696f122ac403d0d867deb717cce3
Instruction ID: 3ec212181963c6067ec8a6b9ec1ebec953841177cf42901b3eed91814c51c128
Opcode Fuzzy Hash: f818d35066984f19e29fd5f82b8b7ed16069696f122ac403d0d867deb717cce3
Instruction Fuzzy Hash: 1B31E2B7606E4484EB158F66D9047A967A9E381FC9F18C037CE0DAB384EE3CC990C354

Function 00403AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00403B25

Strings

virtualFree failing!, xrefs: 00403B62

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: FreeVirtual
String ID: virtualFree failing!
API String ID: 1263568516-3108117800
Opcode ID: fbeba2427a4eca0fa3a9a79192208fb93826b9f356f15f56c56aaa979e056636
Instruction ID: c05decfb4976e675fc689d17eaa451d228e81519f2973baf07724d5d59094471
Opcode Fuzzy Hash: fbeba2427a4eca0fa3a9a79192208fb93826b9f356f15f56c56aaa979e056636
Instruction Fuzzy Hash: C611A7E6B02A8480EB08DF56D8447BA7AE5F750FC1F69D036CA0A67385CF3CC5919744

Function 00407A80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 00407AD3
GetProcAddress.KERNEL32 ref: 00407AFE

Strings

GetCurrentProcessId, xrefs: 00407A81, 00407AE8
could not import: , xrefs: 00407A97

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: AddressProcexit
String ID: GetCurrentProcessId$could not import:
API String ID: 2129014486-1716527884
Opcode ID: b6c3b212903f479f4ebf49c946283e2f8c138eb0e1fa6f3f1027808c0aeba4d5
Instruction ID: 67eaf3da92af00e07100af7ea4084406d0af1b9a082fec374c9c0cd0e519a662
Opcode Fuzzy Hash: b6c3b212903f479f4ebf49c946283e2f8c138eb0e1fa6f3f1027808c0aeba4d5
Instruction Fuzzy Hash: 50F0F696B1171065EE06A3A3FC097BA53256B4D7D5F4C447A7E0C173C2EC7CC4428318

Function 00403670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00403700
printf.MSVCRT ref: 00403716
exit.MSVCRT ref: 00403720

Strings

virtualFree failing!, xrefs: 0040370F

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: FreeVirtualexitprintf
String ID: virtualFree failing!
API String ID: 3269596046-3108117800
Opcode ID: 897f71388d7da554c15fb1ad01ed1eff5c6298ef26397a569b87150280dcb896
Instruction ID: 78a29147f2cb8f2abd1814e0672bbc76dc618bb76bcaf3126ef58004fd57675c
Opcode Fuzzy Hash: 897f71388d7da554c15fb1ad01ed1eff5c6298ef26397a569b87150280dcb896
Instruction Fuzzy Hash: 4A01D2A6313E0082EF54EF16E8493A926A5FB48BC1F68D43BCE0D63390DE3DC1948306

Function 0255EC04 Relevance: 6.5, APIs: 5, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0255ECD3
_snprintf.LIBCMT ref: 0255ECFE
_snprintf.LIBCMT ref: 0255ED1A
_snprintf.LIBCMT ref: 0255EDCF
_snprintf.LIBCMT ref: 0255EDE6

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 34fe6692e58236b4b6682ad6a7b48ec6d7a83c73d4088d9b75cbae944ed0cd91
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: D4810731618A098FDB55EF18DC95BAAB7E6FB98304F00056ED84BC3190DF38DA45CB86

Function 0230E004 Relevance: 6.4, APIs: 5, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0230E0D3
_snprintf.LIBCMT ref: 0230E0FE
_snprintf.LIBCMT ref: 0230E11A
_snprintf.LIBCMT ref: 0230E1CF
_snprintf.LIBCMT ref: 0230E1E6

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: ddeae1f349c3c57680995d0a69422e3885f702e686fc95d8bd08e3d8aaf6d1aa
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: 7F717E72704B8586EB18EF65E8943E977A1F788788F444526DE8D03798DF3CC64ACB50

Function 0040EDC0 Relevance: 6.3, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040EDD9
LeaveCriticalSection.KERNEL32 ref: 0040EDEF

Part of subcall function 0040E070: EnterCriticalSection.KERNEL32 ref: 0040E086
Part of subcall function 0040E070: LeaveCriticalSection.KERNEL32 ref: 0040E0AA

LeaveCriticalSection.KERNEL32 ref: 0040EE53

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 6a11056a20cc35de2018387810d39915439db575be4cd99d8750b0f236ff1038
Instruction ID: 61bb3ac6c2898bd4d78bd4257e1d5eccff422152c7fd7f5e7ea54e01c5cc92cc
Opcode Fuzzy Hash: 6a11056a20cc35de2018387810d39915439db575be4cd99d8750b0f236ff1038
Instruction Fuzzy Hash: 623176B22007448AC7609F37D80075A3361F785F98F08893ADF6AA7795EF78D4A6C754

Function 0040AFD0 Relevance: 6.3, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040AFFB
free.MSVCRT ref: 0040B009
free.MSVCRT ref: 0040B017

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f79286804addad490cfe4ab14be8324b714beba69de8c756b54e71d2cf5278df
Instruction ID: b9fa9daab60f5cdee7daf810507fd102d4a1feffda094eb5bf4fcc26180e4d16
Opcode Fuzzy Hash: f79286804addad490cfe4ab14be8324b714beba69de8c756b54e71d2cf5278df
Instruction Fuzzy Hash: D031AEA1216F4491EF25CB15E8507AB2361FB44B84F48043B8B5E67392EF7CC499D38E

Function 0256EFEC Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0256F00F

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

malloc.LIBCMT ref: 0256F01D

Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F318
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F31D

malloc.LIBCMT ref: 0256F03F
_snprintf.LIBCMT ref: 0256F05A

Part of subcall function 0256F63C: _errno.LIBCMT ref: 0256F673
Part of subcall function 0256F63C: _invalid_parameter_noinfo.LIBCMT ref: 0256F67E

malloc.LIBCMT ref: 0256F075

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction ID: adb0d6d86d96d2be4976f4a9f346f99b42228845db1091b6c98b4697608b6e2d
Opcode Fuzzy Hash: b352101c7262c8bcb4a5e96376bd10b91777e0dce9561e268234f3b9efdf5141
Instruction Fuzzy Hash: E6113D70A1CF194FD7A8EB6CB44922576D2FB8C320F10459EE09BC3795EA349D454BC5

Function 0257062C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02570664

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_invalid_parameter_noinfo.LIBCMT ref: 0257066F
_flush.LIBCMT ref: 02570721
_fileno.LIBCMT ref: 02570742

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction ID: 49839589c4a33311831ef706d3b943637f877e9f763e1983307db9ca75a16c9a
Opcode Fuzzy Hash: 34e7f92ebff520e6a17a4e985317f9f17b8bd586bad3667c73d28a98cf0395a5
Instruction Fuzzy Hash: 90412D30358F0D4FD72C6E6DB45523676C1FBD8714B14126ED89AC31E2EBB1D8528ACA

Function 0231B3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: f8776b367fb57209128baab3c77ef80234e4cbb3e0fcd364922892bfa78135a4
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 3F51A072702640CAD728DF2AE589378B7A2F768B99F14556ACA054B770CF3CD642CF40

Function 0040CE70 Relevance: 6.1, APIs: 4, Instructions: 93synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 0040CEAF

Part of subcall function 0040B420: TlsGetValue.KERNEL32 ref: 0040B43C

WaitForSingleObject.KERNEL32 ref: 0040CEF3
CloseHandle.KERNEL32 ref: 0040CF16
CloseHandle.KERNEL32 ref: 0040CF21

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleValueWait
String ID:
API String ID: 3336430066-0
Opcode ID: e901414d97ce13e6ae834dcc09ab6f319b7fd8cc618350ee60b6e226b2f19569
Instruction ID: 91672e44118f4f9bfc7affad747543ab7aeb8bf378ee3e6b17fc93df5db559ee
Opcode Fuzzy Hash: e901414d97ce13e6ae834dcc09ab6f319b7fd8cc618350ee60b6e226b2f19569
Instruction Fuzzy Hash: 82318D62701A05C1EB11EB25E99077A6355EF50B98F4842379E0D673D6EF3CC8C6D34A

Function 025510D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 02551117
clock.LIBCMT ref: 02551124
clock.LIBCMT ref: 0255112D
clock.LIBCMT ref: 0255113A

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: fcc6bf2992721240a19ae1ea94fcef4c951e1af60786cc04bf7e9d221920e198
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 9511063584CB2D0F4728EDE8A483736BFD0FB85250F1546AEDCCEC3202FA51984286DA

Function 0040CD60 Relevance: 6.1, APIs: 4, Instructions: 68synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 0040CD90

Part of subcall function 0040B420: TlsGetValue.KERNEL32 ref: 0040B43C

WaitForSingleObject.KERNEL32 ref: 0040CDE6
CloseHandle.KERNEL32 ref: 0040CDF7
CloseHandle.KERNEL32 ref: 0040CE02

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleValueWait
String ID:
API String ID: 3336430066-0
Opcode ID: c7d31dfb50537f1a8eccbce3a4ae1095dcfbf069d35d1df4c7b76af1d8775615
Instruction ID: 2ca5244af04e7952dda4fb09adb163b19184c4422eeead410ec1c766d6e3fc79
Opcode Fuzzy Hash: c7d31dfb50537f1a8eccbce3a4ae1095dcfbf069d35d1df4c7b76af1d8775615
Instruction Fuzzy Hash: 64214F72301644C5DB14AF35D98036A2765EB44FA8F084337AE2D677D8DF38C881C389

Function 0232E9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0232E9FC

Part of subcall function 02320A00: _getptd.LIBCMT ref: 02320A16
Part of subcall function 02320A00: __updatetlocinfo.LIBCMT ref: 02320A4B
Part of subcall function 02320A00: __updatetmbcinfo.LIBCMT ref: 02320A72

_errno.LIBCMT ref: 0232EA08

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0232EA13
strchr.LIBCMT ref: 0232EA29

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: 2164d412faa2e3f2c7583543b18699a784e3dc1d2f9f60404da324d237df20cd
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 7F1101736082F441DF209726905223EBBA1F381FE9B4C8122EADB0BE55DB3CD14ACB50

Function 023004D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 02300517
clock.LIBCMT ref: 02300524
clock.LIBCMT ref: 0230052D
clock.LIBCMT ref: 0230053A

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 473a0bfca54bc70771890c334d12dba813a49b0180cefb23fa6294c0900c7717
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 46114832208758859738EEA6A8D026FF650FB88394F194035EE8403640EB74C486CB20

Function 0040BBC0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0040BBDD
GetProcessAffinityMask.KERNEL32 ref: 0040BBEC
GetCurrentProcess.KERNEL32 ref: 0040BC22
SetProcessAffinityMask.KERNEL32 ref: 0040BC2A

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: ad1b5c13f90c738a07939670b23dce36460909951f9cf688e786cc78484e5ba1
Instruction ID: 02328c6c6b3d0d372d7c0dac7e68b381e294f472b7c9d59da6aa44ab6565df31
Opcode Fuzzy Hash: ad1b5c13f90c738a07939670b23dce36460909951f9cf688e786cc78484e5ba1
Instruction Fuzzy Hash: 3DF0AFB3705B0446EB354B2AA8043AB1350FB89B88F8D0539DE8C67390EF3DC9858648

Function 023113B0 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 023113D2

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

_snprintf.LIBCMT ref: 023113F1

Part of subcall function 0231EA3C: _errno.LIBCMT ref: 0231EA73
Part of subcall function 0231EA3C: _invalid_parameter_noinfo.LIBCMT ref: 0231EA7E

remove.LIBCMT ref: 023113FD
remove.LIBCMT ref: 02311404

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID:
API String ID: 2566950902-0
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: e786008582cf331d90849364cb36a0a38b2f51d4499f88b938e124b6ac03a6e6
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: B8F05E26604B9089D218AB12B8103AAB365E794FD0F9C4125AF8D17F1ADF3DC5518B44

Function 00407890 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 004078A0
signal.MSVCRT ref: 004078B1
signal.MSVCRT ref: 004078C2
signal.MSVCRT ref: 004078D3

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 7eb602c1e84c8f2d4508f5b150893b77c3169bd1914478484148f26fd94796d2
Instruction ID: 7ffd0c8f86152527011bd58111e4023a9ddab865a73872750b6147fe438d269d
Opcode Fuzzy Hash: 7eb602c1e84c8f2d4508f5b150893b77c3169bd1914478484148f26fd94796d2
Instruction Fuzzy Hash: 4CE026E4B06701B1E60CA755DC923A42212B768384FE0542BD70D667D56EBC9567831B

Function 00407AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00407AFE

Strings

GetCurrentProcessId, xrefs: 00407A81, 00407AE8
@, xrefs: 00407B5A

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: AddressProc
String ID: @$GetCurrentProcessId
API String ID: 190572456-642312612
Opcode ID: cf4e8c461840196a1d5e3a424c946105794e48b74e8b7f7133caa5fd94005634
Instruction ID: 6816c09b5b8e3e01587aae7f86101661e2e93c0761c323be59c28c1205b1a22f
Opcode Fuzzy Hash: cf4e8c461840196a1d5e3a424c946105794e48b74e8b7f7133caa5fd94005634
Instruction Fuzzy Hash: EF218B63F0928095EF25C729EA1076B7A62A7887CCF494233CE0E17785E63DE406C30A

Function 0256F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0256F8B1

Part of subcall function 02571D18: _getptd_noexit.LIBCMT ref: 02571D1C

_invalid_parameter_noinfo.LIBCMT ref: 0256F8BC

Strings

B, xrefs: 0256F8E8

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 4d2718d039b7f640d8e6a3bc4cc43b01f0776613f71a220fb73b0baccc81c2d8
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 3F118F31628B084FD744EF5CE489769B7D1FB98324F6047AEA41AC72A0DB74C944CB86

Function 00409233 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9
Unknown error, xrefs: 00409330

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 2d0b19d687f5f29cc7643fbd37e0e5f2d4d696f631616a4441eb7d840dc4efaa
Instruction ID: cae68dea5b8d569cca2d0e83e0920741968e0506a5837e57793b34c44011c690
Opcode Fuzzy Hash: 2d0b19d687f5f29cc7643fbd37e0e5f2d4d696f631616a4441eb7d840dc4efaa
Instruction Fuzzy Hash: 4911C262504F84C6D6068F1CE8413EAB370FF9E79AF699316EB8826221DB39C553CB04

Function 0231EC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0231ECB1

Part of subcall function 02321118: _getptd_noexit.LIBCMT ref: 0232111C

_invalid_parameter_noinfo.LIBCMT ref: 0231ECBC

Strings

B, xrefs: 0231ECE8

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 85d8ee9363f7580267a139feccb929d8130aa981577cb5988c6e3a139dbf7c30
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: 4C01C4B2610A5086DB149F12D940359B665F798FE4F544320EF9817B99CF3CC244CB00

Function 004027E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 00402811
VirtualAlloc.KERNEL32 ref: 00402832

Strings

out of memory, xrefs: 004027FD

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: AllocVirtualexit
String ID: out of memory
API String ID: 1690354023-49810860
Opcode ID: 9b30ec3905c0c89b5cfc935bf5c2c0e287248be0effbb3e24d463318583e68f4
Instruction ID: bcd7b5c2427913cdb9a25d01757c6bc0127a90ceabd5c3f63053bd2737258ddf
Opcode Fuzzy Hash: 9b30ec3905c0c89b5cfc935bf5c2c0e287248be0effbb3e24d463318583e68f4
Instruction Fuzzy Hash: 4BF027A0702A0081EF183B22E84A33E1A60BB59B85F44003DCF0E233C1DE3C8240C71E

Function 004092E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

Argument singularity (SIGN), xrefs: 004092E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: e707bc938d8cb56276a69ee73003da0d9516395540f78725769a23699e01524d
Instruction ID: 945eab0354003da6d15c318be8cb8bfb8d9bc9826b62463795d0ef5024144848
Opcode Fuzzy Hash: e707bc938d8cb56276a69ee73003da0d9516395540f78725769a23699e01524d
Instruction Fuzzy Hash: FAF09653404F4486C201CF1CA8403ABB370FF4D789F195316EF893A565DB29C6438704

Function 004092F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9
Overflow range error (OVERFLOW), xrefs: 004092F0

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 63982a0cdb84859ed763b5c711bde44b355f234fde89ca4447e5f37daf66b5be
Instruction ID: 599cd6dfe6446d7fb291f0328e5a12d9de9925ea8f72b494281c938f8dfdd2d4
Opcode Fuzzy Hash: 63982a0cdb84859ed763b5c711bde44b355f234fde89ca4447e5f37daf66b5be
Instruction Fuzzy Hash: 07F09653404F4886C201CF1CA8403ABB370FF4D789F195316EF8936565DB28C643C704

Function 00409300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9
The result is too small to be represented (UNDERFLOW), xrefs: 00409300

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 2440f995e710b0a9293939027ba80f1e42b1855cb9b66d2cb06fd16afb0e1e2d
Instruction ID: 10411b5f3a914164e62eaac81bb6ec492088dca942ee3a17a62361c2ae89ebb3
Opcode Fuzzy Hash: 2440f995e710b0a9293939027ba80f1e42b1855cb9b66d2cb06fd16afb0e1e2d
Instruction Fuzzy Hash: E4F09053804F8886C202CF1CA8403ABB370FF8E789F69531AEF893A565DB28C643C704

Function 00409310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

Total loss of significance (TLOSS), xrefs: 00409310
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 5a8dd1d23a4a9bcf5a86f606299c1fab861597c7fa94b4d0570c2d43325b0f0a
Instruction ID: 097057f6ad5878e72e4ee4ac181b16957aa34abbcbda9fdca5e43a0e22e2c7a5
Opcode Fuzzy Hash: 5a8dd1d23a4a9bcf5a86f606299c1fab861597c7fa94b4d0570c2d43325b0f0a
Instruction Fuzzy Hash: DBF09653404F4486C201CF1CA8403ABB370FF4D789F195316EF8936525DB28C643C704

Function 00409320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9
Partial loss of significance (PLOSS), xrefs: 00409320

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 24f4091a73ebc1d9a38f5fe4bfb48fc015a6aec1e1d4ab082d4ce2a16c115147
Instruction ID: d595b76cc4570e4ec6a1876ee9f9bbc4f7f40900f5a3181d2aa152d52b128fbe
Opcode Fuzzy Hash: 24f4091a73ebc1d9a38f5fe4bfb48fc015a6aec1e1d4ab082d4ce2a16c115147
Instruction Fuzzy Hash: A0F09653404F4486C201CF1CA8403ABB370FF5D789F195316EF8936565DB28C643C704

Function 00409271 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004092B9

Strings

Argument domain error (DOMAIN), xrefs: 00409271
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004092A9

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: b470e2ec745e5dc0a1793ae33c37ab8c5311d9ccd633434ea94186f0bf15b3fd
Instruction ID: 073ce4a4cbda516259acb7becc95f376b22afaa9eb73b48beb55df6b68f8036a
Opcode Fuzzy Hash: b470e2ec745e5dc0a1793ae33c37ab8c5311d9ccd633434ea94186f0bf15b3fd
Instruction Fuzzy Hash: 5CF0B463804F8886C202CF1CA8403ABB370FF4E789F195316EF893A524DB28C643C704

Function 023010C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 0230116A

Part of subcall function 0232E208: _calloc_impl.LIBCMT ref: 0232E218
Part of subcall function 0232E208: _errno.LIBCMT ref: 0232E22B
Part of subcall function 0232E208: _errno.LIBCMT ref: 0232E235

free.LIBCMT ref: 023012F3
free.LIBCMT ref: 023012FD
free.LIBCMT ref: 0230130F

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: 309e6ca9590fb27c41a1348dcdfc67356fb286d6ce8849e66bda58708da93684
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 7CC11A32618B848AD764CF65E89479E77B4F788B88F10412AEBCD87B58DF38C555CB00

Function 0256AD44 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0256AD78

Part of subcall function 0256F284: _FF_MSGBANNER.LIBCMT ref: 0256F2B4
Part of subcall function 0256F284: _NMSG_WRITE.LIBCMT ref: 0256F2BE
Part of subcall function 0256F284: _callnewh.LIBCMT ref: 0256F2F2
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F2FD
Part of subcall function 0256F284: _errno.LIBCMT ref: 0256F308

free.LIBCMT ref: 0256AEBF
free.LIBCMT ref: 0256AF23
free.LIBCMT ref: 0256AF2F

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction ID: d311af8b23e9183e1d721da83684e0dfff79b1d4bf379932d06b827430abe4a0
Opcode Fuzzy Hash: 220d10eecca3932b28677e19a5d899b4e1de467fae96e5e6bbac4d4284393be2
Instruction Fuzzy Hash: 4951C635718A0A4FDB59EB28D89867DB3E2FBC8300F100A2DD44BC3155EF74D9428B8A

Function 02554300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 02554363

Memory Dump Source

Source File: 00000000.00000002.2498758475.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_svchostinter.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction ID: bb8b3a6d4fb2e46a4dc3b34d8fcea99b4ea0a6d02b8ce77f334930865dee525e
Opcode Fuzzy Hash: eb22e79342f6c44f5990d3d93bc1acaf377093f70efb3d4e41a798bd81bbd69f
Instruction Fuzzy Hash: F941D37061CA558BCB5CDF2CE89427A77E1FBC8310700456EDC9BC3256EF30E8928A89

Function 0231A144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0231A178

Part of subcall function 0231E684: _FF_MSGBANNER.LIBCMT ref: 0231E6B4
Part of subcall function 0231E684: _NMSG_WRITE.LIBCMT ref: 0231E6BE
Part of subcall function 0231E684: _callnewh.LIBCMT ref: 0231E6F2
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E6FD
Part of subcall function 0231E684: _errno.LIBCMT ref: 0231E708

free.LIBCMT ref: 0231A2BF
free.LIBCMT ref: 0231A323
free.LIBCMT ref: 0231A32F

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: a264f3b4adafdbb2113bb763085ae8574918c564350001a45025510047b18867
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 9351C03230574586DE2CFB2AE45036E63A2FB85BC1F984926CE1A5BB54EF7ED501CB10

Function 02303700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 02303763

Memory Dump Source

Source File: 00000000.00000002.2498713924.0000000002300000.00000020.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_svchostinter.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: 79ba584b6f65a53a3280c886bb8c6a2886de2d592a7ca2a13e0e3084e408e573
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: 0941B37270078187CB68DF26E4A066E77A5F784FC8F4485A5DE2A47B44EF38D809CB14

Function 0040EB20 Relevance: 5.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040EB67
LeaveCriticalSection.KERNEL32 ref: 0040EB8E

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4a4c7fba1a6e6ae530c452ec11eda39110b68435af26e3958d9cdc29cbdbbb18
Instruction ID: ffc107a79c8ca23e6cb2ab8f4a33688f2962519e9cda97039da4d76dda66b925
Opcode Fuzzy Hash: 4a4c7fba1a6e6ae530c452ec11eda39110b68435af26e3958d9cdc29cbdbbb18
Instruction Fuzzy Hash: DA31717370460086E750DF3AE40035A73A0E740BA8F184A36DF265B3C8EB79D896CB59

Function 0040E9F0 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040EA37
LeaveCriticalSection.KERNEL32 ref: 0040EA5E

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 15d575399897864f71b927fedc9677e28d381f2498bfae7a6f74509db4b5cc22
Instruction ID: 671f9346988143cf189ff9c19a3e50ba0894d4c724fc7568212cb4dad4618ca6
Opcode Fuzzy Hash: 15d575399897864f71b927fedc9677e28d381f2498bfae7a6f74509db4b5cc22
Instruction Fuzzy Hash: 8A219573704600CBDB54CF3AD44039A33A0F788B68F088A36DE1697788EB79C996CB55

Function 0040E7C0 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,004015EB,?,?,?,0040EC9B), ref: 0040E7F0
LeaveCriticalSection.KERNEL32(?,?,0040EC9B,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E806
EnterCriticalSection.KERNEL32(?,?,0040EC9B,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E835
LeaveCriticalSection.KERNEL32(?,?,0040EC9B,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040E83F

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c01eae508601ac2bced1713845ebc6d8aab6a0451395c797fa42af9f7b587646
Instruction ID: c4630b665ad4d136283a3c0854155f125ef7188aff18a47595cba90a7203099d
Opcode Fuzzy Hash: c01eae508601ac2bced1713845ebc6d8aab6a0451395c797fa42af9f7b587646
Instruction Fuzzy Hash: 4F01D1337045109AD726EB33AC00B2A6750BBC9FE8F188422EE0913750DE3CC553D705

Function 00409D70 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00409D97
free.MSVCRT ref: 00409DE8
LeaveCriticalSection.KERNEL32 ref: 00409DF4

Memory Dump Source

Source File: 00000000.00000002.2498301705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2498268109.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498331443.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498363224.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498422468.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498445094.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498468101.000000000045F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498493219.0000000000463000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2498519257.0000000000466000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_svchostinter.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 78a3235d163a2de0c0b9d5cf9a837263df8389fed1f3972b4169db4cab243b6f
Instruction ID: 30c992c40092553c7fac1774a41a8907275ea653607729d19a6be7d8ee101634
Opcode Fuzzy Hash: 78a3235d163a2de0c0b9d5cf9a837263df8389fed1f3972b4169db4cab243b6f
Instruction Fuzzy Hash: A9011AB1351A0583EB58DB55EC8036A23A1FB94B41F544436CA0D973A2EB7CDC95D34A

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report svchostinter.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: svchostinter.exePID: 6176, Parent PID: 4056

Windows Analysis Report
svchostinter.exe

Function 00408BF0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 93
memorythreadinjectionCOMMON

Function 00401180 Relevance: 13.7, APIs: 9, Instructions: 189
sleepstringCOMMON

Function 02565E28 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 0040B420 Relevance: 15.1, APIs: 10, Instructions: 80
COMMON

Function 0040B6C0 Relevance: 13.6, APIs: 9, Instructions: 111
COMMON

Function 0040A390 Relevance: 12.1, APIs: 8, Instructions: 128
COMMON

Function 00408990 Relevance: 9.0, APIs: 6, Instructions: 32
COMMON

Function 0255CA74 Relevance: 7.9, APIs: 6, Instructions: 411
COMMONLIBRARYCODE

Function 0255E68C Relevance: 7.8, APIs: 5, Instructions: 260
networkCOMMONLIBRARYCODE

Function 0255F014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 0040BC40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
COMMON

Function 0255EA48 Relevance: 3.2, APIs: 2, Instructions: 159
networkCOMMONLIBRARYCODE

Function 023196B4 Relevance: 1.6, APIs: 1, Instructions: 149
libraryCOMMON

Function 02319324 Relevance: 1.3, APIs: 1, Instructions: 87
memoryCOMMON