Edit tour

Windows Analysis Report
hvix64.exe

Overview

General Information

Sample name:	hvix64.exe
Analysis ID:	1579279
MD5:	60c37e8f119030afec51722aa561f768
SHA1:	5559158217b6df32004c8eee33c1ab21dbfde7b1
SHA256:	d29b670dbbf40bf66b5c01d20c291f39fdb503fe35fb71f0ab0565dd8797943a
Tags:	exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

ValleyRAT

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Multi AV Scanner detection for submitted file

Yara detected ValleyRAT

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Deletes itself after installation

Found evasive API chain checking for user administrative privileges

Modifies the context of a thread in another process (thread injection)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to create new users

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Tries to disable installed Antivirus / HIPS / PFW

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

hvix64.exe (PID: 7392 cmdline: "C:\Users\user\Desktop\hvix64.exe" MD5: 60C37E8F119030AFEC51722AA561F768)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7544 cmdline: C:\Windows\system32\svchost.exe -k netsvcs MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 7584 cmdline: C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

ParphaCrashReport64.exe (PID: 7632 cmdline: "C:\Program Files\Windows Mail\ParphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: svchost.exe PID: 1044	JoeSecurity_ValleyRAT	Yara detected ValleyRAT	Joe Security

Sigma Signatures

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\hvix64.exe", ParentImage: C:\Users\user\Desktop\hvix64.exe, ParentProcessId: 7392, ParentProcessName: hvix64.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, ProcessId: 1044, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\hvix64.exe", ParentImage: C:\Users\user\Desktop\hvix64.exe, ParentProcessId: 7392, ParentProcessName: hvix64.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, ProcessId: 1044, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: hvix64.exe	Virustotal: Detection: 15%			Perma Link
Source: hvix64.exe	ReversingLabs: Detection: 13%

Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.dll			Jump to behavior

Source: hvix64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Build\PX\A\PoisonX\nvsphelperplugin64\x64\Release\arphaDump64.pdb source: hvix64.exe, hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: hvix64.exe, hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1770781974.00007FF664553000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe, 00000005.00000000.1763337817.00007FF664552000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe.2.dr

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,		3_2_0000000180026810
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180026810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,		4_2_0000000180026810

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	3_2_000000018001E210
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	3_2_000000018001DDD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	4_2_000000018001E210
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001C850
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001CCF0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	4_2_000000018001DDD0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF664548F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF664548F78

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,

3_2_0000000180029300

Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8
Source: unknown	TCP traffic detected without corresponding DNS query: 18.166.193.8

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180032C50 VirtualAlloc,CreateEventW,WSARecv,WSAGetLastError,WaitForMultipleObjects,WSAGetOverlappedResult,WSAGetLastError,CloseHandle,VirtualFree,

3_2_0000000180032C50

Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ejemplo.com
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=afCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GBCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419&category=theme81https://myactivity.google.com/myactivit
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419Ctrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=esCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe	String found in binary or memory: https://chrome.google.com/webstore?hl=etCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fiCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=filCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=frCtrl$1
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ejemplo.com.Se
Source: hvix64.exe	String found in binary or memory: https://myactivity.google.com/
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.com
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comContrase
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comGestoorde
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comMga
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comMots
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSaved
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSe
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSelle
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comT
Source: hvix64.exe	String found in binary or memory: https://policies.google.com/
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/a/?p=browser_profile_details
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/96817
Source: hvix64.exe	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&AideG
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&yudaAdministrado
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlBestuur
Source: hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlO&hjeOrganisaatiosi
Source: hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_000000018002F1B0

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	3_2_000000018002F1B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	3_2_0000000180026200
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800197D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	3_2_00000001800197D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800199F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	3_2_00000001800199F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	4_2_000000018002F1B0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180026200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	4_2_0000000180026200
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800197D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	4_2_00000001800197D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800199F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	4_2_00000001800199F0

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018001AC60 DefWindowProcW,SendMessageW,OpenClipboard,GetClipboardData,GlobalLock,lstrlenW,lstrlenW,lstrlenW,GlobalUnlock,CloseClipboard,VirtualFree,VirtualFree,CloseClipboard,SendMessageW,PostQuitMessage,

3_2_000000018001AC60

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018001A410 GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,

3_2_000000018001A410

Source: hvix64.exe, 00000000.00000002.1744359668.0000022FCD02D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_d29e0acd-f

Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180005824 realloc,NtQuerySystemInformation,	0_2_0000000180005824
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800080F2 VirtualAllocEx,WriteProcessMemory,memset,memcpy,NtAlpcConnectPort,	0_2_00000001800080F2
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	3_2_0000000180011AE0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	3_2_0000000180011C70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	3_2_0000000180012830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180012830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	4_2_0000000180012830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180011AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	4_2_0000000180011AE0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180011C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	4_2_0000000180011C70

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800205A0: CreateFileW,memset,lstrlenA,DeviceIoControl,CloseHandle,

3_2_00000001800205A0

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180030180 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,CloseServiceHandle,CloseServiceHandle,Sleep,

3_2_0000000180030180

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800201A0 GetCurrentProcess,OpenProcessToken,GetLastError,DuplicateTokenEx,SetTokenInformation,CreateEnvironmentBlock,CreateProcessAsUserW,CreateProcessAsUserW,

3_2_00000001800201A0

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Jump to behavior

Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800080F2	0_2_00000001800080F2
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180009BC0	0_2_0000000180009BC0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800054D5	0_2_00000001800054D5
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800015B0	0_2_00000001800015B0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180001010	0_2_0000000180001010
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003833	0_2_0000000180003833
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180028038	0_2_0000000180028038
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180014848	0_2_0000000180014848
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000284D	0_2_000000018000284D
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018002C080	0_2_000000018002C080
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003880	0_2_0000000180003880
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800180EE	0_2_00000001800180EE
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000290C	0_2_000000018000290C
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180004153	0_2_0000000180004153
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002170	0_2_0000000180002170
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000B1AC	0_2_000000018000B1AC
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800069E0	0_2_00000001800069E0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800151E8	0_2_00000001800151E8
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002A06	0_2_0000000180002A06
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180001A10	0_2_0000000180001A10
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002A19	0_2_0000000180002A19
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003220	0_2_0000000180003220
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000225E	0_2_000000018000225E
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018001AA6C	0_2_000000018001AA6C
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000B280	0_2_000000018000B280
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180006AB0	0_2_0000000180006AB0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000C2D0	0_2_000000018000C2D0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003AE0	0_2_0000000180003AE0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003220	0_2_0000000180003220
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000435B	0_2_000000018000435B
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000C370	0_2_000000018000C370
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180023B98	0_2_0000000180023B98
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800033B8	0_2_00000001800033B8
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018001FC0C	0_2_000000018001FC0C
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180028464	0_2_0000000180028464
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003464	0_2_0000000180003464
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000947B	0_2_000000018000947B
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002C8A	0_2_0000000180002C8A
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180004CB0	0_2_0000000180004CB0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800044C1	0_2_00000001800044C1
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003CF2	0_2_0000000180003CF2
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002526	0_2_0000000180002526
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003530	0_2_0000000180003530
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180007550	0_2_0000000180007550
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180001D60	0_2_0000000180001D60
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180016D88	0_2_0000000180016D88
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800045A9	0_2_00000001800045A9
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003DBC	0_2_0000000180003DBC
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000360B	0_2_000000018000360B
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000B620	0_2_000000018000B620
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002E24	0_2_0000000180002E24
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180005E58	0_2_0000000180005E58
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002666	0_2_0000000180002666
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180029E8C	0_2_0000000180029E8C
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000469C	0_2_000000018000469C
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180024EB0	0_2_0000000180024EB0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000BEB0	0_2_000000018000BEB0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000B6C0	0_2_000000018000B6C0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180008EC0	0_2_0000000180008EC0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018001FED8	0_2_000000018001FED8
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_00000001800096E0	0_2_00000001800096E0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000DEE8	0_2_000000018000DEE8
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_000000018000C6F0	0_2_000000018000C6F0
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180003717	0_2_0000000180003717
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180010F18	0_2_0000000180010F18
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180021F44	0_2_0000000180021F44
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180006F70	0_2_0000000180006F70
Source: C:\Users\user\Desktop\hvix64.exe	Code function: 0_2_0000000180002777	0_2_0000000180002777
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001010	2_2_0000000180001010
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001A10	2_2_0000000180001A10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001D60	2_2_0000000180001D60
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003833	2_2_0000000180003833
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180028038	2_2_0000000180028038
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180014848	2_2_0000000180014848
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000284D	2_2_000000018000284D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018002C080	2_2_000000018002C080
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003880	2_2_0000000180003880
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800180EE	2_2_00000001800180EE
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800080F2	2_2_00000001800080F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000290C	2_2_000000018000290C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180004153	2_2_0000000180004153
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002170	2_2_0000000180002170
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B1AC	2_2_000000018000B1AC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800069E0	2_2_00000001800069E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800151E8	2_2_00000001800151E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002A06	2_2_0000000180002A06
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002A19	2_2_0000000180002A19
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003220	2_2_0000000180003220
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000225E	2_2_000000018000225E
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001AA6C	2_2_000000018001AA6C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B280	2_2_000000018000B280
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180006AB0	2_2_0000000180006AB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C2D0	2_2_000000018000C2D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003AE0	2_2_0000000180003AE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003220	2_2_0000000180003220
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000435B	2_2_000000018000435B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C370	2_2_000000018000C370
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180023B98	2_2_0000000180023B98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800033B8	2_2_00000001800033B8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180009BC0	2_2_0000000180009BC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001FC0C	2_2_000000018001FC0C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180028464	2_2_0000000180028464
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003464	2_2_0000000180003464
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000947B	2_2_000000018000947B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002C8A	2_2_0000000180002C8A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180004CB0	2_2_0000000180004CB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800044C1	2_2_00000001800044C1
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800054D5	2_2_00000001800054D5
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003CF2	2_2_0000000180003CF2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002526	2_2_0000000180002526
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003530	2_2_0000000180003530
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180007550	2_2_0000000180007550
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180016D88	2_2_0000000180016D88
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800045A9	2_2_00000001800045A9
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800015B0	2_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003DBC	2_2_0000000180003DBC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000360B	2_2_000000018000360B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B620	2_2_000000018000B620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002E24	2_2_0000000180002E24
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180005E58	2_2_0000000180005E58
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002666	2_2_0000000180002666
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180029E8C	2_2_0000000180029E8C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000469C	2_2_000000018000469C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180024EB0	2_2_0000000180024EB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000BEB0	2_2_000000018000BEB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B6C0	2_2_000000018000B6C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180008EC0	2_2_0000000180008EC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001FED8	2_2_000000018001FED8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800096E0	2_2_00000001800096E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000DEE8	2_2_000000018000DEE8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C6F0	2_2_000000018000C6F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003717	2_2_0000000180003717
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180010F18	2_2_0000000180010F18
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180021F44	2_2_0000000180021F44
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180006F70	2_2_0000000180006F70
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002777	2_2_0000000180002777
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF374F2	2_2_000001845BF374F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF474EE	2_2_000001845BF474EE
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF5B480	2_2_000001845BF5B480
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32C80	2_2_000001845BF32C80
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF43C48	2_2_000001845BF43C48
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31C4D	2_2_000001845BF31C4D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF57438	2_2_000001845BF57438
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32C33	2_2_000001845BF32C33
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF30410	2_2_000001845BF30410
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31B77	2_2_000001845BF31B77
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF36370	2_2_000001845BF36370
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF51344	2_2_000001845BF51344
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32B17	2_2_000001845BF32B17
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF40318	2_2_000001845BF40318
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3D2E8	2_2_000001845BF3D2E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3BAF0	2_2_000001845BF3BAF0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF4F2D8	2_2_000001845BF4F2D8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF38AE0	2_2_000001845BF38AE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF382C0	2_2_000001845BF382C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3AAC0	2_2_000001845BF3AAC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF542B0	2_2_000001845BF542B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B2B0	2_2_000001845BF3B2B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF33A9C	2_2_000001845BF33A9C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF5928C	2_2_000001845BF5928C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31A66	2_2_000001845BF31A66
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35258	2_2_000001845BF35258
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32224	2_2_000001845BF32224
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3AA20	2_2_000001845BF3AA20
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32A0B	2_2_000001845BF32A0B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF331BC	2_2_000001845BF331BC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF339A9	2_2_000001845BF339A9
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF309B0	2_2_000001845BF309B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF46188	2_2_000001845BF46188
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31160	2_2_000001845BF31160
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF36950	2_2_000001845BF36950
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31926	2_2_000001845BF31926
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32930	2_2_000001845BF32930
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF330F2	2_2_000001845BF330F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF348D5	2_2_000001845BF348D5
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF338C1	2_2_000001845BF338C1
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF340B0	2_2_000001845BF340B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3208A	2_2_000001845BF3208A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3887B	2_2_000001845BF3887B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32864	2_2_000001845BF32864
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF57864	2_2_000001845BF57864
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF4F00C	2_2_000001845BF4F00C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF327B8	2_2_000001845BF327B8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF38FC0	2_2_000001845BF38FC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF52F98	2_2_000001845BF52F98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B770	2_2_000001845BF3B770
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3375B	2_2_000001845BF3375B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32620	2_2_000001845BF32620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32EE0	2_2_000001845BF32EE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B6D0	2_2_000001845BF3B6D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35EB0	2_2_000001845BF35EB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3A680	2_2_000001845BF3A680
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF49E6C	2_2_000001845BF49E6C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3165E	2_2_000001845BF3165E
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31E19	2_2_000001845BF31E19
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32620	2_2_000001845BF32620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31E06	2_2_000001845BF31E06
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF30E10	2_2_000001845BF30E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF445E8	2_2_000001845BF445E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35DE0	2_2_000001845BF35DE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3A5AC	2_2_000001845BF3A5AC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31570	2_2_000001845BF31570
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF33553	2_2_000001845BF33553
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31D0C	2_2_000001845BF31D0C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012140	3_2_0000000180012140
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180015150	3_2_0000000180015150
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800224E0	3_2_00000001800224E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020680	3_2_0000000180020680
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800176E0	3_2_00000001800176E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F9E0	3_2_000000018001F9E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001AAD0	3_2_000000018001AAD0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180013E10	3_2_0000000180013E10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006FF7	3_2_0000000180006FF7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002E010	3_2_000000018002E010
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006057	3_2_0000000180006057
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001070	3_2_0000000180001070
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800020C7	3_2_00000001800020C7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A110	3_2_000000018000A110
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007113	3_2_0000000180007113
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000612D	3_2_000000018000612D
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180044140	3_2_0000000180044140
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007160	3_2_0000000180007160
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000517A	3_2_000000018000517A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000517C	3_2_000000018000517C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011180	3_2_0000000180011180
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001A190	3_2_000000018001A190
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180019190	3_2_0000000180019190
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000219F	3_2_000000018000219F
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A1E0	3_2_000000018000A1E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800061EC	3_2_00000001800061EC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180018230	3_2_0000000180018230
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001264	3_2_0000000180001264
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180031270	3_2_0000000180031270
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000227C	3_2_000000018000227C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027290	3_2_0000000180027290
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002B2D0	3_2_000000018002B2D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800642E0	3_2_00000001800642E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800062E6	3_2_00000001800062E6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000D2F0	3_2_000000018000D2F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800062F9	3_2_00000001800062F9
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029300	3_2_0000000180029300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003300	3_2_0000000180003300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180062327	3_2_0000000180062327
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025340	3_2_0000000180025340
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018005B380	3_2_000000018005B380
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800073C0	3_2_00000001800073C0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800173D0	3_2_00000001800173D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800083E0	3_2_00000001800083E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800013F7	3_2_00000001800013F7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018004C410	3_2_000000018004C410
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180014410	3_2_0000000180014410
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001D420	3_2_000000018001D420
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180023464	3_2_0000000180023464
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003470	3_2_0000000180003470
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800244B0	3_2_00000001800244B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800054E0	3_2_00000001800054E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800334F0	3_2_00000001800334F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026530	3_2_0000000180026530
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E550	3_2_000000018001E550
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000656A	3_2_000000018000656A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180009588	3_2_0000000180009588
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025590	3_2_0000000180025590
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001B5A0	3_2_000000018001B5A0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800075D2	3_2_00000001800075D2
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000F5E0	3_2_000000018000F5E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000C5F0	3_2_000000018000C5F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180016630	3_2_0000000180016630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001630	3_2_0000000180001630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018003664B	3_2_000000018003664B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180032660	3_2_0000000180032660
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180056670	3_2_0000000180056670
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000769C	3_2_000000018000769C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A6A0	3_2_000000018000A6A0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800486E0	3_2_00000001800486E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024700	3_2_0000000180024700
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006704	3_2_0000000180006704
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F710	3_2_000000018001F710
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000271A	3_2_000000018000271A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180033760	3_2_0000000180033760
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180063770	3_2_0000000180063770
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000176F	3_2_000000018000176F
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180018780	3_2_0000000180018780
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180052790	3_2_0000000180052790
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800367B8	3_2_00000001800367B8
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800257C0	3_2_00000001800257C0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002A7F0	3_2_000000018002A7F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180030810	3_2_0000000180030810
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000B822	3_2_000000018000B822
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027870	3_2_0000000180027870
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180028880	3_2_0000000180028880
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002F890	3_2_000000018002F890
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018003A8BC	3_2_000000018003A8BC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800138D0	3_2_00000001800138D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000E8DC	3_2_000000018000E8DC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024930	3_2_0000000180024930
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002971	3_2_0000000180002971
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000E9B0	3_2_000000018000E9B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800199F0	3_2_00000001800199F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180053A00	3_2_0000000180053A00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000FA00	3_2_000000018000FA00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180021A10	3_2_0000000180021A10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025A10	3_2_0000000180025A10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002AA30	3_2_000000018002AA30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003A32	3_2_0000000180003A32
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007A33	3_2_0000000180007A33
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001EA40	3_2_000000018001EA40
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005A50	3_2_0000000180005A50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180004A98	3_2_0000000180004A98
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000FAA0	3_2_000000018000FAA0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180035AD0	3_2_0000000180035AD0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006B00	3_2_0000000180006B00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005B3E	3_2_0000000180005B3E
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012B50	3_2_0000000180012B50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024B60	3_2_0000000180024B60
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000CBAB	3_2_000000018000CBAB
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180023BC0	3_2_0000000180023BC0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002BD6	3_2_0000000180002BD6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180008C05	3_2_0000000180008C05
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180030C20	3_2_0000000180030C20
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006B00	3_2_0000000180006B00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC27	3_2_000000018002FC27
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC30	3_2_000000018002FC30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC39	3_2_000000018002FC39
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007C3B	3_2_0000000180007C3B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC42	3_2_000000018002FC42
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC4B	3_2_000000018002FC4B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC54	3_2_000000018002FC54
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180065C60	3_2_0000000180065C60
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC5D	3_2_000000018002FC5D
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000AC80	3_2_000000018000AC80
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180035C90	3_2_0000000180035C90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025C90	3_2_0000000180025C90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006C98	3_2_0000000180006C98
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180036C9E	3_2_0000000180036C9E
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180061CA7	3_2_0000000180061CA7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003CA6	3_2_0000000180003CA6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180019CB0	3_2_0000000180019CB0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002CD2	3_2_0000000180002CD2
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180038D24	3_2_0000000180038D24
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002AD30	3_2_000000018002AD30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006D44	3_2_0000000180006D44
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000ED50	3_2_000000018000ED50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180062D70	3_2_0000000180062D70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001D80	3_2_0000000180001D80
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002D8A	3_2_0000000180002D8A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024D90	3_2_0000000180024D90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180018DA0	3_2_0000000180018DA0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007DA1	3_2_0000000180007DA1
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002BDC0	3_2_000000018002BDC0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000EDF0	3_2_000000018000EDF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018003DE00	3_2_000000018003DE00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005E06	3_2_0000000180005E06
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029E10	3_2_0000000180029E10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006E10	3_2_0000000180006E10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000CE10	3_2_000000018000CE10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000FE20	3_2_000000018000FE20
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001AE40	3_2_000000018001AE40
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007E89	3_2_0000000180007E89
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180059E90	3_2_0000000180059E90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180019EC0	3_2_0000000180019EC0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003EC7	3_2_0000000180003EC7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006EEB	3_2_0000000180006EEB
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005F46	3_2_0000000180005F46
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180036F5F	3_2_0000000180036F5F
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180016F60	3_2_0000000180016F60
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018005CF70	3_2_000000018005CF70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007F7C	3_2_0000000180007F7C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180021F80	3_2_0000000180021F80
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001F88	3_2_0000000180001F88
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180044F90	3_2_0000000180044F90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180034FA0	3_2_0000000180034FA0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180017FA0	3_2_0000000180017FA0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180015FB0	3_2_0000000180015FB0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180004FB5	3_2_0000000180004FB5
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024FC0	3_2_0000000180024FC0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001EFC0	3_2_000000018001EFC0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180012140	4_2_0000000180012140
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180018780	4_2_0000000180018780
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180023BC0	4_2_0000000180023BC0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180019CB0	4_2_0000000180019CB0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001AE40	4_2_000000018001AE40
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180006FF7	4_2_0000000180006FF7
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002E010	4_2_000000018002E010
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180006057	4_2_0000000180006057
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180001070	4_2_0000000180001070
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800020C7	4_2_00000001800020C7
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000A110	4_2_000000018000A110
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180007113	4_2_0000000180007113
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000612D	4_2_000000018000612D
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180044140	4_2_0000000180044140
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180015150	4_2_0000000180015150
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180007160	4_2_0000000180007160
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000517A	4_2_000000018000517A
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000517C	4_2_000000018000517C
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180011180	4_2_0000000180011180
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001A190	4_2_000000018001A190
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180019190	4_2_0000000180019190
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000219F	4_2_000000018000219F
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000A1E0	4_2_000000018000A1E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800061EC	4_2_00000001800061EC
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180018230	4_2_0000000180018230
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180001264	4_2_0000000180001264
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180031270	4_2_0000000180031270
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000227C	4_2_000000018000227C
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027290	4_2_0000000180027290
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002B2D0	4_2_000000018002B2D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800642E0	4_2_00000001800642E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800062E6	4_2_00000001800062E6
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000D2F0	4_2_000000018000D2F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800062F9	4_2_00000001800062F9
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029300	4_2_0000000180029300
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180003300	4_2_0000000180003300
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180062327	4_2_0000000180062327
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180025340	4_2_0000000180025340
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018005B380	4_2_000000018005B380
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800073C0	4_2_00000001800073C0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800173D0	4_2_00000001800173D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800083E0	4_2_00000001800083E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800013F7	4_2_00000001800013F7
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018004C410	4_2_000000018004C410
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180014410	4_2_0000000180014410
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001D420	4_2_000000018001D420
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180023464	4_2_0000000180023464
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180003470	4_2_0000000180003470
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800244B0	4_2_00000001800244B0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800224E0	4_2_00000001800224E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800054E0	4_2_00000001800054E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800334F0	4_2_00000001800334F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180026530	4_2_0000000180026530
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001E550	4_2_000000018001E550
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000656A	4_2_000000018000656A
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180009588	4_2_0000000180009588
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180025590	4_2_0000000180025590
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001B5A0	4_2_000000018001B5A0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800075D2	4_2_00000001800075D2
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000F5E0	4_2_000000018000F5E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000C5F0	4_2_000000018000C5F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180016630	4_2_0000000180016630
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180001630	4_2_0000000180001630
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018003664B	4_2_000000018003664B
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180032660	4_2_0000000180032660
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180056670	4_2_0000000180056670
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180020680	4_2_0000000180020680
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000769C	4_2_000000018000769C
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000A6A0	4_2_000000018000A6A0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800486E0	4_2_00000001800486E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800176E0	4_2_00000001800176E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180024700	4_2_0000000180024700
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180006704	4_2_0000000180006704
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001F710	4_2_000000018001F710
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000271A	4_2_000000018000271A
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180033760	4_2_0000000180033760
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180063770	4_2_0000000180063770
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000176F	4_2_000000018000176F
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180052790	4_2_0000000180052790
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800367B8	4_2_00000001800367B8
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800257C0	4_2_00000001800257C0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002A7F0	4_2_000000018002A7F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180030810	4_2_0000000180030810
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000B822	4_2_000000018000B822
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C850	4_2_000000018001C850
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027870	4_2_0000000180027870
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180028880	4_2_0000000180028880
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002F890	4_2_000000018002F890
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018003A8BC	4_2_000000018003A8BC
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800138D0	4_2_00000001800138D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000E8DC	4_2_000000018000E8DC
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180024930	4_2_0000000180024930
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180002971	4_2_0000000180002971
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000E9B0	4_2_000000018000E9B0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001F9E0	4_2_000000018001F9E0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800199F0	4_2_00000001800199F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180053A00	4_2_0000000180053A00
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000FA00	4_2_000000018000FA00
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180021A10	4_2_0000000180021A10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180025A10	4_2_0000000180025A10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002AA30	4_2_000000018002AA30
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180003A32	4_2_0000000180003A32
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180007A33	4_2_0000000180007A33
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001EA40	4_2_000000018001EA40
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180005A50	4_2_0000000180005A50
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180004A98	4_2_0000000180004A98
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000FAA0	4_2_000000018000FAA0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180035AD0	4_2_0000000180035AD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001AAD0	4_2_000000018001AAD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180006B00	4_2_0000000180006B00
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180005B3E	4_2_0000000180005B3E
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180012B50	4_2_0000000180012B50
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180024B60	4_2_0000000180024B60
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018000CBAB	4_2_000000018000CBAB
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180002BD6	4_2_0000000180002BD6
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180008C05	4_2_0000000180008C05
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180030C20	4_2_0000000180030C20
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180006B00	4_2_0000000180006B00
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002FC27	4_2_000000018002FC27
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002FC30	4_2_000000018002FC30
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002FC39	4_2_000000018002FC39
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180007C3B	4_2_0000000180007C3B

Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000000180044F40 appears 61 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000000180041800 appears 91 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 0000000180044F40 appears 61 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 0000000180041800 appears 91 times

Source: hvix64.exe

Static PE information: invalid certificate

Source: hvix64.exe	Binary or memory string: OriginalFilename vs hvix64.exe
Source: hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearphaCrashReport.exe2 vs hvix64.exe
Source: hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearphaCrashReport.exe2 vs hvix64.exe

Source: hvix64.exe

Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317

Source: hvix64.exe, 00000000.00000002.1746476578.00007FF66709C000.00000008.00000001.01000000.00000003.sdmp

Binary or memory string: ndre-land.nonet.slnet.soin-brb.de123website.lutrentino-stirol.it

Source: classification engine

Classification label: mal92.troj.evad.winEXE@7/3@0/1

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	3_2_0000000180020680
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180027290
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180029300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	3_2_0000000180020480
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180027870
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	3_2_0000000180029A70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001FD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	3_2_000000018001FD10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002CE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	3_2_000000018002CE70
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180027290
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180029300
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180020480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	4_2_0000000180020480
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180020680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	4_2_0000000180020680
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180027870
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	4_2_0000000180029A70
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001FD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	4_2_000000018001FD10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002CE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	4_2_000000018002CE70

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018001C4E0 memset,memset,memset,QueryDosDeviceW,GetDriveTypeW,lstrlenW,GetVolumeInformationW,lstrlenW,GetDiskFreeSpaceExW,

3_2_000000018001C4E0

Source: C:\Windows\System32\svchost.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,		3_2_00000001800263C0
Source: C:\Windows\System32\dllhost.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,		4_2_00000001800263C0

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800223B0 CreateToolhelp32Snapshot,malloc,Process32FirstW,lstrlenW,lstrlenW,Process32NextW,lstrlenW,Process32NextW,free,CloseHandle,

3_2_00000001800223B0

Source: C:\Users\user\Desktop\hvix64.exe

Code function: 0_2_0000000180001A10 CoInitialize,CLSIDFromString,IIDFromString,CoCreateInstance,

0_2_0000000180001A10

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Code function: 5_2_00007FF664534000 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00007FF664534000

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180012140 WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess,

3_2_0000000180012140

Source: C:\Windows\System32\svchost.exe

File created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Jump to behavior

Source: hvix64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\hvix64.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\hvix64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hvix64.exe	Virustotal: Detection: 15%
Source: hvix64.exe	ReversingLabs: Detection: 13%

Source: svchost.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: svchost.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}
Source: dllhost.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: dllhost.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}

Source: unknown	Process created: C:\Users\user\Desktop\hvix64.exe "C:\Users\user\Desktop\hvix64.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior

Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.dll			Jump to behavior

Source: hvix64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: hvix64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: hvix64.exe

Static file information: File size 23278936 > 1048576

Source: hvix64.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x9bec00
Source: hvix64.exe	Static PE information: Raw size of .vmp2 is bigger than: 0x100000 < 0xbf0400

Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hvix64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hvix64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: hvix64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Build\PX\A\PoisonX\nvsphelperplugin64\x64\Release\arphaDump64.pdb source: hvix64.exe, hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: hvix64.exe, hvix64.exe, 00000000.00000002.1743844700.0000022FCCF00000.00000004.00001000.00020000.00000000.sdmp, hvix64.exe, 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1770781974.00007FF664553000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe, 00000005.00000000.1763337817.00007FF664552000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe.2.dr

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845B3A0508 LoadLibraryA,GetProcAddressForCaller,

2_2_000001845B3A0508

Source: hvix64.exe	Static PE information: section name: .vmp2
Source: hvix64.exe	Static PE information: section name: .qtmetad
Source: hvix64.exe	Static PE information: section name: .qtmimed
Source: hvix64.exe	Static PE information: section name: _RDATA

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C3E0 push rcx; ret	3_2_000000018001C3E1
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800619F7 push FF491775h; ret	3_2_00000001800619FC
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C3E0 push rcx; ret	4_2_000000018001C3E1
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800619F7 push FF491775h; ret	4_2_00000001800619FC

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800230FE VirtualFree,VirtualFree,malloc,malloc,VirtualFree,VirtualFree,NetUserAdd,Sleep,NetLocalGroupAddMembers,free,free,

3_2_00000001800230FE

Source: C:\Windows\System32\svchost.exe

File created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018002D060 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_000000018002D060

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\svchost.exe

File deleted: c:\users\user\desktop\hvix64.exe

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018001BFC0 OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,

3_2_000000018001BFC0

Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain checking for user administrative privileges

Source: C:\Windows\System32\dllhost.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode
Source: C:\Users\user\Desktop\hvix64.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode	graph_0-13630
Source: C:\Windows\System32\svchost.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode	graph_2-27922

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180016F60 GetCurrentProcessId,ProcessIdToSessionId,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,CloseHandle,WTSGetActiveConsoleSessionId,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,CreateThread,VirtualFree,VirtualFree,VirtualFree,VirtualFree,

3_2_0000000180016F60

Source: C:\Users\user\Desktop\hvix64.exe	Code function: malloc,memcpy,malloc,memset,memcpy,memset,GetModuleFileNameW,malloc,memset,memcpy,OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	0_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: malloc,memcpy,malloc,memset,memcpy,memset,GetModuleFileNameW,malloc,memset,memcpy,OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	2_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	3_2_000000018002D140
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018002F890
Source: C:\Windows\System32\dllhost.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	4_2_000000018002D140
Source: C:\Windows\System32\dllhost.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018002F890

Source: C:\Windows\System32\svchost.exe	API coverage: 7.5 %
Source: C:\Windows\System32\dllhost.exe	API coverage: 3.2 %

Source: C:\Windows\System32\svchost.exe TID: 7524

Thread sleep count: 32 > 30

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	3_2_000000018001E210
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	3_2_000000018001DDD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	4_2_000000018001E210
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001C850
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001CCF0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	4_2_000000018001DDD0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF664548F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF664548F78

Source: C:\Windows\System32\svchost.exe

3_2_0000000180029300

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800224E0 memset,memset,memset,memset,gethostname,gethostbyname,inet_ntoa,wsprintfW,lstrcatW,GetForegroundWindow,GetWindowTextW,VirtualAlloc,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,VirtualFree,GetComputerNameW,GetCurrentProcess,IsWow64Process,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,GetSystemInfo,wsprintfW,GlobalMemoryStatusEx,wsprintfW,VirtualAlloc,VirtualAlloc,GetUserNameW,GetCurrentProcessId,wsprintfW,VirtualFree,VirtualFree,memset,GetWindowsDirectoryW,GetLastError,GetVolumeInformationW,wsprintfA,wsprintfA,wsprintfW,CoInitializeEx,CoCreateInstance,SysFreeString,CoUninitialize,GetCurrentProcess,IsWow64Process,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,

3_2_00000001800224E0

Source: svchost.exe, 00000002.00000002.2977530184.000001845AC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: hvix64.exe	Binary or memory string: .?AVQEmulationPaintEngine@@
Source: svchost.exe, 00000002.00000002.2977598200.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000000.1725807215.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.2976579345.000002D977413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dllhost.exe, 00000004.00000002.2976440759.00000182923CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll((

Source: C:\Users\user\Desktop\hvix64.exe	API call chain: ExitProcess graph end node			graph_0-13637
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node			graph_2-27929

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018002E010 BlockInput,BlockInput,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,mouse_event,BlockInput,

3_2_000000018002E010

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_0000000180064130

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Code function: 5_2_00007FF66453D1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF66453D1E8

Source: C:\Windows\System32\svchost.exe

3_2_0000000180016F60

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180034DA0 VirtualAlloc ?,?,00000000,0000000180035130,?,?,00000000,0000000180014AAC

3_2_0000000180034DA0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845B3A0508 LoadLibraryA,GetProcAddressForCaller,

2_2_000001845B3A0508

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_00000001800194C0 CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,CloseHandle,WTSGetActiveConsoleSessionId,WaitForSingleObject,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,CloseHandle,WTSGetActiveConsoleSessionId,WaitForSingleObject,VirtualFree,VirtualFree,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,

3_2_00000001800194C0

Source: C:\Users\user\Desktop\hvix64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001801129E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00000001801129E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180060030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000000180060030
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000000180064130
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180060770 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000000180060770
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180060030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000000180060030
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000000180064130
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180060770 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000000180060770
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF66453EEF4 SetUnhandledExceptionFilter,	5_2_00007FF66453EEF4
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF6645421D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF6645421D8
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF66453E440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF66453E440
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF66453ED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF66453ED0C

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: ParphaCrashReport64.exe.2.dr

Jump to dropped file

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\hvix64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B370000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845BE00000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B390000 protect: page read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_000000018001F9E0 VirtualAllocEx,GetLastError,VirtualAllocEx,WriteProcessMemory,GetLastError,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,memset,GetThreadContext,SetThreadContext,memset,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,GetLastError,

3_2_000000018001F9E0

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002E4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	3_2_000000018002E4D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	3_2_000000018001F710
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	3_2_0000000180029E10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002E4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	4_2_000000018002E4D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001F710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	4_2_000000018001F710
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	4_2_0000000180029E10

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 7544			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 7584			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\hvix64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845BE00000	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000	Jump to behavior
Source: C:\Users\user\Desktop\hvix64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 18292200000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 18292290000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 182921F0000	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe		3_2_0000000180012140
Source: C:\Windows\System32\dllhost.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe		4_2_0000000180012140

Source: C:\Windows\System32\svchost.exe

3_2_000000018002E010

Source: C:\Windows\System32\svchost.exe

3_2_000000018002E010

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior

Source: dllhost.exe, 00000004.00000003.2961263042.0000018294930000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000003.00000003.2377527258.000002D978380000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2377555589.000002D9783F0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000004.00000003.2357630281.0000018294930000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Managerl&"[System Process]
Source: svchost.exe, 00000003.00000003.2377804772.000002D978BA0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2377579581.000002D978C20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TCPProgram Managerl&"[System Process]

Source: C:\Users\user\Desktop\hvix64.exe

Code function: 0_2_000000018002BBA8 cpuid

0_2_000000018002BBA8

Source: C:\Users\user\Desktop\hvix64.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180027E20 CreateNamedPipeW,GetLastError,ConnectNamedPipe,GetLastError,

3_2_0000000180027E20

Source: C:\Users\user\Desktop\hvix64.exe

Code function: 0_2_0000000180112B5C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000180112B5C

Source: C:\Windows\System32\svchost.exe

3_2_00000001800224E0

Stealing of Sensitive Information

Yara detected ValleyRAT

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 1044, type: MEMORYSTR

Remote Access Functionality

Yara detected ValleyRAT

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 1044, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180021520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	3_2_0000000180021520
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180047630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	3_2_0000000180047630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018004A830 socket,socket,htonl,bind,getsockname,	3_2_000000018004A830
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180056B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	3_2_0000000180056B30
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180021520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	4_2_0000000180021520
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180047630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	4_2_0000000180047630
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018004A830 socket,socket,htonl,bind,getsockname,	4_2_000000018004A830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180056B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	4_2_0000000180056B30

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Create Account	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	11 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	12 Windows Service	12 Windows Service	1 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	1 Scheduled Task/Job	523 Process Injection	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 File Deletion	Cached Domain Credentials	1 Network Share Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	41 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	4 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	523 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hvix64.exe	15%	Virustotal		Browse
hvix64.exe	13%	ReversingLabs	Win64.Dropper.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files\Windows Mail\ParphaCrashReport64.exe	4%	ReversingLabs

Name	Source	Malicious	Reputation
https://support.google.com/chrome/answer/6098869?hl=es	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/answer/6098869	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.html	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=es-419Ctrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=etCtrl$1	hvix64.exe	false	high
https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSaved	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=zh-TWCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://myactivity.google.com/	hvix64.exe	false	high
https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSelle	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://passwords.google.comGestoorde	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.com	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://policies.google.com/	hvix64.exe	false	high
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=esCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://ejemplo.com.Se	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=afCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSe	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://www.google.com/chrome/privacy/eula_text.html&AideG	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comMots	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore/category/extensions	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chromebook?p=app_intent	hvix64.exe	false	high
https://chrome.google.com/webstore?hl=frCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=es-419&category=theme81https://myactivity.google.com/myactivit	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comT	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/answer/96817	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/a/?p=browser_profile_details	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=filCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comMga	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/a/answer/9122284	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=enCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comContrase	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=fiCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlBestuur	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlO&hjeOrganisaatiosi	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
http://ejemplo.com	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlA&yudaAdministrado	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=en-GBCtrl$1	hvix64.exe, 00000000.00000002.1746476578.00007FF666866000.00000008.00000001.01000000.00000003.sdmp, hvix64.exe, 00000000.00000000.1719172318.00007FF666815000.00000008.00000001.01000000.00000003.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
18.166.193.8	unknown	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579279
Start date and time:	2024-12-21 12:41:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hvix64.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@7/3@0/1
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 99% Number of executed functions: 56 Number of non-executed functions: 283
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ParphaCrashReport64.exe, PID 7632 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:42:13	Task Scheduler	Run new task: MicrosoftMailUpdateTask path: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	34.221.123.182
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.196.33.98
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.203.198.124
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	15.228.127.139
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	13.217.229.62
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.201.109.132
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	175.41.191.50
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.182.250.212
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	52.11.191.179
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	13.220.3.75

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\Windows Mail\ParphaCrashReport64.exe	2024-12-10#U67e5#U9605_uninst.exe	Get hash	malicious	ValleyRAT	Browse
	2024-12-10#U67e5#U9605_uninst.exe	Get hash	malicious	ValleyRAT	Browse
	png131.exe	Get hash	malicious	ValleyRAT	Browse
	install.exe	Get hash	malicious	ValleyRAT	Browse
	Telegrm2.69.exe	Get hash	malicious	Unknown	Browse
	Telegrm2.69.exe	Get hash	malicious	Unknown	Browse
	file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: 2024-12-10#U67e5#U9605_uninst.exe, Detection: malicious, Browse Filename: 2024-12-10#U67e5#U9605_uninst.exe, Detection: malicious, Browse Filename: png131.exe, Detection: malicious, Browse Filename: install.exe, Detection: malicious, Browse Filename: Telegrm2.69.exe, Detection: malicious, Browse Filename: Telegrm2.69.exe, Detection: malicious, Browse Filename: file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\Program Files\Windows Mail\arphaDump64.dll

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	546252
Entropy (8bit):	6.543985233910406
Encrypted:	false
SSDEEP:	12288:awnKbeNO/thmmWIK3z9rG3U9szzrHUPRxG0+UfYlrYSe:flXDp9HPYlr5e
MD5:	55EF931D0099F4A27D6291E8149F9BEE
SHA1:	3139CC82AC7E924885D12221CE269551086758F8
SHA-256:	6AC58F3AF83E181925CF487AFC833998FC7BCF7BF87DF9356D6383F562AECC9A
SHA-512:	2E72BD59E5C193D36167EA8FAB6A7CE92FFAF781024B97C755AEF576BD50C76C15C3DF05C7FFA0DD9ABDAF2738EAE5C7CE9B8B3CF9B803E475170446D0B0BEDA
Malicious:	false
Reputation:	low
Preview:	4...H..(H...D$8run.H.L$8.O...H..(...eH..%`......D..3.L..E..t"A........A..a.J..L.I....A..D....u..H.A.....H.\$.H.l$.H.t$.WAVAWH.. D......H.P.H.j L..I.......M..L.P0M..tLIcB<B.........t<I.<..O.I...j....w 3.I..D..9_.v...I...P...A..D;.t+..H...;_.r.L;.u.3.H.\$@H.l$HH.t$PH.. A_A^_.O$I..D...Y.O.I..B...I.......@SH.. H.......%...H..H.. [H....H.\$.WH.. H..H...........H..H..H.\$0H.. _H.....H.\$.UVWATAUAVAWH.. L..M..3.Z.H........2=..L.......-A..H.D$x....M..M.f.H.D$p3...A..y.H..(fA;A.s\|I..9.u29E8~ZHc]8A......O.H..I..A.....A..L..G.3.H...T$p.-.O.A.......I..A.....A..W.H..D..I..H...T$x._.I....H..(..H......;.\|.H.\$`H.. A_A^A]A\_^].H.\$.H.l$.H.t$ WATAUAVAWH..@L..-A........ ...H.L$ D..H..3...D.g.E..H.L$ A....E..W.H.L$$..E..W.H.L$(..E..W.H.L$,..E..W.H.L$0..E..W`H.L$4..E..H.L$8....E..W H.L$<....O.B....../.H...5...M..E3.L..A..H.........A..Y.I.q0H..(H#.fE;i.......I..D.C.A.....A.....E..A#.A...A#.A....s..K.A..@....H.....OH..B..I..RD.T. A....A....D.CT. ..u.A..@t.A.A ..E..y.A.A$..t..K.L.L$pH...E.

C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	3.559796516107948
Encrypted:	false
SSDEEP:	48:yei1q9tNTyOXZj9c9V9Lbra+iaiudupRCRvA9ufAuRa7T5XhPsV8ic4dTKp+++:tX4diaigVA9ll7dhFF7+
MD5:	79C8530188472FA4159DE398A9CA797F
SHA1:	0B8743354489D4460DA39E8E4EF2230E9925F638
SHA-256:	46722563913B24900DFD02AFD809AE2BBABB5CE420AA81ECBF008F7ACE247F34
SHA-512:	2079F7EA505FC410028A0D36A408AFE97E0BDED14548EE6448F692FEEF2D55D52CE6EC9DF5A016C6737595275FF6BD5F4D5397F0C128445ED262B75BF4DD7EE5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.A.u.t.h.o.r.>.S.Y.S.T.E.M.<./.A.u.t.h.o.r.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.M.i.c.r.o.s.o.f.t. .M.a.i.l. .U.p.d.a.t.e. .T.a.s.k. .M.a.c.h.i.n.e.C.o.r.e.<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t.M.a.i.l.U.p.d.a.t.e.T.a.s.k.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.B.o.o.t.T.r.i.g.g.e.r.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.B.o.o.t.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.U.s.e.r.I.d.>.S.-.1.-.5.-.1.8.<./.U.s.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.997705641446781
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hvix64.exe
File size:	23'278'936 bytes
MD5:	60c37e8f119030afec51722aa561f768
SHA1:	5559158217b6df32004c8eee33c1ab21dbfde7b1
SHA256:	d29b670dbbf40bf66b5c01d20c291f39fdb503fe35fb71f0ab0565dd8797943a
SHA512:	b3ad900f0225c16b2e13e866696f889f17fd0c51a861380c8b038e6f573fc41436305b111d8bf0fcfa6569af08291199074755f77e0c46dbf24d6186667ebcfb
SSDEEP:	393216:D1/Uf6MyNXElYsjLl7Skew2j+bqJqJsv6tWKFdu9C:J4pKRiqJ
TLSH:	8B37BF07B2900699E072E078DA47C127FB71F418A76097DB35A896D92F73BF0A93B351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................\|.....7.............................................r...................\...r.......s.......s......

File Icon


Icon Hash:	8c183c3aceacac48

Static PE Info

General

Entrypoint:	0x1408afff0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x675000B5 [Wed Dec 4 07:11:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7ef050b01014b0234d5be0c3d4a81582

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/02/2023 00:05:41 01/02/2024 00:05:41
Subject Chain	CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	8BA9D783638C7A19E193C5B6A251F742
Thumbprint SHA-1:	58FD671E2D4D200CE92D6E799EC70DF96E6D2664
Thumbprint SHA-256:	1721693D3E23C7ABF800AE7B86654ED86DCEAB48C530A57C00D24EF23FF7407E
Serial:	330000041331BC198807A90774000000000413

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F965146886Ch
dec eax
add esp, 28h
jmp 00007F9651467BCFh
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
mov edx, 00000FA0h
dec eax
lea ecx, dword ptr [00D17776h]
call dword ptr [00110668h]
dec eax
lea ecx, dword ptr [00BD9769h]
call dword ptr [001102BBh]
dec eax
mov ebx, eax
dec eax
test eax, eax
jne 00007F9651467D67h
dec eax
lea ecx, dword ptr [00BD979Ch]
call dword ptr [001102A6h]
dec eax
mov ebx, eax
dec eax
test eax, eax
je 00007F9651467DD1h
dec eax
lea edx, dword ptr [00BD97A7h]
dec eax
mov ecx, ebx
call dword ptr [00110296h]
dec eax
lea edx, dword ptr [00BD97B7h]
dec eax
mov ecx, ebx
dec eax
mov edi, eax
call dword ptr [00110283h]
dec eax
test edi, edi
je 00007F9651467D67h
dec eax
test eax, eax
je 00007F9651467D62h
dec eax
mov dword ptr [00D1773Ah], edi
dec eax
mov dword ptr [00D1773Bh], eax
jmp 00007F9651467D70h
inc ebp
xor ecx, ecx
inc ebp
xor eax, eax
xor ecx, ecx
inc ecx
lea edx, dword ptr [ecx+01h]
call dword ptr [001105A7h]
dec eax
mov dword ptr [00D176E8h], eax
dec eax
test eax, eax
je 00007F9651467D76h
xor ecx, ecx
call 00007F9651467879h
test al, al
je 00007F9651467D6Bh
dec eax
lea ecx, dword ptr [0000001Dh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c0f38	0x154	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x161b000	0x21ea8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa221a8	0x75e1c	.vmp2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1631000	0x2558	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x163d000	0xc1f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14d1238	0x1c	.vmp2
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x14d1400	0x28	.vmp2
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14d1260	0x138	.vmp2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c0000	0xf10	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9bea60	0x9bec00	ad7a18a94e844ab16267efbd30a99280	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.idata	0x9c0000	0x424e	0x4400	ffa77a54d4f138e8c9bbfab0fcc8e5ef	False	0.3131893382352941	data	4.775786531589324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp2	0x9c5000	0xc0455c	0xbf0400	4c873b07176e22ce18d7f04c3f33cd73	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.qtmetad	0x15ca000	0x536	0x600	bfd0a37e057f358d80d1716d9a9abd7e	False	0.24609375	data	5.0500249701877475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.qtmimed	0x15cb000	0x4ece5	0x4ee00	2d32d357ab751ffbbb513570c6ee6986	False	0.997458770800317	gzip compressed data, original size modulo 2^32 0	7.998000978505572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
_RDATA	0x161a000	0x130	0x200	4cf87728c7431acc28c0e2229f313f5a	False	0.318359375	data	2.6787961516860954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x161b000	0x21ea8	0x22000	81e384a870fe61afeb15e7ad050af826	False	0.06386431525735294	data	0.8760938299552002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x163d000	0xc1f8	0xc200	ae4ac34fee01f20308f4133c27853680	False	0.16233086340206185	data	5.483512500297378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x161b1f8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.038137347687211644
RT_ICON	0x162ba20	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m			0.06277590918646206
RT_ICON	0x1634ec8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.0839041095890411
RT_ICON	0x16390f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.11047717842323651
RT_ICON	0x163b698	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.15431519699812382
RT_ICON	0x163c740	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.28102836879432624
RT_GROUP_ICON	0x163cba8	0x5a	data			0.7777777777777778
RT_VERSION	0x163cc04	0x29c	data	English	United States	0.4820359281437126

Imports

DLL	Import
WTSAPI32.dll	WTSFreeMemory, WTSQuerySessionInformationW
UxTheme.dll	GetThemeColor, GetThemeInt, GetThemePartSize, OpenThemeData, GetThemeEnumValue, GetThemeMargins, GetCurrentThemeName, IsAppThemed, IsThemeActive, SetWindowTheme, GetThemeBool, IsThemeBackgroundPartiallyTransparent, GetThemeBackgroundRegion, CloseThemeData, GetThemeTransitionDuration, GetThemePropertyOrigin
dwmapi.dll	DwmGetWindowAttribute, DwmIsCompositionEnabled, DwmSetWindowAttribute, DwmEnableBlurBehindWindow
GDI32.dll	CreateRectRgn, DeleteDC, DeleteObject, GetRegionData, SelectClipRgn, SelectObject, CreateDIBSection, GdiFlush, BitBlt, CreateCompatibleDC, SetLayout, GetDeviceCaps, CreateCompatibleBitmap, CreateDCW, CreateBitmap, ChoosePixelFormat, SetPixelFormat, DescribePixelFormat, GetPixelFormat, SwapBuffers, GetBitmapBits, GetObjectW, CreateFontIndirectW, EnumFontFamiliesExW, GetFontData, GetStockObject, AddFontResourceExW, RemoveFontResourceExW, AddFontMemResourceEx, RemoveFontMemResourceEx, GetTextMetricsW, GetTextFaceW, GetCharABCWidthsW, GetCharABCWidthsFloatW, GetGlyphOutlineW, GetOutlineTextMetricsW, GetTextExtentPoint32W, GetCharABCWidthsI, SetBkMode, SetGraphicsMode, SetTextColor, SetTextAlign, SetWorldTransform, ExtTextOutW, CombineRgn, OffsetRgn, GetDIBits
OLEAUT32.dll	SafeArrayPutElement, SysAllocString, SafeArrayCreateVector, SysFreeString
IMM32.dll	ImmGetVirtualKey, ImmSetCandidateWindow, ImmGetDefaultIMEWnd, ImmGetContext, ImmReleaseContext, ImmAssociateContext, ImmAssociateContextEx, ImmGetCompositionStringW, ImmGetOpenStatus, ImmNotifyIME, ImmSetCompositionWindow
KERNEL32.dll	EnterCriticalSection, RaiseException, lstrcmpW, GetLastError, GetCurrentThreadId, GetModuleHandleW, GetProcAddress, LocalFree, FormatMessageW, WTSGetActiveConsoleSessionId, ExpandEnvironmentStringsW, CloseHandle, CreateProcessW, CheckRemoteDebuggerPresent, OpenProcess, GlobalAlloc, GlobalUnlock, GlobalLock, GetLocaleInfoW, LoadLibraryW, LoadLibraryA, GlobalSize, GetCurrentProcessId, GetUserDefaultLangID, CreateFileW, GetFileSizeEx, ReadFile, WriteFile, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, WideCharToMultiByte, RtlPcToFileHeader, GetExitCodeProcess, GetUserGeoID, InitializeCriticalSectionEx, GetTimeZoneInformation, GetModuleHandleExW, FreeLibrary, FindNextFileW, VirtualFree, VirtualAlloc, CreateMutexW, ReleaseMutex, InitializeCriticalSection, WriteConsoleW, HeapSize, GetProcessHeap, FreeEnvironmentStringsW, FindFirstFileExW, FindNextChangeNotification, FindFirstChangeNotificationW, FindCloseChangeNotification, MultiByteToWideChar, LCMapStringW, CompareStringW, RegisterWaitForSingleObject, UnregisterWaitEx, SetFilePointerEx, SetEndOfFile, GetFileType, FlushFileBuffers, GetFileInformationByHandleEx, SystemTimeToFileTime, FileTimeToSystemTime, TzSpecificLocalTimeToSystemTime, MoveFileExW, MoveFileW, CopyFileW, DeviceIoControl, SetErrorMode, GetVolumePathNamesForVolumeNameW, GetTempPathW, SetFileTime, RemoveDirectoryW, GetLogicalDrives, GetFullPathNameW, GetFileInformationByHandle, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, CreateDirectoryW, GetCurrentDirectoryW, GetModuleFileNameW, GetStartupInfoW, GetTickCount64, QueryPerformanceFrequency, QueryPerformanceCounter, GetFileAttributesExW, GetUserPreferredUILanguages, GetUserDefaultLCID, GetCurrencyFormatW, GetTimeFormatW, GetDateFormatW, ResetEvent, GetSystemInfo, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, ResumeThread, TerminateThread, GetThreadPriority, SetThreadPriority, GetCurrentThread, CreateThread, WaitForMultipleObjects, Sleep, WaitForSingleObject, DuplicateHandle, GetSystemDirectoryW, CreateEventW, WaitForSingleObjectEx, SetEvent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, OutputDebugStringW, GetLocalTime, GetSystemTime, InitializeCriticalSectionAndSpinCount, GetCommandLineW, CompareStringEx, GetConsoleWindow, GetDriveTypeW, GetVolumeInformationW, GetLongPathNameW, DeleteCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, SetLastError, RtlUnwind, LoadLibraryExW, ExitProcess, GetCommandLineA, ExitThread, FreeLibraryAndExitThread, SetFileAttributesW, SetStdHandle, GetConsoleMode, ReadConsoleW, GetConsoleCP, GetStdHandle, HeapFree, HeapAlloc, HeapReAlloc, RtlUnwindEx, GetCPInfo, IsValidLocale, GetGeoInfoW, SetEnvironmentVariableW, IsValidCodePage, GetACP, GetOEMCP, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EnumSystemLocalesW, GetEnvironmentStringsW, GetSystemTimeAsFileTime, InitializeSListHead
ole32.dll	OleFlushClipboard, OleGetClipboard, OleSetClipboard, CoCreateGuid, CoInitialize, CoCreateInstance, CoUninitialize, OleUninitialize, OleInitialize, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleIsCurrentClipboard, DoDragDrop, CoTaskMemFree, ReleaseStgMedium, CoInitializeEx, CoGetMalloc, StringFromGUID2
SHELL32.dll	SHGetKnownFolderPath, CommandLineToArgvW, SHGetFileInfoW, SHGetStockIconInfo, ShellExecuteW, SHCreateItemFromIDList, SHCreateItemFromParsingName, SHGetMalloc, SHGetPathFromIDListW, SHGetKnownFolderIDList, SHBrowseForFolderW, Shell_NotifyIconW, Shell_NotifyIconGetRect
USER32.dll	IsZoomed, PeekMessageW, FindWindowA, SetCaretPos, GetIconInfo, CreateIconIndirect, CreateCursor, ShowCaret, HideCaret, DestroyCaret, CreateCaret, IsWindowEnabled, RegisterWindowMessageW, GetKeyboardLayout, RegisterClipboardFormatW, SetClipboardViewer, IsHungAppWindow, LoadIconW, EnumDisplayMonitors, GetMonitorInfoW, MonitorFromWindow, SetMenuItemInfoW, GetMenuItemInfoW, TrackPopupMenu, RemoveMenu, ModifyMenuW, AppendMenuW, InsertMenuW, DestroyMenu, CreatePopupMenu, CreateMenu, DrawMenuBar, SetMenu, LoadImageW, GetSysColorBrush, ChildWindowFromPointEx, WindowFromPoint, GetCursorPos, GetFocus, RegisterClassExW, GetClassInfoW, UnregisterClassW, UnregisterPowerSettingNotification, RegisterPowerSettingNotification, GetKeyboardLayoutList, GetAncestor, DestroyIcon, DestroyCursor, GetWindow, GetWindowThreadProcessId, SetParent, GetParent, SetWindowLongPtrW, GetKeyboardState, LoadCursorW, GetWindowLongW, ScreenToClient, ClientToScreen, SetCursor, AdjustWindowRectEx, GetWindowRect, GetClientRect, SetWindowTextW, InvalidateRect, SetWindowRgn, GetUpdateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, EnableMenuItem, GetSystemMenu, GetMenu, ReleaseCapture, SetCapture, GetCapture, IsTouchWindow, UnregisterTouchWindow, RegisterTouchWindow, SetFocus, IsIconic, IsWindowVisible, SetWindowPlacement, GetWindowPlacement, SetWindowPos, MoveWindow, FlashWindowEx, SetLayeredWindowAttributes, UpdateLayeredWindow, ShowWindow, IsChild, CreateWindowExW, AttachThreadInput, PostMessageW, SendMessageW, UpdateLayeredWindowIndirect, GetCaretBlinkTime, MessageBeep, IsWindow, GetDoubleClickTime, GetDesktopWindow, GetSysColor, ReleaseDC, GetDC, DestroyWindow, DefWindowProcW, SystemParametersInfoW, GetSystemMetrics, GetKeyState, ToAscii, ToUnicode, MapVirtualKeyW, TrackPopupMenuEx, ChangeWindowMessageFilterEx, RealGetWindowClassW, EnumWindows, GetWindowTextW, CloseTouchInputHandle, GetTouchInputInfo, GetAsyncKeyState, GetMessageExtraInfo, TrackMouseEvent, GetClipboardFormatNameW, GetWindowLongPtrW, MessageBoxW, DrawIconEx, TranslateMessage, DispatchMessageW, GetQueueStatus, GetCursor, GetCursorInfo, SetCursorPos, EnumDisplayDevicesW, SetWindowLongW, RegisterClassW, MsgWaitForMultipleObjectsEx, SetTimer, KillTimer, CharNextExA, RegisterDeviceNotificationW, UnregisterDeviceNotification, MonitorFromPoint, ChangeClipboardChain
WINMM.dll	timeSetEvent, PlaySoundW, timeKillEvent
USERENV.dll	GetUserProfileDirectoryW
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
NETAPI32.dll	NetApiBufferFree, NetShareEnum
WS2_32.dll	WSAAsyncSelect
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegQueryValueExW, SystemFunction036, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegQueryInfoKeyW, RegSetValueExW, OpenProcessToken, AccessCheck, AllocateAndInitializeSid, CopySid, DuplicateToken, FreeSid, GetLengthSid, MapGenericMask, LookupAccountSidW, GetEffectiveRightsFromAclW, GetNamedSecurityInfoW, BuildTrusteeWithSidW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 12:42:13.082446098 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:13.202012062 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:13.202090025 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:13.202205896 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:13.321619034 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:14.758285999 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:14.798209906 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:15.310182095 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:15.429780006 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:25.438827991 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:25.558473110 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:35.563853979 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:35.683621883 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:45.689018965 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:45.809111118 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:42:55.813942909 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:42:55.933646917 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:05.938980103 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:06.135104895 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:16.023711920 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:16.142115116 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:16.143413067 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:16.261782885 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:26.267230034 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:26.387727976 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:36.392170906 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:36.511696100 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:46.517209053 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:46.637933969 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:43:56.642237902 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:43:56.761811018 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:44:06.767277956 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:44:06.887003899 CET	80	49733	18.166.193.8	192.168.2.4
Dec 21, 2024 12:44:16.708856106 CET	49733	80	192.168.2.4	18.166.193.8
Dec 21, 2024 12:44:16.829385996 CET	80	49733	18.166.193.8	192.168.2.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	18.166.193.8	80	7544	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 12:42:13.202205896 CET	56	OUT	Data Raw: 13 1d 0d 11 0f 22 0c 20 2c 04 0e 09 06 08 29 2c 26 23 1f 1e 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 Data Ascii: " ,),&#::::::::::::::::::::::::::::::::=8
Dec 21, 2024 12:42:14.758285999 CET	85	IN	Data Raw: 0a 1a 12 13 01 0c 0d 21 1f 0f 16 16 0b 1d 29 00 2a 26 29 07 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a 5e 3a 3a 3a 27 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c 63 b2 12 b1 e2 b3 e2 01 92 dc 56 1c 56 9c 60 9a c9 8a d9 8a 9a 00 00 b5 Data Ascii: !)*&)::::::::::::::::;:::^:::':::::::=8xcVV`Iu
Dec 21, 2024 12:42:15.310182095 CET	845	OUT	Data Raw: 0a 1a 12 13 01 0c 0d 21 1f 0f 16 16 0b 1d 29 00 2a 26 29 07 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a 50 0a 3a 3a 2f 39 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 5a 5d 6b 1a 41 14 2d 06 8a 51 6b f2 e0 43 90 b4 94 50 4a 29 a5 4f 7d Data Ascii: !)*&)::::::::::::::::;:::P::/9::::::=8xZ]kA-QkCPJ)O}:O5+f>1(]6&Y9sg;ID5=Ci?#Lv"#I mvK"(6dZMZ)=Oc+0!yM$wKZA`H,R
Dec 21, 2024 12:42:25.438827991 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 21, 2024 12:42:35.563853979 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 21, 2024 12:42:45.689018965 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 21, 2024 12:42:55.813942909 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 21, 2024 12:43:05.938980103 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 21, 2024 12:43:16.023711920 CET	652	OUT	Data Raw: 0d 1f 20 05 1a 1a 00 22 06 07 14 10 23 1f 17 18 03 04 17 10 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 32 1a 3a 3a 54 12 3a 3a 6e 38 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 99 41 6b 13 51 10 c7 c1 93 e0 c5 43 0f 25 14 91 22 22 22 c5 83 a7 c1 Data Ascii: "#::::::::::::::::2::T::n8::::::=8xAkQC%"""]Jl%b,4RLP7Bq4&1IyffMH&r"H$J!o?A>k}Y+^@y%3n4pc$rp!%t^t,_sFuildM8A;
Dec 21, 2024 12:43:16.142115116 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	06:42:09
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\hvix64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\hvix64.exe"
Imagebase:	0x7ff665e50000
File size:	23'278'936 bytes
MD5 hash:	60C37E8F119030AFEC51722AA561F768
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:42:09
Start date:	21/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:42:11
Start date:	21/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:42:12
Start date:	21/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:42:13
Start date:	21/12/2024
Path:	C:\Program Files\Windows Mail\ParphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Mail\ParphaCrashReport64.exe"
Imagebase:	0x7ff664530000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	76.4%
Total number of Nodes:	110
Total number of Limit Nodes:	4

Executed Functions

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211
servicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00000001800015E5
memcpy.NTDLL ref: 0000000180001609
malloc.MSVCRT ref: 0000000180001613
memset.NTDLL ref: 0000000180001648
memset.NTDLL ref: 00000001800016A8
GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
malloc.MSVCRT ref: 00000001800016CD
memset.NTDLL ref: 00000001800016E7
memcpy.NTDLL ref: 00000001800016F5
OpenSCManagerW.ADVAPI32 ref: 0000000180001789
EnumServicesStatusExW.ADVAPI32 ref: 00000001800017D0
malloc.MSVCRT ref: 00000001800017E2
memset.NTDLL ref: 00000001800017FC
EnumServicesStatusExW.ADVAPI32 ref: 0000000180001838
CloseServiceHandle.ADVAPI32 ref: 0000000180001845
free.MSVCRT ref: 000000018000184E
CloseServiceHandle.ADVAPI32 ref: 0000000180001856
lstrcmpiW.KERNEL32 ref: 0000000180001881

Strings

Schedule, xrefs: 0000000180001872

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: mallocmemset$CloseEnumHandleServiceServicesStatusmemcpy$FileManagerModuleNameOpenfreelstrcmpi
String ID: Schedule
API String ID: 3636854120-2739827629
Opcode ID: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction ID: 6ee3f7f16e62e9fbbf62cb728b63543f6f6100922e48a7ada6915e3d38cfd098
Opcode Fuzzy Hash: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction Fuzzy Hash: 84A1AE36705B8886EBA5CB19E4883EDB7A4F78DB94F54D128EE8903755EF38D648C700

Function 00000001800080F2 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
memorynativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000817B
WriteProcessMemory.KERNELBASE ref: 000000018000820C
memset.NTDLL ref: 0000000180008354
memcpy.NTDLL ref: 0000000180008375
NtAlpcConnectPort.NTDLL ref: 00000001800083E7

Strings

Dive right in and make a splash,We're throwing a pool party in a flash!Bring your swimsuits and sunscreen galore,We'll turn up the heat and let the good times pour!, xrefs: 0000000180008315
0, xrefs: 000000018000828B

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: AllocAlpcConnectMemoryPortProcessVirtualWritememcpymemset
String ID: 0$Dive right in and make a splash,We're throwing a pool party in a flash!Bring your swimsuits and sunscreen galore,We'll turn up the heat and let the good times pour!
API String ID: 2322259470-3460289035
Opcode ID: c43cf6f9343ddec1ca79c7315b89c45580cd43461ba35576a3c26a51ac169fb6
Instruction ID: a438414d86da3f9fa76c6e2917a93b97ec5bb287934b9f4f7f73d30ebcaf7dce
Opcode Fuzzy Hash: c43cf6f9343ddec1ca79c7315b89c45580cd43461ba35576a3c26a51ac169fb6
Instruction Fuzzy Hash: 6D713DB5324EC891EBA5CF65E8587DA6362F788798F80A216DE4D07668DF3CC249C700

Function 0000000180009BC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 0000000180009CB9

Strings

@, xrefs: 0000000180009CA1

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 08567cc30074b475b331b46d2cc87d554941ba0be2af3992f720d6e759045faf
Instruction ID: 13e2f726a9112c9c31c995d983c9da114070f7450b087ebba6d3042457f4b947
Opcode Fuzzy Hash: 08567cc30074b475b331b46d2cc87d554941ba0be2af3992f720d6e759045faf
Instruction Fuzzy Hash: 8F41CF32318B9881EB65CF62F854BD67764F788784F519116EE8D43B14DF38C61AC700

Function 0000000180005824 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

realloc.MSVCRT ref: 000000018000587E
NtQuerySystemInformation.NTDLL ref: 00000001800058CD

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: InformationQuerySystemrealloc
String ID:
API String ID: 4089764311-0
Opcode ID: aa0bfc6469bc17d5eeda48fd87731ce22d6874c3ca3fc959c4416cf641374c4d
Instruction ID: b0525076bbbf58c043072cd616ac76dc382e5d39b6996fcf6a95a9be821e6ce1
Opcode Fuzzy Hash: aa0bfc6469bc17d5eeda48fd87731ce22d6874c3ca3fc959c4416cf641374c4d
Instruction Fuzzy Hash: 27015EB632498485FB55CBA6E86839BB362E38CBD4F44E0269E0D47758CE28C1098700

Function 00000001800054D5 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE ref: 000000018000559C

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: de33ea6b4f9ce6d4b4402c8e18623ba837b56d9b22b6662e0c33dbf5e61d8208
Instruction ID: 9c50cbf5d08d3b6d4a605893f6b359a3682b26f1feaf6ace4ca51b493498b96a
Opcode Fuzzy Hash: de33ea6b4f9ce6d4b4402c8e18623ba837b56d9b22b6662e0c33dbf5e61d8208
Instruction Fuzzy Hash: 9211BFB1614B8885FB61CFA5E8187C773A0E38D794F45A116DE4E17B64CF38C209C704

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 000000018000194B
GetModuleFileNameW.KERNEL32 ref: 000000018000195D
wcsstr.NTDLL ref: 000000018000196F
IsUserAnAdmin.SHELL32 ref: 000000018000197A
ExitProcess.KERNEL32 ref: 00000001800019A1

Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800015E5
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 0000000180001609
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 0000000180001613
Part of subcall function 00000001800015B0: memset.NTDLL ref: 0000000180001648
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016A8
Part of subcall function 00000001800015B0: GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800016CD
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016E7
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 00000001800016F5
Part of subcall function 00000001800015B0: OpenSCManagerW.ADVAPI32 ref: 0000000180001789

ExitProcess.KERNEL32 ref: 000000018000198E

Strings

svchost.exe, xrefs: 0000000180001963

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: memset$malloc$ExitFileModuleNameProcessmemcpy$AdminManagerOpenUserwcsstr
String ID: svchost.exe
API String ID: 2075570005-3106260013
Opcode ID: 79fe10d2032a91db138303a6d4bba14be8b863467a7872a6f2e5965e82f79385
Instruction ID: bee279387a080e4ef1cf93fe2260fe9373c10eb3ce040ed65f2ee5617e8a23f3
Opcode Fuzzy Hash: 79fe10d2032a91db138303a6d4bba14be8b863467a7872a6f2e5965e82f79385
Instruction Fuzzy Hash: 87019631310A4C81FBAADB21E4A93DA6360BB8C795F449025A95E46695DF3CC34CC740

Function 000000018000AD3E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000ADC2

Strings

@, xrefs: 000000018000ADAC

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 25e8e2e1e41b46ff06f862ad0091e17087f53469a818b64f494525446fc89b42
Instruction ID: 6b845daad974ccd9c6abd76d61111d535f536517db2d34ef27256cbb8d76cfd7
Opcode Fuzzy Hash: 25e8e2e1e41b46ff06f862ad0091e17087f53469a818b64f494525446fc89b42
Instruction Fuzzy Hash: 7B016DB5729A8C41FBA9CBA1F465BD62360A78DBD4F40A21A9D0E17B55DE2CC2068304

Function 000000018000A9BE Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000AA41

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e550c5f1444e37c0b1477e103827308c662109d29a65ec8f8fad6b41b1961b1e
Instruction ID: 251b8e02f3a2b925dc00676b0f08ae0c6924386de3889a0ff5d432a66f8cfcc3
Opcode Fuzzy Hash: e550c5f1444e37c0b1477e103827308c662109d29a65ec8f8fad6b41b1961b1e
Instruction Fuzzy Hash: 75012CB5619E8C41FBA9CBA1F464BDA6774E78DB94F40A11ADE0E17B51DF28C20AC304

Function 0000000180008E30 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAdjustPrivilege.NTDLL ref: 0000000180008E96

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: AdjustPrivilege
String ID:
API String ID: 3260937286-0
Opcode ID: 0831086ae50f2ba65709bcbf1c33f12cfd0f3053b93a604bdcfa268e10cb0fbc
Instruction ID: 04bb496a426d1b43e6b52f20395e61ae4e41d159ec3593a713d9b4970c529e46
Opcode Fuzzy Hash: 0831086ae50f2ba65709bcbf1c33f12cfd0f3053b93a604bdcfa268e10cb0fbc
Instruction Fuzzy Hash: A5F04F3A334F8C81EBE9DB21E85979667A0B74CB98F41A406ED4D43764CE3DC2158B00

Function 0000000180005A0D Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessId.KERNELBASE ref: 0000000180005A81

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: Process
String ID:
API String ID: 1235230986-0
Opcode ID: d16e56ca8ceffb6996a770eebb8859cff0112ba79151dc499dea6e218c25d2af
Instruction ID: d652ffa87c38ed1c04ac93e0a0d2335ef1528c7a1f19fbd04ef7ff50280f2555
Opcode Fuzzy Hash: d16e56ca8ceffb6996a770eebb8859cff0112ba79151dc499dea6e218c25d2af
Instruction Fuzzy Hash: 0C018BB271490485EB54CB59E4503AB7371F78DBD8F50A122EF4E87764DF29C256C704

Function 000000018000AF22 Relevance: 1.5, APIs: 1, Instructions: 31
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000AF9F

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4492a0bf8fcf8f33afd06441f64975728a7ffe302e5029ee3f64efdc84710f0c
Instruction ID: 56856a108c934b35fd8b12db096080665d1aff2e22ecb35535ebb708edeb7d18
Opcode Fuzzy Hash: 4492a0bf8fcf8f33afd06441f64975728a7ffe302e5029ee3f64efdc84710f0c
Instruction Fuzzy Hash: 9101E8B5319E8891FBA9CB52E898386A362A78DBD0F51D1169D0D47768CE2DC109C304

Function 000000018000A8B2 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000A932

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a9c6a2df7492c35cbc3cd719515342c8cda296547e204cd9f67484ff88ad8695
Instruction ID: 440d9c2e63d84a318507e4d3145013176a8cc7cafd38941c5fd7eab054e276a3
Opcode Fuzzy Hash: a9c6a2df7492c35cbc3cd719515342c8cda296547e204cd9f67484ff88ad8695
Instruction Fuzzy Hash: 4A013CF5319E8881FBA5CB56E898786A762E78EBD4F41D1168D4D0B768CF3DC109C304

Function 000000018000B100 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000B17E

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 35ffae5299d4c335a8ff36bc6453c7f7216bb7ebbfbf3e1d59d74c353a4e1218
Instruction ID: 24c97e1a4b5bf787aa031fe235fe3c6da918f95ea593df74073bd4adbefb4954
Opcode Fuzzy Hash: 35ffae5299d4c335a8ff36bc6453c7f7216bb7ebbfbf3e1d59d74c353a4e1218
Instruction Fuzzy Hash: 73F03CF5329E9981FBA5CB12EC58786A322F789BD4F41E1168D0D4B768CE2DC2098384

Non-executed Functions

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000000018000103C
malloc.MSVCRT ref: 00000001800010C9
memcpy.NTDLL ref: 00000001800010EB
memcpy.NTDLL ref: 0000000180001100
memset.NTDLL ref: 00000001800011B4
wsprintfW.USER32 ref: 00000001800011D5
CreateFileW.KERNEL32 ref: 0000000180001203
GetLastError.KERNEL32 ref: 0000000180001212
WriteFile.KERNEL32 ref: 0000000180001233
GetLastError.KERNEL32 ref: 000000018000123D
CloseHandle.KERNEL32 ref: 0000000180001246
Sleep.KERNEL32 ref: 0000000180001251
memset.NTDLL ref: 0000000180001266
wsprintfW.USER32 ref: 0000000180001287
CreateFileW.KERNEL32 ref: 00000001800012B5
GetLastError.KERNEL32 ref: 00000001800012C4
WriteFile.KERNEL32 ref: 00000001800012E5
GetLastError.KERNEL32 ref: 00000001800012EF
CloseHandle.KERNEL32 ref: 00000001800012F8
Sleep.KERNEL32 ref: 0000000180001303
memset.NTDLL ref: 0000000180001318
wsprintfW.USER32 ref: 0000000180001339
CreateFileW.KERNEL32 ref: 0000000180001367
GetLastError.KERNEL32 ref: 0000000180001376
WriteFile.KERNEL32 ref: 0000000180001393
GetLastError.KERNEL32 ref: 000000018000139D
CloseHandle.KERNEL32 ref: 00000001800013A6
Sleep.KERNEL32 ref: 00000001800013B1
VirtualAlloc.KERNEL32 ref: 00000001800013D4
memcpy.NTDLL ref: 00000001800013F0
CreateThread.KERNEL32 ref: 000000018000140C
VariantInit.OLEAUT32 ref: 0000000180001441
SysAllocString.OLEAUT32 ref: 00000001800014A3
GetLastError.KERNEL32 ref: 00000001800014BE
memset.NTDLL ref: 00000001800014D6
wsprintfW.USER32 ref: 00000001800014F4
memset.NTDLL ref: 000000018000152F
memcpy.NTDLL ref: 0000000180001544
CreateThread.KERNEL32 ref: 0000000180001562

Strings

\Microsoft\Windows, xrefs: 000000018000149C
%s\%s, xrefs: 00000001800011C7, 0000000180001279, 000000018000132B, 00000001800014E9

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: ErrorLast$File$Creatememset$memcpywsprintf$CloseHandleSleepWrite$AllocThreadmalloc$InitStringVariantVirtual
String ID: %s\%s$\Microsoft\Windows
API String ID: 1085075972-4137575348
Opcode ID: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction ID: ca852493329d7e8b29278f03f5207e3e8a0b6c409a20f5d7edd43a4be3d27a44
Opcode Fuzzy Hash: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction Fuzzy Hash: 4DF18A32610F8985F7A6CF24E8087DD33A0F78DBA8F449215EE9A17694EF38C249C700

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000180001A3B
CLSIDFromString.OLE32 ref: 0000000180001CFA
IIDFromString.OLE32 ref: 0000000180001D0D
CoCreateInstance.OLE32 ref: 0000000180001D2C

Strings

A::, xrefs: 0000000180001A4F
^:G:, xrefs: 0000000180001B44
:, xrefs: 0000000180001CA0
Y::, xrefs: 0000000180001C46
Y:\:, xrefs: 0000000180001AD8
:Y:, xrefs: 0000000180001C3F
\:^:, xrefs: 0000000180001C4D
\:[:, xrefs: 0000000180001B9B
X:[:, xrefs: 0000000180001BAA
X:^:, xrefs: 0000000180001AE8
:_:, xrefs: 0000000180001AF0

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: FromString$CreateInitializeInstance
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 511945936-2205580742
Opcode ID: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction ID: 28b9f900473ef5d70d4cda544e42fab565c9dc4f26e78512e927f69b0d8a042f
Opcode Fuzzy Hash: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction Fuzzy Hash: 0291FD73D18BD4CAE311CF7994016EDBB70F799348F14A249EB946A919EB78E684CF00

Function 0000000180001D60 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000180001DA5
SysAllocString.OLEAUT32 ref: 0000000180001DE4
SysAllocString.OLEAUT32 ref: 0000000180001DF0
IIDFromString.OLE32 ref: 0000000180001F31
SysAllocString.OLEAUT32 ref: 0000000180001F61
SysAllocString.OLEAUT32 ref: 0000000180001F71
VariantInit.OLEAUT32 ref: 0000000180001FEA
SysAllocString.OLEAUT32 ref: 0000000180001FF7

Strings

{4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}, xrefs: 0000000180001F26
SYSTEM, xrefs: 0000000180001DD9

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: String$Alloc$FromInitVariant
String ID: SYSTEM${4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}
API String ID: 929278495-107290059
Opcode ID: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction ID: 371f9a688604c33e3b5ae190077701ce0554801126743d20ac49bde758192535
Opcode Fuzzy Hash: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction Fuzzy Hash: E5B1C236B00B558AEB40DF6AD88829D77B1FB88FA9F559016DE0E57B28DF35C189C300

Function 0000000180028464 Relevance: 14.7, APIs: 9, Instructions: 1208COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00000001800284AD
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028AB8
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028C7B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028E82
_invalid_parameter_noinfo.LIBCMT ref: 0000000180029146
_invalid_parameter_noinfo.LIBCMT ref: 0000000180029341
memcpy_s.LIBCPMT ref: 000000018002942F
memcpy_s.LIBCPMT ref: 00000001800294DA
memcpy_s.LIBCPMT ref: 00000001800295A3

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID:
API String ID: 808467561-0
Opcode ID: e6e2a47d0b7aca8797bf2f78af511f090b7de726a253ea606c4e540f123b5b7a
Instruction ID: 4599084cfb13f8c747939fbc3aba35a6bd4e8a08bbcc0f0b71949d4f47730483
Opcode Fuzzy Hash: e6e2a47d0b7aca8797bf2f78af511f090b7de726a253ea606c4e540f123b5b7a
Instruction Fuzzy Hash: 5FB2E0766022998BE7A7CE69D544BED37A5F78C3C8F509125EA0657B88DF34CB48CB00

Function 0000000180007550 Relevance: 9.2, Strings: 7, Instructions: 485COMMON

Download Yara Rule

Strings

TpAllocAlpcCompletion, xrefs: 0000000180007A0A
ntdll.dll, xrefs: 000000018000780A
NtAlpcConnectPort, xrefs: 0000000180007C5F
\RPC Control\, xrefs: 0000000180007729
NtAlpcSetInformation, xrefs: 0000000180007B33
?Vse4", xrefs: 000000018000759B
NtAlpcCreatePort, xrefs: 00000001800078E1

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: ?Vse4"$NtAlpcConnectPort$NtAlpcCreatePort$NtAlpcSetInformation$TpAllocAlpcCompletion$\RPC Control\$ntdll.dll
API String ID: 0-3440571002
Opcode ID: 3e7f587f86fd0b2bf1a8a0d1d2c8b2dcce1149cee181315916f08b714af195f2
Instruction ID: 8c3100648684ed6cf3a6acba9f1e9974d33f54458c7afc613a7cd7d66638faa8
Opcode Fuzzy Hash: 3e7f587f86fd0b2bf1a8a0d1d2c8b2dcce1149cee181315916f08b714af195f2
Instruction Fuzzy Hash: 53124DF5720E9891EF94CBB9E8687C66362F78D798F81A117DE0D57624DE38C20AC700

Function 0000000180016D88 Relevance: 7.0, Strings: 5, Instructions: 783COMMON

Download Yara Rule

Strings

__swift_2, xrefs: 0000000180017D34
__unaligned, xrefs: 0000000180017A1E
__swift_1, xrefs: 0000000180017D10
call, xrefs: 0000000180016FE8
__restrict, xrefs: 0000000180017B37

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: ExceptionThrow
String ID: __restrict$__swift_1$__swift_2$__unaligned$call
API String ID: 432778473-3141380587
Opcode ID: 6a396b12831feff5c6f80a323355d14ea9fae3a8da964f50d645d654625ebbdc
Instruction ID: 673e966dcc0d85f334313fac89718d38bf41ed5ef13417959e8c730922fdb805
Opcode Fuzzy Hash: 6a396b12831feff5c6f80a323355d14ea9fae3a8da964f50d645d654625ebbdc
Instruction Fuzzy Hash: 5C627E72701E8882EB86EB25D4583DD27A1FB8EBD4F408125FA5E577A6DF38C649C700

Function 0000000180023B98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180023BFC

Strings

gfffffff, xrefs: 0000000180023E99

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: 7c5b9028af6473dd728daef05391e74bafcea77e80a4e195b251d3550d854208
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: 869145767057CC86EF97CB2AE4013EDABA5A758BC4F06C022EA5947395DE3DC60AC701

Function 0000000180003DBC Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

C:\windows\, xrefs: 00000001800040A8
C:\windows\system32\, xrefs: 0000000180003F43
WinSta0\Default, xrefs: 000000018000409C
taskmgr.exe, xrefs: 0000000180003F94

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: C:\windows\$C:\windows\system32\$WinSta0\Default$taskmgr.exe
API String ID: 0-638001070
Opcode ID: 3c7d1f0fb87f662b2079bad57b09a5afaa48cb8c83d5525282594a227a335d39
Instruction ID: 1bf4e9e1e70513e3816d114cab4aa84c7a719184b3830627372934e1f9606700
Opcode Fuzzy Hash: 3c7d1f0fb87f662b2079bad57b09a5afaa48cb8c83d5525282594a227a335d39
Instruction Fuzzy Hash: 0C8127F5324E9982EF95CBA8F8697D66322F7897D8F80A112CD1E57624DE38D209C704

Function 0000000180003AE0 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

winver.exe, xrefs: 0000000180003BE1
C:\windows\, xrefs: 0000000180003C45
C:\windows\system32\, xrefs: 0000000180003B90
WinSta0\Default, xrefs: 0000000180003C39

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: C:\windows\$C:\windows\system32\$WinSta0\Default$winver.exe
API String ID: 0-1160837885
Opcode ID: 1308d712bd6591429a8d37c48bbd1829232a434116c75b441977ccfa919fa798
Instruction ID: 55855d67a1f766f1614c6ad6b77d44964cb4204ffe99e224a87b86ff19b563fd
Opcode Fuzzy Hash: 1308d712bd6591429a8d37c48bbd1829232a434116c75b441977ccfa919fa798
Instruction Fuzzy Hash: C841A4B5324E9882FF55CB69F8687966322F789BD8F40A116CD5E4B764DE3CC20AC704

Function 0000000180028038 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018002809E
memcpy_s.LIBCPMT ref: 00000001800280C9

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction ID: 57088630f82899a46a4f04304140a90d468cb093ad556e4d18a7d8c59b71a2f9
Opcode Fuzzy Hash: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction Fuzzy Hash: 5EC1387671628987EB66CF19E044B9EB791F7987C4F44C125EB4A43B84DB38EA09DB00

Function 000000018001FED8 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

ko-KR, xrefs: 000000018001FEEC
0, xrefs: 00000001800200A7

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$ko-KR
API String ID: 3215553584-2196303776
Opcode ID: f96d09346a2f6e77d59369c2194a8b950e6b78dbaa0c336e0d12ce098f52cc8c
Instruction ID: 454ebc8193fa5ca865f8f1965dd2a4e4b4682b0a5584ee5ea9980d899769f2f6
Opcode Fuzzy Hash: f96d09346a2f6e77d59369c2194a8b950e6b78dbaa0c336e0d12ce098f52cc8c
Instruction Fuzzy Hash: 3A71D33521070D82FBFB9A1990807E963A1E74D7C4FA4D126BE49437ABCF35CA4B9705

Function 0000000180003220 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

p, xrefs: 00000001800032F3
0, xrefs: 0000000180003282

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: 0$p
API String ID: 0-2059906072
Opcode ID: e7e5a160b0dc7bf11acf6e058a7a07693b04e0544c402e7120b811fb21f28438
Instruction ID: 3ee67f828506e40d833cc10e170725f94807106ad1cab914bfb00022e22d59fe
Opcode Fuzzy Hash: e7e5a160b0dc7bf11acf6e058a7a07693b04e0544c402e7120b811fb21f28438
Instruction Fuzzy Hash: A731F075605E9D81EB55DF56E894BD62321F388BD8F42A212ED4E0BB24EE3CC15AC700

Function 0000000180024EB0 Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024EF9

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9a675805437782ecf3217d5187c311e375e8358acccf04f95891004c6cc889dd
Instruction ID: 1f61cd1c6d9a0cc47e5c3170d1c15f4e9de5b8ae94a737795fa3a990e1df4aaf
Opcode Fuzzy Hash: 9a675805437782ecf3217d5187c311e375e8358acccf04f95891004c6cc889dd
Instruction Fuzzy Hash: 0BA1E67231069881EBA3DB66A8047DAA3A0F78DBD4F549526FE9D07BC4DF78C64D8304

Function 000000018002C080 Relevance: 1.7, APIs: 1, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000018002C2CF

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 0e21b991dae342f80746e460734db2b0327f033799438967f91080e093b168d9
Instruction ID: 0593f73a9b31075b8e6bf2cb9e383320a294c5aeb291d1da762f6cdddc12ea76
Opcode Fuzzy Hash: 0e21b991dae342f80746e460734db2b0327f033799438967f91080e093b168d9
Instruction Fuzzy Hash: 10B12B73600B88CBEB56CF29C88679C77A0F349B88F19C916EB59877A8CB35C955C701

Function 0000000180010F18 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

l section in CAtlBaseModule, xrefs: 0000000180010FB7

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: ExceptionThrow
String ID: l section in CAtlBaseModule
API String ID: 432778473-2709337986
Opcode ID: a127ccbb264a5a4aec1e8b8c97d9fa5e153886bac66a3a6cc8a19aedac249b0e
Instruction ID: 3133a5dfd5f79aac6ce2c53f471fbcfe22b2aa6c2a7d5a5a984ae032cb248d46
Opcode Fuzzy Hash: a127ccbb264a5a4aec1e8b8c97d9fa5e153886bac66a3a6cc8a19aedac249b0e
Instruction Fuzzy Hash: 23027C36600E8886EB96DF25E8443DD73A1FB8DBD5F448526EA4E43BA4DF38C648C700

Function 00000001800180EE Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

__restrict, xrefs: 00000001800183C3

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: __restrict
API String ID: 0-803856930
Opcode ID: 5745e3cfed15ffb7b3e2fa7717aad80a57a6249b3a0910dbd319ea413861beba
Instruction ID: 2a1f3f8c5416bf1435224dd1e95b651f0a407b08188742a7ac323c2b5a68232f
Opcode Fuzzy Hash: 5745e3cfed15ffb7b3e2fa7717aad80a57a6249b3a0910dbd319ea413861beba
Instruction Fuzzy Hash: DAF15936601F4886EB928F65D8543DC73A5EB8DBC8F548526FE0E47BA4DE78CB498340

Function 000000018001FC0C Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 000000018001FDDB

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 5f4ddedfd77a8f2be46d5b27c9f7dfb0d5136d7c17e53cee70af679ad4ba4177
Instruction ID: 71f2418fc044250fc616a08c0bb954c8cfb89a1255eab9d4a98bc77a135e3a3b
Opcode Fuzzy Hash: 5f4ddedfd77a8f2be46d5b27c9f7dfb0d5136d7c17e53cee70af679ad4ba4177
Instruction Fuzzy Hash: 5871E235210A0D82FBFB9A29A0407F92392E7487C4F94D016BE46577EACF35CA4B9745

Function 0000000180002C8A Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

201ef99a-7fa0-444c-9399-19ba84f12a1a, xrefs: 0000000180002DAE

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: 201ef99a-7fa0-444c-9399-19ba84f12a1a
API String ID: 0-3963691810
Opcode ID: 305143c906e545cbbdba88b15ed8d96aa5c5b1023b370279aab489ed2de4cf70
Instruction ID: f859e3b1c76c282179c02603d62779a177e542a7d14e57d8a75f66858979eba8
Opcode Fuzzy Hash: 305143c906e545cbbdba88b15ed8d96aa5c5b1023b370279aab489ed2de4cf70
Instruction Fuzzy Hash: A54153B1715B9D46EF89CB78D9653A62322FB8C7ACF40A516C90E47765DE38C209C300

Function 0000000180002526 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

ncalrpc, xrefs: 00000001800025DE

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: ncalrpc
API String ID: 0-2983622238
Opcode ID: 8e139b6873f62461d47cfb06735ed223aa3699eae5bf13dfab6a051279dd2f2d
Instruction ID: 72ca54434e2e545ad87ad6f85711ca4f80c48705b1af1cf0b8a8e1738ac29a0d
Opcode Fuzzy Hash: 8e139b6873f62461d47cfb06735ed223aa3699eae5bf13dfab6a051279dd2f2d
Instruction Fuzzy Hash: 99312FB1721A6952EF49CF78E8687966762F79C794F91E522CE0E4B624DE3CC209C700

Function 0000000180014848 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e631ec45a2daf68f48d52614a6345ed429c570a616f22469c908a5fe8b28b5b
Instruction ID: 6d80879f2b6ca484a565809d41c0eb2dabc8ae21e66747f9efe079bfb1bd8c10
Opcode Fuzzy Hash: 3e631ec45a2daf68f48d52614a6345ed429c570a616f22469c908a5fe8b28b5b
Instruction Fuzzy Hash: DA22D177310AA882EB46DB65C0547AC33B6FB48B84F028116FB599B7B1DF38D668C354

Function 000000018000DEE8 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1622125fadd830d72695094e7b85cc31ec002336933b0e724cad098e10e2d7b0
Instruction ID: 946e0dd2bba7b3100fd246393857d7d015b19ff97fe3a12f1d34a5a40530aed8
Opcode Fuzzy Hash: 1622125fadd830d72695094e7b85cc31ec002336933b0e724cad098e10e2d7b0
Instruction Fuzzy Hash: E4E181722046C986EBB2CB15E8943E977A1F78E7D4F84C121EA8A936D5DF78C64DC700

Function 0000000180029E8C Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe71d8e7cd50308ca462f153a194306955503b02d46b76410196ab8a6e65239
Instruction ID: c02e86e1f92cc5576d6cd232989999bceb531278b49536794b781076c4770d9c
Opcode Fuzzy Hash: cfe71d8e7cd50308ca462f153a194306955503b02d46b76410196ab8a6e65239
Instruction Fuzzy Hash: BFE1D032708A848AE793CF68E5803DD77B1F74A7D8F548116EA4E57B99DE38C25AC700

Function 00000001800151E8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ae51d95b1815005dd45d5e3ab8a349bfdaaf9539e2a3891bf7a9a4281af68b
Instruction ID: 207e761d23252ea67ff1337872d1fa257f2b4668b6d9f4a23401ae9418e5b291
Opcode Fuzzy Hash: 16ae51d95b1815005dd45d5e3ab8a349bfdaaf9539e2a3891bf7a9a4281af68b
Instruction Fuzzy Hash: AFB1AB72A10B8886E352CF39D8457DC37A4F389B88F519216EE4D17B66DF35D689CB00

Function 00000001800069E0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86f20f7f5deea267c01afef8e7a4c05c31875faa151d310fea3b18ea46ae3c1
Instruction ID: 30b487c4dbfd5edb157edb9dd0446cf9089909246d75a709a71c41256c183c41
Opcode Fuzzy Hash: a86f20f7f5deea267c01afef8e7a4c05c31875faa151d310fea3b18ea46ae3c1
Instruction Fuzzy Hash: 4F410672B10A5886EB14CF64F815B9AB3A8F788794F505025DF8E47B68EF3CC156C700

Function 000000018000469C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfda2f7c180109932206dffacf20a53aef2a56dc1179a3e9a6f89e125c1a26ad
Instruction ID: 6a73b4ca67aa358b5cca9cf8f50e7addbf38a80432c4fb2377473208703d20e7
Opcode Fuzzy Hash: bfda2f7c180109932206dffacf20a53aef2a56dc1179a3e9a6f89e125c1a26ad
Instruction Fuzzy Hash: 645126E9654B9982EF94DBA9F8693D62322FB497D8F80F112CE1E57724DD38D209C304

Function 00000001800096E0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073128fd360148c17e41ec35af6a18c2df5ced6b4e463a8a16fec66cb74d860e
Instruction ID: b6fa69fb7e3d6089a58b1dc0a55349c666dd73e1d328c0310e1d9ae523244059
Opcode Fuzzy Hash: 073128fd360148c17e41ec35af6a18c2df5ced6b4e463a8a16fec66cb74d860e
Instruction Fuzzy Hash: A351CF32715F8896EB64CB65F94478A73A5F7887C4F54412AEA8E83B28EF3CD119C700

Function 0000000180008EC0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1111058f7c16aa1c110f3b5979ca66c856bb8bda45b3eaebbbd55d773fd606
Instruction ID: 9937fe3f73516922539d469a7d9b5dbd200fa43091dfd9594953e81ca0841af9
Opcode Fuzzy Hash: de1111058f7c16aa1c110f3b5979ca66c856bb8bda45b3eaebbbd55d773fd606
Instruction Fuzzy Hash: 7F51C2B5760E9982EB64CF65E8687D66321FB89BD4F44E126DE0E57B24DE3CC11AC300

Function 0000000180021F44 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53c239ed1f9684605d2ef346be0b8bf89de5d156fdc40e0d799da5887b65061
Instruction ID: 211af31c44281ca6c3f3932d9a28d26ed70725301ca9e5a4bb4aa04c7d8998f6
Opcode Fuzzy Hash: a53c239ed1f9684605d2ef346be0b8bf89de5d156fdc40e0d799da5887b65061
Instruction Fuzzy Hash: 25419232310A5886EB85CF6AE954399A391E34CFD4F49D427EE4D97B58DE3CC649C300

Function 000000018000B1AC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68527aba035480757e2393879a0d4de352a47f6bf703ed5fa56455fc597868c2
Instruction ID: 9b73b6c5183f860324fa61cee2baeb0ca0f8f8b507aed4a99a4e0eda6c344d24
Opcode Fuzzy Hash: 68527aba035480757e2393879a0d4de352a47f6bf703ed5fa56455fc597868c2
Instruction Fuzzy Hash: 984103B3714E4995EB25CF61E86478AB3A5F3887D8F44E126EE4D07A58DF38C246C300

Function 000000018001AA6C Relevance: .1, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaae997217fc1b3336f25de6e62d34e0746f7d3c2a6a256d0b5f71472e0a0425
Instruction ID: 048e6db2ecfd184872977d7eb727c5e493510e05d032e6f18c4ab6865a9947bf
Opcode Fuzzy Hash: eaae997217fc1b3336f25de6e62d34e0746f7d3c2a6a256d0b5f71472e0a0425
Instruction Fuzzy Hash: B341B37261C6888AF7EB8F15B4847967B91E34E3D0F11C429F94A87691DF79C6888F00

Function 0000000180006AB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59276b993bbd5f607d6d3a9a9acf607f8ad274a0d99c33aa421d3a75b3b8979b
Instruction ID: ea9816badbe891c07a2aded6d1ec92d5857af46983f2473552b7590bc608b90a
Opcode Fuzzy Hash: 59276b993bbd5f607d6d3a9a9acf607f8ad274a0d99c33aa421d3a75b3b8979b
Instruction Fuzzy Hash: 24419D76B20A8886EB14CB65F45479AB365F38CBC4F40912ADE4E53B68DE3CC216C740

Function 000000018000C2D0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a4f3e3c3f40ea96cedb268f2507c4aa92d7cf089ba266e7691892548829ecb
Instruction ID: ff810da637aa1fd401c95da2c6d69315e604f84d2d111450c1a2a7c20e68e2a5
Opcode Fuzzy Hash: f3a4f3e3c3f40ea96cedb268f2507c4aa92d7cf089ba266e7691892548829ecb
Instruction Fuzzy Hash: B941FFB2318F89D6DB54CFA5E4A579A7B61F388788F84901ADE4E47A14DF38C12AC340

Function 000000018000C6F0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7caa211d1805da3631b5417297298fbd746491c9ff13b9b06d3acbe089dc0ae
Instruction ID: 1f6bebfb10a220892d2831274fb9d9e41c253fa787b11ea253d3ff134c5c468f
Opcode Fuzzy Hash: a7caa211d1805da3631b5417297298fbd746491c9ff13b9b06d3acbe089dc0ae
Instruction Fuzzy Hash: FF419FB2214F88D2EB54CF55E88478AB7A6F3447C4F94D126EE8D5BA18CF78C15AC740

Function 000000018000BEB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc054b22e393740934c6599b1190f187be60ae239c821f3ddf288e380813183
Instruction ID: d558cfae5a731fffe16df58c07b62597b32ae423ecf54f032ed4b289fbb168ab
Opcode Fuzzy Hash: 9dc054b22e393740934c6599b1190f187be60ae239c821f3ddf288e380813183
Instruction Fuzzy Hash: 4041D3B2324E4DD2DF48CB15E454B9A7365F748BC8F658216DA4E87768EF39C21AC700

Function 000000018000B620 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711a5f6cc3d39d5f0aef55b7034a878137727931ce5006779a437fec81a29920
Instruction ID: c4b80034388e89da8ffe7b427c8155ba048d36e5b74cf413b7ce4096cc0294b9
Opcode Fuzzy Hash: 711a5f6cc3d39d5f0aef55b7034a878137727931ce5006779a437fec81a29920
Instruction Fuzzy Hash: AC4126B2728E48A2DB14CF25E69878E7762F3443C4F45A206EE4E57328DF39C225C700

Function 000000018000C370 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02ea177d7df7be9d47921f817159e6b389a93a74e3aee8d1a395a9d44e4e98a
Instruction ID: 30f2c0aa2bc627d33595a3753288768bcaf23473739ac437f1ff85fbf168e941
Opcode Fuzzy Hash: c02ea177d7df7be9d47921f817159e6b389a93a74e3aee8d1a395a9d44e4e98a
Instruction Fuzzy Hash: FA31CFB2764E8987EB94CFA4E4657EA3B21F384398F84911BDE4F47A14DE68C01AC341

Function 000000018000435B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43f2c2cbd10ab131c97a87bfb9a8d77e076664a556218998fa3f3ff93ba8f25
Instruction ID: 42c4d16a0e0d136c5a94160c46d85d5892129638e54f14ca30ac4ff8e229c4e5
Opcode Fuzzy Hash: c43f2c2cbd10ab131c97a87bfb9a8d77e076664a556218998fa3f3ff93ba8f25
Instruction Fuzzy Hash: 65310DF9654B9892EB55DBB8F8697C62322F74D7D8F81B502CE0E27624DE38D209C740

Function 000000018000947B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bce6376752d693395b932a5d9318ffbe6d4c9bed5557d96fc3b5228a6ed1993
Instruction ID: 91db3ca7ca736f51b2b9f4a1fdda40ff6b442f2c49d3b76bc6f7bd54feb42801
Opcode Fuzzy Hash: 2bce6376752d693395b932a5d9318ffbe6d4c9bed5557d96fc3b5228a6ed1993
Instruction Fuzzy Hash: 2531FBB5314E8481EF99CF66ECA93A66362FB88BE4F54E1168E0F57B64CE3DC1458304

Function 0000000180004153 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c12f5db1e7ae7d88fc0262756b9d0bf6622ca984ac394aaf837a3336d7d9a4
Instruction ID: b9540b73c02fa2fd8fd9ed4b04a7558bae6bb2522907684b3f8178f982c6447f
Opcode Fuzzy Hash: 11c12f5db1e7ae7d88fc0262756b9d0bf6622ca984ac394aaf837a3336d7d9a4
Instruction Fuzzy Hash: 3F215EF53159A882EB95CF65E8787972322FB49BD8F81E112CD1E57764DE38C209C304

Function 000000018000B280 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74b49f80d6d3cffa9bfb68b489edd80f871d1e69f348bd9d5bedd62bb40d514
Instruction ID: 34ebe62695f2a6a6ea2397927167a92a4784dc70ec7df40509b9419055f8788e
Opcode Fuzzy Hash: e74b49f80d6d3cffa9bfb68b489edd80f871d1e69f348bd9d5bedd62bb40d514
Instruction Fuzzy Hash: 7D31C1F6715A499AEB14CF60E46478AB3A5F3447C8F48E226EA4E47A1CDF78C219C304

Function 0000000180004CB0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ed0da8da41128ee95df92606b628508953cd21a2e597ae56ff743980468b27
Instruction ID: ea228047f8abccb8f34d8cb69d0855da280cee6fe6b78123f25de321abaee775
Opcode Fuzzy Hash: 29ed0da8da41128ee95df92606b628508953cd21a2e597ae56ff743980468b27
Instruction Fuzzy Hash: BD2101B2724E8885EB95CF62E828B9A7361F38CBD4F419126DE4E47B54CE3CC10AC700

Function 0000000180006F70 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659e1158283c071cac0272366369d00d1cfa562a966f2f5affa459bf10e8deba
Instruction ID: 6d7058e35041f85eefca8006119c3596d2fa62747ef7dd2be534be946fff4e46
Opcode Fuzzy Hash: 659e1158283c071cac0272366369d00d1cfa562a966f2f5affa459bf10e8deba
Instruction Fuzzy Hash: BB21D5B2764E5892DB59CFB6E864BC63761E759BD4F40A116EE0D57324EE38CA06C300

Function 000000018000B6C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879b8cc6a287b552be2b8c7838c9cf5361018535551b3c5eae2337da7c2a05c9
Instruction ID: 64e956f36281cdf23b4cab459502cafc9c3b83219f603c2a53f066b43bdf7739
Opcode Fuzzy Hash: 879b8cc6a287b552be2b8c7838c9cf5361018535551b3c5eae2337da7c2a05c9
Instruction Fuzzy Hash: 9931A2B2724A49A6DB15CF64D25878E7B62F3443D8F49A206DB0E57628EF39C16AC700

Function 0000000180003833 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7643b34bb1144c09516ca8224fed32c138a04b2f755b136cd71388444af2efbb
Instruction ID: 8007ea01a93bf6de8c95f9a16faa5e8d6c04bd6e38d315922757046993a1328b
Opcode Fuzzy Hash: 7643b34bb1144c09516ca8224fed32c138a04b2f755b136cd71388444af2efbb
Instruction Fuzzy Hash: 5F2148F5761EA982EB89CFB5E86979A2321E749BD8F41A112CD0E17724DE2CD6098300

Function 0000000180002666 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c104ebe3e0084b9c2d6c68d3b1b1809b1ba36be3a0ef8b7a361271054a232770
Instruction ID: baf3eb62263214422a0973d769ae56c08939dd68f110effc1bb9cb03c9f86de4
Opcode Fuzzy Hash: c104ebe3e0084b9c2d6c68d3b1b1809b1ba36be3a0ef8b7a361271054a232770
Instruction Fuzzy Hash: CE2159F5720AA892EB85CFB4E468BD627A1F74C3A4F81A413DE0D47620EE39C209C300

Function 00000001800044C1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d83384389e1bc3f5c40116a0a1417798e316c1697b6e029db620e488cbd2b1f
Instruction ID: 7d1135aa24797edbf35de8feb47ffd13e3235087d5b84f893e072cfd3e31e24b
Opcode Fuzzy Hash: 5d83384389e1bc3f5c40116a0a1417798e316c1697b6e029db620e488cbd2b1f
Instruction Fuzzy Hash: D1118EA271498C46FB96DBB4F969BD76322EB4C3A9F80A012DD0D07A55DD3CC24AC700

Function 0000000180002A19 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0213aaa7a16af12e76c05f13803a6cb1816da3aa76317169f32ff85a43e83aea
Instruction ID: 95480194bb9f6c9ad9d964584a4fad66eb43ce3f3ee230db89eb3e49904c33dd
Opcode Fuzzy Hash: 0213aaa7a16af12e76c05f13803a6cb1816da3aa76317169f32ff85a43e83aea
Instruction Fuzzy Hash: 56210BF2711A5D92EB49DF75D868BD667A2E78CBD4F41E512CD0E5B624DE3CC2098300

Function 0000000180003717 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f85260008f1cca6d719552e34a0840437b2decd6b2aec5b8999dc0ce01bbffe
Instruction ID: 02ba138fbc53fc0a7e206b6c0fccc1f4cb11f22df8a79a790e142c2087e4c986
Opcode Fuzzy Hash: 3f85260008f1cca6d719552e34a0840437b2decd6b2aec5b8999dc0ce01bbffe
Instruction Fuzzy Hash: 48213BB6761A5DC5EF49DF65E868B8A6721F788BD8F41A122CD0E47728DE3CD209C700

Function 000000018000290C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803c451430e3029bb009500dace81e7bc3217c3b4584f2ef31f91a53a698693d
Instruction ID: 4519c20df033b0754d584584f46a47e9c3f61284702b1b178af72c485ed47193
Opcode Fuzzy Hash: 803c451430e3029bb009500dace81e7bc3217c3b4584f2ef31f91a53a698693d
Instruction Fuzzy Hash: E02160F5714F8482EB45CBB5E8593CA63B1FB897A4F40A506DA4E57A24EE3CD20AC700

Function 0000000180002170 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566796d93a591df3f5db1c38c43d6e1f2c58bb1bf9c844d883f4a478785d6911
Instruction ID: bc53908923a101081ac78a2ff91d1596a8a62396a49556bd27b6b69a29ae519e
Opcode Fuzzy Hash: 566796d93a591df3f5db1c38c43d6e1f2c58bb1bf9c844d883f4a478785d6911
Instruction Fuzzy Hash: 6511E3E262096C82FB59DFA6A869F862332E349BD8F01E123DD5E5B714DD39C10BC300

Function 000000018000360B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a56065663d7f32470598edd8e4c56aa3322786b1e37be48fd2162c7dda414fd
Instruction ID: 8fbfe2caa4e00eb4ae2a73ae29cd16ebba4a4082f14f5113274d96e794981e6d
Opcode Fuzzy Hash: 3a56065663d7f32470598edd8e4c56aa3322786b1e37be48fd2162c7dda414fd
Instruction Fuzzy Hash: 0721A4B2709A9882EB55CF64E4687977761FB8C798F41A116DE4E47A14EF3DC109C700

Function 00000001800045A9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de039b8aeb4dd7a341e305cb49e7d4a566f2f03f9a363aa92138b342856feec
Instruction ID: 9e59c1c7de84271de07ddad5238888e61d5fae15b8e3d2a62c0818bf1ca1a5d9
Opcode Fuzzy Hash: 4de039b8aeb4dd7a341e305cb49e7d4a566f2f03f9a363aa92138b342856feec
Instruction Fuzzy Hash: 2F1151B5714E9882EB54CB74E46839A6361F7887B8F80A316C92E576E4DF39C10AC744

Function 0000000180002777 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00286fc56aac180519fed44c3472dbbed5625b745e2bf1041001a8241787df3
Instruction ID: 453c13d840d8ab8480c25eabad8a5a4e6cf22c2320a7064174f112572a8564ab
Opcode Fuzzy Hash: b00286fc56aac180519fed44c3472dbbed5625b745e2bf1041001a8241787df3
Instruction Fuzzy Hash: 8E113CE171196846FF89CF65D9697665393EB8C7E4F81E426CE0E8B768ED3CC1098304

Function 000000018000225E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6f47147aee9d0c5d2e3a57a73bf876d140cefaec2fbc1aba1964aca6a06b7c
Instruction ID: dcb26d1462b17352493136ca1a284502f5bdb4a1f8be4333a819d013a470b478
Opcode Fuzzy Hash: 3e6f47147aee9d0c5d2e3a57a73bf876d140cefaec2fbc1aba1964aca6a06b7c
Instruction Fuzzy Hash: 3311C2B6624A9E42E709DFF4B424FCA3771E389750F00B517DE4A53510DE38C21AC300

Function 000000018000284D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8879920a56ce6d951eaa2299e71384d51284fb55c40a98b48f618b07d76cb7
Instruction ID: 1bcc190078e11d5e3502c0fb8cfdf52a8957de65a2b1b8071e9e04ba3849ecfd
Opcode Fuzzy Hash: 0e8879920a56ce6d951eaa2299e71384d51284fb55c40a98b48f618b07d76cb7
Instruction Fuzzy Hash: 9D1100F5721E9841FB49CB75D4683D66362E788794F80A917CA0F57664DD39C2498340

Function 0000000180003CF2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fa84bd9608fd1e2ded7a46ac84a71bf4807f0703b11cbbff9e650931e748d0
Instruction ID: 81b86e7094c320bcc5e7f926c263843823ab5f04b050e6f3beb40bfc522f2c83
Opcode Fuzzy Hash: 62fa84bd9608fd1e2ded7a46ac84a71bf4807f0703b11cbbff9e650931e748d0
Instruction Fuzzy Hash: 4F114FB5614E9882EB54CB78F4687DA6321F78C798F80B113CD0E57625EE39C21AC340

Function 0000000180003530 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169374a88c9bc48999de202173db2c687a39263e6fb74efa0de97639e935559a
Instruction ID: 58ab01e0f729e006e025e3cd5db47f1a357a7dbbf023e6ea43b04656e7f2b6d0
Opcode Fuzzy Hash: 169374a88c9bc48999de202173db2c687a39263e6fb74efa0de97639e935559a
Instruction Fuzzy Hash: 6A113DB1715E6881EB59CF65E9587866362F74C798F82E122CC4E47728EE39C248C700

Function 0000000180002A06 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6214b3987fdb11ae9af8bb44ed0752c7393761a47505b246c2a752352195c6b7
Instruction ID: 246bc5305b8913a4d01db227893256f8bf5d597bde7be6eae501e461eb4fa0bc
Opcode Fuzzy Hash: 6214b3987fdb11ae9af8bb44ed0752c7393761a47505b246c2a752352195c6b7
Instruction Fuzzy Hash: A4113CB2711E5C91EB49CF25E868B9A67A1F78CB94F41E526DE0E47768DE3CC209C300

Function 0000000180003464 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a304966c8f6e6c63f3b4d1dc84eaa042215815f68f4f7ed99f7cad32e1286f1
Instruction ID: 91f1bf17694832eb7885352137df2ae2a0c82d5e88c9f87b3bad460dc89f63f9
Opcode Fuzzy Hash: 7a304966c8f6e6c63f3b4d1dc84eaa042215815f68f4f7ed99f7cad32e1286f1
Instruction Fuzzy Hash: 451169F531286D82EB89CF65E929B865322E7487D8F82F112CC0E4B718ED39D109C700

Function 0000000180005E58 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214099cfcd0ee3826ed9ef66e5b675abfeddc10177d1ca11de6341e968b0d06b
Instruction ID: 39990edd012c80a11a8c246ade81e0b00b1fb03419df7482220b1a2638345046
Opcode Fuzzy Hash: 214099cfcd0ee3826ed9ef66e5b675abfeddc10177d1ca11de6341e968b0d06b
Instruction Fuzzy Hash: 7E11A5F1330A8886FB95CBB5E8683DA6361E78D7D4F84B012CE0E47765CE28C20AC304

Function 0000000180003880 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcce50d7d365edf9bc1dcf0723df82f9ff79db8457ccb87dc38c7b0742b08610
Instruction ID: 15f0b12e67b83b815c9156cfa897ef3110cdd404d207d48cd89176b21f2d8fa0
Opcode Fuzzy Hash: dcce50d7d365edf9bc1dcf0723df82f9ff79db8457ccb87dc38c7b0742b08610
Instruction Fuzzy Hash: 06015EB5751E6D82EB89DF75E4697DA2320EB48B94F82B512CC0E57320ED3CDA0AC300

Function 0000000180002E24 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f73bb3cb6f5cf5abec075b9014cb563e06a4567c89c5d20f7171c5a4b410b69
Instruction ID: 22dcafcaff4b78d83aaf35a6f31f5da21172cbe544e4bfae6083fdcba81ddec3
Opcode Fuzzy Hash: 6f73bb3cb6f5cf5abec075b9014cb563e06a4567c89c5d20f7171c5a4b410b69
Instruction Fuzzy Hash: 080152F5611E9D82EB45CBB9E8A83D76325E78D7E8F40E1128E0E67625DE38C2098300

Function 00000001800033B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797ab2e302fecb4ee9151d5ec147357b9b6b8374a5a73c2aa17e4c7710b83c27
Instruction ID: c05fe9916e29f3615726ac8ab40efd06a7f832fe150a5180127c36e0d361f74a
Opcode Fuzzy Hash: 797ab2e302fecb4ee9151d5ec147357b9b6b8374a5a73c2aa17e4c7710b83c27
Instruction Fuzzy Hash: 130125F1652E5E82FB59CBA4E569BC66362EB487D8F40F1179D0D07618EE3CD219C304

Function 000000018002BBA8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction ID: c5723c18dcfd40d5e26eb64c6513ed8ad7c8279d3e69258c72aec0d621b19a73
Opcode Fuzzy Hash: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction Fuzzy Hash: 15F06871714A548AEBD5CF2CA44276A77D0F30C3C4FA0C519E68983B04D63D8165CF04

Function 000000018001A7E8 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000018001A7F7

Part of subcall function 0000000180019CF8: __vcrt_initialize.LIBVCRUNTIME ref: 0000000180019D1A

__scrt_release_startup_lock.LIBCMT ref: 000000018001A87A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A890
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A8BC
__scrt_get_show_window_mode.LIBCMT ref: 000000018001A8CD
__scrt_is_managed_app.LIBCMT ref: 000000018001A8F0
__scrt_uninitialize_crt.LIBCMT ref: 000000018001A907
__scrt_fastfail.LIBCMT ref: 000000018001A939
__scrt_fastfail.LIBCMT ref: 000000018001A944
__security_init_cookie.LIBCMT ref: 000000018001A960

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 20208a98ab850ec38ed8325cc0af7ea2ed5af357558f35f83d8d5c5aa49ef683
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: C631923160994C86FBE7BBA5D4523EA2391AB4E3C4F45C425B94A473D7DE28CB4E8350

Function 0000000180019F69 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000000018001A062
__scrt_fastfail.LIBCMT ref: 000000018001A0B1
__scrt_fastfail.LIBCMT ref: 000000018001A0BC
__scrt_fastfail.LIBCMT ref: 000000018001A0C7

Strings

`eh vector vbase constructor iterator', xrefs: 0000000180019F9C
`local vftable', xrefs: 0000000180019FE0
`udt returning', xrefs: 0000000180019FCC
onstructor closure', xrefs: 0000000180019FF4

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 430d6e6a62d8c94c9c04e7e52013dca82c213aedb955d9ad44379b1780147ad5
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: FF416D35206B4C82FBA79B20E9503EA2361AB4EBD0F54D525E90E477A4DF3CC68E8304

Function 000000018002B9A8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002B9D0
_set_statfp.LIBCMT ref: 000000018002B9EB
_set_statfp.LIBCMT ref: 000000018002BA07
_set_statfp.LIBCMT ref: 000000018002BA43

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 3b9bd57b40fff3d8961f464b14179896b260d9c17b5d0c480fa0c6cf32fa7499
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: CB117732690A4D01F7E72129D4553F93340AB6D3F4F45C634BA76976D6CE248BC94302

Function 000000018001F660 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001F698
_invalid_parameter_noinfo.LIBCMT ref: 000000018001F8D2

Strings

ko-KR, xrefs: 000000018001F6B7
*, xrefs: 000000018001F7A5

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: 247b425bc4075f99800c1718c7ffe54540729addd1f222e63731e205efc231c0
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: B0718F72504E58C6E7FA9F2980443BC3BA0F34DBD8F649216EA4646399DF31CA8AC750

Function 0000000180017B98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_2, xrefs: 0000000180017D34
__swift_1, xrefs: 0000000180017D10

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: e36f902788c0381efdc077c6dc949100de42eee437ea8b415927d241f746463c
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: CF618E32300A8882EF96DB29E5447E963A1FB4CBD4F488525EF6D4779ADF38D645C340

Function 0000000180023FE4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024027

Strings

o-l1-2-1, xrefs: 00000001800240CC
gfff, xrefs: 0000000180024149

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 4e08fe91d50fd43471445e9309ac5ad4362738dffbe45d8770cad9fb3b789804
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: 5951F4737147C886E7A78B35E9413997B91E399BD0F48D221EB944BAD6CE38C698C700

Function 0000000180024430 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018002459E

Strings

api-ms-win-core-sysinfo-l1-2-1, xrefs: 00000001800244D1
synch-l1-2-0, xrefs: 00000001800244A4

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: 9d4985de47fc3aa1ddc341b920f7898ed377652abc42465d74999370fa1411ca
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: 86418E72705F888AE782CF65E8507CE73A5F7193C8F518126EA9807B99DF38C629C340

Function 000000018001D646 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001C478: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000000018001C47C

__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D66E
__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D6F8

Strings

csm, xrefs: 000000018001D6CB

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 011c5e600e2baba1b5aebe761702f78806dc8dec4a9d5acc90072a234146c346
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: 40212D76204A4887E7B2DF15E05079E7760F39DBE4F008206EEA943795CF39DA8ACB01

Function 000000018001A972 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000018001A99B

Strings

`vector destructor iterator', xrefs: 000000018001A980
nt delete closure', xrefs: 000000018001A9A0

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: c8ada3eb98077b3e77d28a4839308a809c4d6d91d1a7368aad5ed78790c858ba
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 9EE01AB1200B0490DB068F65E8513E873A4EB4CB90F48C032AA5C47354EF38C6A9C301

Function 000000018001AA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000018001AA55
_CxxThrowException.LIBVCRUNTIME ref: 000000018001AA66

Strings

File, xrefs: 000000018001AA5A

Memory Dump Source

Source File: 00000000.00000002.1742238830.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1742106603.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742515479.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742552950.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1742586469.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_hvix64.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 9145d171dbcecb2188c45693134888adfda474ee1ae56853841174419c243042
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 49C08C3221488D91EB62EB10E8917DA5330B7A8384F818111F19C824B69F1CC30ECB00

Analysis Process: svchost.exePID: 1044, Parent PID: 7392COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.6%
Total number of Nodes:	107
Total number of Limit Nodes:	17

Executed Functions

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000000018000103C
malloc.MSVCRT ref: 00000001800010C9
memcpy.NTDLL ref: 00000001800010EB
memcpy.NTDLL ref: 0000000180001100
memset.NTDLL ref: 00000001800011B4
wsprintfW.USER32 ref: 00000001800011D5
CreateFileW.KERNEL32 ref: 0000000180001203
GetLastError.KERNEL32 ref: 0000000180001212
WriteFile.KERNEL32 ref: 0000000180001233
GetLastError.KERNEL32 ref: 000000018000123D
CloseHandle.KERNEL32 ref: 0000000180001246
SleepEx.KERNEL32 ref: 0000000180001251
memset.NTDLL ref: 0000000180001266
wsprintfW.USER32 ref: 0000000180001287
CreateFileW.KERNEL32 ref: 00000001800012B5
GetLastError.KERNEL32 ref: 00000001800012C4
WriteFile.KERNEL32 ref: 00000001800012E5
GetLastError.KERNEL32 ref: 00000001800012EF
CloseHandle.KERNEL32 ref: 00000001800012F8
SleepEx.KERNEL32 ref: 0000000180001303
memset.NTDLL ref: 0000000180001318
wsprintfW.USER32 ref: 0000000180001339
CreateFileW.KERNEL32 ref: 0000000180001367
GetLastError.KERNEL32 ref: 0000000180001376
WriteFile.KERNEL32 ref: 0000000180001393
GetLastError.KERNEL32 ref: 000000018000139D
CloseHandle.KERNEL32 ref: 00000001800013A6
SleepEx.KERNEL32 ref: 00000001800013B1
VirtualAlloc.KERNEL32 ref: 00000001800013D4
memcpy.NTDLL ref: 00000001800013F0
CreateThread.KERNEL32 ref: 000000018000140C
VariantInit.OLEAUT32 ref: 0000000180001441
SysAllocString.OLEAUT32 ref: 00000001800014A3
GetLastError.KERNEL32 ref: 00000001800014BE
memset.NTDLL ref: 00000001800014D6
wsprintfW.USER32 ref: 00000001800014F4
memset.NTDLL ref: 000000018000152F
memcpy.NTDLL ref: 0000000180001544
CreateThread.KERNEL32 ref: 0000000180001562

Strings

\Microsoft\Windows, xrefs: 000000018000149C
%s\%s, xrefs: 00000001800011C7, 0000000180001279, 000000018000132B, 00000001800014E9

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$File$Creatememset$memcpywsprintf$CloseHandleSleepWrite$AllocThreadmalloc$InitStringVariantVirtual
String ID: %s\%s$\Microsoft\Windows
API String ID: 1085075972-4137575348
Opcode ID: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction ID: ca852493329d7e8b29278f03f5207e3e8a0b6c409a20f5d7edd43a4be3d27a44
Opcode Fuzzy Hash: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction Fuzzy Hash: 4DF18A32610F8985F7A6CF24E8087DD33A0F78DBA8F449215EE9A17694EF38C249C700

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE ref: 0000000180001A3B
CLSIDFromString.OLE32 ref: 0000000180001CFA
IIDFromString.OLE32 ref: 0000000180001D0D
CoCreateInstance.COMBASE ref: 0000000180001D2C

Strings

X:[:, xrefs: 0000000180001BAA
\:^:, xrefs: 0000000180001C4D
:, xrefs: 0000000180001CA0
^:G:, xrefs: 0000000180001B44
Y:\:, xrefs: 0000000180001AD8
A::, xrefs: 0000000180001A4F
X:^:, xrefs: 0000000180001AE8
\:[:, xrefs: 0000000180001B9B
:_:, xrefs: 0000000180001AF0
:Y:, xrefs: 0000000180001C3F
Y::, xrefs: 0000000180001C46

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: FromString$CreateInitializeInstance
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 511945936-2205580742
Opcode ID: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction ID: 28b9f900473ef5d70d4cda544e42fab565c9dc4f26e78512e927f69b0d8a042f
Opcode Fuzzy Hash: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction Fuzzy Hash: 0291FD73D18BD4CAE311CF7994016EDBB70F799348F14A249EB946A919EB78E684CF00

Function 000001845B3A0508 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001845B3A0627
GetProcAddressForCaller.KERNELBASE ref: 000001845B3A06C1

Strings

ateH, xrefs: 000001845B3A05B5
l.dl, xrefs: 000001845B3A054B
lloc, xrefs: 000001845B3A05AE
eHea, xrefs: 000001845B3A056D
RtlR, xrefs: 000001845B3A0558
ocat, xrefs: 000001845B3A0566
RtlA, xrefs: 000001845B3A05A7
l.dl, xrefs: 000001845B3A059A
ntdl, xrefs: 000001845B3A0593
ntdl, xrefs: 000001845B3A0541
eAll, xrefs: 000001845B3A055F
eap, xrefs: 000001845B3A05BC

Memory Dump Source

Source File: 00000002.00000002.2979050070.000001845B3A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b3a0000_svchost.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID: RtlA$RtlR$ateH$eAll$eHea$eap$l.dl$l.dl$lloc$ntdl$ntdl$ocat
API String ID: 4215043672-3994871222
Opcode ID: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction ID: c381af4db78858afda48622ee0d699de6729f89d134ab15c92d4731855fb9dee
Opcode Fuzzy Hash: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction Fuzzy Hash: 4771D130604A0A8BEB58EF58C845BED77E1FF94710F20815AD80AE7296DF35E9428F85

Function 0000000180001D60 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000180001DA5
SysAllocString.OLEAUT32 ref: 0000000180001DE4
SysAllocString.OLEAUT32 ref: 0000000180001DF0
IIDFromString.OLE32 ref: 0000000180001F31
SysAllocString.OLEAUT32 ref: 0000000180001F61
SysAllocString.OLEAUT32 ref: 0000000180001F71
VariantInit.OLEAUT32 ref: 0000000180001FEA
SysAllocString.OLEAUT32 ref: 0000000180001FF7

Strings

SYSTEM, xrefs: 0000000180001DD9
{4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}, xrefs: 0000000180001F26

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: String$Alloc$FromInitVariant
String ID: SYSTEM${4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}
API String ID: 929278495-107290059
Opcode ID: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction ID: 371f9a688604c33e3b5ae190077701ce0554801126743d20ac49bde758192535
Opcode Fuzzy Hash: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction Fuzzy Hash: E5B1C236B00B558AEB40DF6AD88829D77B1FB88FA9F559016DE0E57B28DF35C189C300

Function 000001845B370508 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001845B370627

Strings

ntdl, xrefs: 000001845B370541
ateH, xrefs: 000001845B3705B5
RtlA, xrefs: 000001845B3705A7
l.dl, xrefs: 000001845B37054B
RtlR, xrefs: 000001845B370558
ocat, xrefs: 000001845B370566
l.dl, xrefs: 000001845B37059A
lloc, xrefs: 000001845B3705AE
eHea, xrefs: 000001845B37056D
eAll, xrefs: 000001845B37055F
eap, xrefs: 000001845B3705BC
ntdl, xrefs: 000001845B370593

Memory Dump Source

Source File: 00000002.00000002.2978971054.000001845B370000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b370000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID: RtlA$RtlR$ateH$eAll$eHea$eap$l.dl$l.dl$lloc$ntdl$ntdl$ocat
API String ID: 1029625771-3994871222
Opcode ID: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction ID: a74a42356ef8f54fa7955b3c366e675d3a8961867c6609bc0195d9789616b061
Opcode Fuzzy Hash: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction Fuzzy Hash: 8471A031614A0A8BEB58EF58C855BED77E1FF94310F21815AD80AE7286DF34DA42CF85

Function 00000001800019D0 Relevance: 4.5, APIs: 3, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00000001800019D9
SleepEx.KERNEL32 ref: 00000001800019E8
DeleteFileW.KERNEL32 ref: 00000001800019F1

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: DeleteFile$Sleep
String ID:
API String ID: 2100639427-0
Opcode ID: 819f48160997e5889829df66ddb1cfbaf94046e4fda21bae77f85b2f67c4eaa9
Instruction ID: ee9c1bd20bde787a3df6403edb75ddca03fdaf3f5216dae4a0b383b50a80e175
Opcode Fuzzy Hash: 819f48160997e5889829df66ddb1cfbaf94046e4fda21bae77f85b2f67c4eaa9
Instruction Fuzzy Hash: 5CD05E20301A0986FB9A5BB2E8583E613A85B0DBD2F0860249C1685280DF18C7CE8301

Function 000001845B3A0345 Relevance: 1.4, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000001845B3A0395

Memory Dump Source

Source File: 00000002.00000002.2979050070.000001845B3A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b3a0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: ef4bb6c71454d22b561e0105ee1553b42766148eaa3c283ca195eff69e386f39
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: 2131C3316586018BDB5CEA1CE8C26A973D0F795304B30529EE9C7D71C7EE39E9438B89

Function 000001845B370345 Relevance: 1.4, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000001845B370395

Memory Dump Source

Source File: 00000002.00000002.2978971054.000001845B370000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b370000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: fb5624946f701f58ffc31c8419db3424fa54852be020087c6986d22e8504e12a
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: 7131C3316586018BEB5CDA1CE8C26AD73D0F795304B20519EE9C7D7187EE39E9438B89

Non-executed Functions

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211
servicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00000001800015E5
memcpy.NTDLL ref: 0000000180001609
malloc.MSVCRT ref: 0000000180001613
memset.NTDLL ref: 0000000180001648
memset.NTDLL ref: 00000001800016A8
GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
malloc.MSVCRT ref: 00000001800016CD
memset.NTDLL ref: 00000001800016E7
memcpy.NTDLL ref: 00000001800016F5
OpenSCManagerW.ADVAPI32 ref: 0000000180001789
EnumServicesStatusExW.ADVAPI32 ref: 00000001800017D0
malloc.MSVCRT ref: 00000001800017E2
memset.NTDLL ref: 00000001800017FC
EnumServicesStatusExW.ADVAPI32 ref: 0000000180001838
CloseServiceHandle.ADVAPI32 ref: 0000000180001845
free.MSVCRT ref: 000000018000184E
CloseServiceHandle.ADVAPI32 ref: 0000000180001856
lstrcmpiW.KERNEL32 ref: 0000000180001881

Strings

Schedule, xrefs: 0000000180001872

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: mallocmemset$CloseEnumHandleServiceServicesStatusmemcpy$FileManagerModuleNameOpenfreelstrcmpi
String ID: Schedule
API String ID: 3636854120-2739827629
Opcode ID: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction ID: 6ee3f7f16e62e9fbbf62cb728b63543f6f6100922e48a7ada6915e3d38cfd098
Opcode Fuzzy Hash: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction Fuzzy Hash: 84A1AE36705B8886EBA5CB19E4883EDB7A4F78DB94F54D128EE8903755EF38D648C700

Function 000001845BF30E10 Relevance: 13.9, Strings: 11, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Y::, xrefs: 000001845BF31046
\:^:, xrefs: 000001845BF3104D
:, xrefs: 000001845BF310A0
A::, xrefs: 000001845BF30E4F
:Y:, xrefs: 000001845BF3103F
X:[:, xrefs: 000001845BF30FAA
X:^:, xrefs: 000001845BF30EE8
:_:, xrefs: 000001845BF30EF0
Y:\:, xrefs: 000001845BF30ED8
\:[:, xrefs: 000001845BF30F9B
^:G:, xrefs: 000001845BF30F44

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 0-2205580742
Opcode ID: d90148109c58263767cfb54190a6e54a75e0a48cc10efb8014eb7dc9dcd99103
Instruction ID: dcab3b9f2db7d9d944fb45beb8de10387a31829edead7d99da5042bcf1608516
Opcode Fuzzy Hash: d90148109c58263767cfb54190a6e54a75e0a48cc10efb8014eb7dc9dcd99103
Instruction Fuzzy Hash: 9791EE73D18BD58BE311CF7994016AEBB70F795348F14A349EA846691AEF78E680CF00

Function 0000000180023B98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180023BFC

Strings

gfffffff, xrefs: 0000000180023E99

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: 7c5b9028af6473dd728daef05391e74bafcea77e80a4e195b251d3550d854208
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: 869145767057CC86EF97CB2AE4013EDABA5A758BC4F06C022EA5947395DE3DC60AC701

Function 000001845BF52F98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF52FFC

Strings

gfffffff, xrefs: 000001845BF53299

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: bbbae7935abc3b7bee493bde96c9e43f93909778a7fcba09dae96741df72da8d
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: BC912373B057C987EB15CB2EA4103EDBBA5A755B84F05C022CA9A877D5EF39C606CB01

Function 000000018001A7E8 Relevance: 15.1, APIs: 10, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 000000018001A7F7

Part of subcall function 0000000180019CF8: __vcrt_initialize.LIBVCRUNTIME ref: 0000000180019D1A

__scrt_release_startup_lock.LIBCMT ref: 000000018001A87A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A890
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A8BC
__scrt_get_show_window_mode.LIBCMT ref: 000000018001A8CD
__scrt_is_managed_app.LIBCMT ref: 000000018001A8F0
__scrt_uninitialize_crt.LIBCMT ref: 000000018001A907
__scrt_fastfail.LIBCMT ref: 000000018001A939
__scrt_fastfail.LIBCMT ref: 000000018001A944
__security_init_cookie.LIBCMT ref: 000000018001A960

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 20208a98ab850ec38ed8325cc0af7ea2ed5af357558f35f83d8d5c5aa49ef683
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: C631923160994C86FBE7BBA5D4523EA2391AB4E3C4F45C425B94A473D7DE28CB4E8350

Function 000001845BF49BE8 Relevance: 15.1, APIs: 10, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 000001845BF49BF7

Part of subcall function 000001845BF490F8: __vcrt_initialize.LIBVCRUNTIME ref: 000001845BF4911A

__scrt_release_startup_lock.LIBCMT ref: 000001845BF49C7A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000001845BF49C90
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000001845BF49CBC
__scrt_get_show_window_mode.LIBCMT ref: 000001845BF49CCD
__scrt_is_managed_app.LIBCMT ref: 000001845BF49CF0
__scrt_uninitialize_crt.LIBCMT ref: 000001845BF49D07
__scrt_fastfail.LIBCMT ref: 000001845BF49D39
__scrt_fastfail.LIBCMT ref: 000001845BF49D44
__security_init_cookie.LIBCMT ref: 000001845BF49D60

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 649731ae198dc1f129116bc9484d2e52d335e8c361f54c9094adad0cce7e989a
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: 423141337012038BFB64EB68D4563ED2391AB55344F44C429AACACB6D7DF298745CF15

Function 0000000180019F69 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000000018001A062
__scrt_fastfail.LIBCMT ref: 000000018001A0B1
__scrt_fastfail.LIBCMT ref: 000000018001A0BC
__scrt_fastfail.LIBCMT ref: 000000018001A0C7

Strings

`eh vector vbase constructor iterator', xrefs: 0000000180019F9C
onstructor closure', xrefs: 0000000180019FF4
`udt returning', xrefs: 0000000180019FCC
`local vftable', xrefs: 0000000180019FE0

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 430d6e6a62d8c94c9c04e7e52013dca82c213aedb955d9ad44379b1780147ad5
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: FF416D35206B4C82FBA79B20E9503EA2361AB4EBD0F54D525E90E477A4DF3CC68E8304

Function 000001845BF49369 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000001845BF49462
__scrt_fastfail.LIBCMT ref: 000001845BF494B1
__scrt_fastfail.LIBCMT ref: 000001845BF494BC
__scrt_fastfail.LIBCMT ref: 000001845BF494C7

Strings

`eh vector vbase constructor iterator', xrefs: 000001845BF4939C
`local vftable', xrefs: 000001845BF493E0
onstructor closure', xrefs: 000001845BF493F4
`udt returning', xrefs: 000001845BF493CC

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 9136cc2e46e2b1c2881ad59cf5e40b820321d34a5dd54a28c1c77466e197d6bf
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: EE415B37302B0287FA14DB64E8117DD2361AB8AB90F44D925C98E877E4DF2DD645CB18

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 000000018000194B
GetModuleFileNameW.KERNEL32 ref: 000000018000195D
wcsstr.NTDLL ref: 000000018000196F
IsUserAnAdmin.SHELL32 ref: 000000018000197A
ExitProcess.KERNEL32 ref: 00000001800019A1

Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800015E5
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 0000000180001609
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 0000000180001613
Part of subcall function 00000001800015B0: memset.NTDLL ref: 0000000180001648
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016A8
Part of subcall function 00000001800015B0: GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800016CD
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016E7
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 00000001800016F5
Part of subcall function 00000001800015B0: OpenSCManagerW.ADVAPI32 ref: 0000000180001789

ExitProcess.KERNEL32 ref: 000000018000198E

Strings

svchost.exe, xrefs: 0000000180001963

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: memset$malloc$ExitFileModuleNameProcessmemcpy$AdminManagerOpenUserwcsstr
String ID: svchost.exe
API String ID: 2075570005-3106260013
Opcode ID: 58df4dc3bab4f7dd2091c0286527b5df24bc2997b8bd963c05bea4cdd90a2c72
Instruction ID: a7e4a02683164cc51efae999f71ec939c82b81573c8ef5df0e77f5c8c66af7f8
Opcode Fuzzy Hash: 58df4dc3bab4f7dd2091c0286527b5df24bc2997b8bd963c05bea4cdd90a2c72
Instruction Fuzzy Hash: 7E015231311A4D81FBAAEB21E8A93DA6360BB8D795F449125A99E46295DF3CC34CC740

Function 000000018002B9A8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002B9D0
_set_statfp.LIBCMT ref: 000000018002B9EB
_set_statfp.LIBCMT ref: 000000018002BA07
_set_statfp.LIBCMT ref: 000000018002BA43

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 3b9bd57b40fff3d8961f464b14179896b260d9c17b5d0c480fa0c6cf32fa7499
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: CB117732690A4D01F7E72129D4553F93340AB6D3F4F45C634BA76976D6CE248BC94302

Function 000001845BF5ADA8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001845BF5ADD0
_set_statfp.LIBCMT ref: 000001845BF5ADEB
_set_statfp.LIBCMT ref: 000001845BF5AE07
_set_statfp.LIBCMT ref: 000001845BF5AE43

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 7b68062c370480586a6b508ff13b72486563f8fde28c0239a908538b01f45b2f
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: 8B11A333A54E0313F7641125E8513ED10C06B59374F18C62DAAF6866DACF388AE24F28

Function 000000018001F660 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001F698
_invalid_parameter_noinfo.LIBCMT ref: 000000018001F8D2

Strings

*, xrefs: 000000018001F7A5
ko-KR, xrefs: 000000018001F6B7

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: 247b425bc4075f99800c1718c7ffe54540729addd1f222e63731e205efc231c0
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: B0718F72504E58C6E7FA9F2980443BC3BA0F34DBD8F649216EA4646399DF31CA8AC750

Function 000001845BF4EA60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF4EA98
_invalid_parameter_noinfo.LIBCMT ref: 000001845BF4ECD2

Strings

ko-KR, xrefs: 000001845BF4EAB7
*, xrefs: 000001845BF4EBA5

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: f16193010dff068c7ed84621fe4ca362c5b18af2dab87b3d1b5dacbfb3e3261e
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: 47718E7350465287E76CDF288144ABE3BA0F309B58F249226DBC6C2299DF71CA82DF55

Function 0000000180017B98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_1, xrefs: 0000000180017D10
__swift_2, xrefs: 0000000180017D34

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: e36f902788c0381efdc077c6dc949100de42eee437ea8b415927d241f746463c
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: CF618E32300A8882EF96DB29E5447E963A1FB4CBD4F488525EF6D4779ADF38D645C340

Function 000001845BF46F98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_2, xrefs: 000001845BF47134
__swift_1, xrefs: 000001845BF47110

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: eedcba72b94e8455cf12a778523fd45130f16c321118e2a38ffc4f48c2386725
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: 0C617833300B4283EE14DF29E94479DB3A1FB85B94F4885259FA987B99DF38D681CB40

Function 000001845BF41C08 Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

InitializeConditionVariable, xrefs: 000001845BF41E2E
h-l1-2-0.dll, xrefs: 000001845BF41DEE
WakeAllConditionVariable, xrefs: 000001845BF41ECE
SleepConditionVariableCS, xrefs: 000001845BF41E8E

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$h-l1-2-0.dll
API String ID: 0-1747795296
Opcode ID: 0f20d8eddffe02f4355215346de876ec0be27590aef8c60f560b2699b0830f65
Instruction ID: a2a64c9656dbf3ac80e007cf1625033fad391ae153a40853377359a67ab715bb
Opcode Fuzzy Hash: 0f20d8eddffe02f4355215346de876ec0be27590aef8c60f560b2699b0830f65
Instruction Fuzzy Hash: 0DE15B73301B4693EF14EB2DD54029C27A0F745FA0F848129DA9D977A2DF38CAA5CB80

Function 0000000180023FE4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024027

Strings

o-l1-2-1, xrefs: 00000001800240CC
gfff, xrefs: 0000000180024149

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 4e08fe91d50fd43471445e9309ac5ad4362738dffbe45d8770cad9fb3b789804
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: 5951F4737147C886E7A78B35E9413997B91E399BD0F48D221EB944BAD6CE38C698C700

Function 000001845BF533E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF53427

Strings

o-l1-2-1, xrefs: 000001845BF534CC
gfff, xrefs: 000001845BF53549

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 35f44d6248e26576cf52ff3a087703af49e5567ca7485271ac6f2982216cf897
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: CC5115737147C687E7258F29A94139DAB91E381B90F48E225D7D987AD6CF38D644CB00

Function 0000000180024430 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018002459E

Strings

synch-l1-2-0, xrefs: 00000001800244A4
api-ms-win-core-sysinfo-l1-2-1, xrefs: 00000001800244D1

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: 9d4985de47fc3aa1ddc341b920f7898ed377652abc42465d74999370fa1411ca
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: 86418E72705F888AE782CF65E8507CE73A5F7193C8F518126EA9807B99DF38C629C340

Function 000001845BF53830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF5399E

Strings

api-ms-win-core-sysinfo-l1-2-1, xrefs: 000001845BF538D1
synch-l1-2-0, xrefs: 000001845BF538A4

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: fcc4e98753c76f204dac5035a5fdf26dc6fcf29de7bff09a069ead2da3181eff
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: CD416873A01B459BE700CF25E8417DD33E5E719388F40C626AA9987B98DF39C625CB84

Function 000000018001D646 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001C478: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000000018001C47C

__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D66E
__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D6F8

Strings

csm, xrefs: 000000018001D6CB

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 011c5e600e2baba1b5aebe761702f78806dc8dec4a9d5acc90072a234146c346
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: 40212D76204A4887E7B2DF15E05079E7760F39DBE4F008206EEA943795CF39DA8ACB01

Function 000001845BF4CA46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000001845BF4B878: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000001845BF4B87C

__DestructExceptionObject.LIBVCRUNTIME ref: 000001845BF4CA6E
__DestructExceptionObject.LIBVCRUNTIME ref: 000001845BF4CAF8

Strings

csm, xrefs: 000001845BF4CACB

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 68cf5074ba69b881289d54ed96a6c5298438dc51312a792323b2b4b7cd58f0c1
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: BB21283760464287E631DF16E05039EB760F388BA9F408211DED983BA5DF39DA86CF11

Function 000000018001A972 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000018001A99B

Strings

nt delete closure', xrefs: 000000018001A9A0
`vector destructor iterator', xrefs: 000000018001A980

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: c8ada3eb98077b3e77d28a4839308a809c4d6d91d1a7368aad5ed78790c858ba
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 9EE01AB1200B0490DB068F65E8513E873A4EB4CB90F48C032AA5C47354EF38C6A9C301

Function 000001845BF49D72 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001845BF49D9B

Strings

`vector destructor iterator', xrefs: 000001845BF49D80
nt delete closure', xrefs: 000001845BF49DA0

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: 3043ecb2c8399d8b9c14b74e94f74efd8f5ba6a037f6f9b56c79e4a541fbf60e
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 59E04F73200B0092DF158F55F8501EC73A4EB4CB50B48D0229A9C87355EF38C6E9C704

Function 000000018001AA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000018001AA55
_CxxThrowException.LIBVCRUNTIME ref: 000000018001AA66

Strings

File, xrefs: 000000018001AA5A

Memory Dump Source

Source File: 00000002.00000002.2975312748.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2975241569.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975593099.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975672931.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2975738503.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 9145d171dbcecb2188c45693134888adfda474ee1ae56853841174419c243042
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 49C08C3221488D91EB62EB10E8917DA5330B7A8384F818111F19C824B69F1CC30ECB00

Function 000001845BF49E4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000001845BF49E55
_CxxThrowException.LIBVCRUNTIME ref: 000001845BF49E66

Strings

File, xrefs: 000001845BF49E5A

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 4ee1287ad15bde44113e449cd526210951ad5c3771337bd71063dc856ee1dd59
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 8EC04C7321458797DA20EB15D8921DD6331B7A8344F908551A2DD829B7DF19C719CF00

Function 000001845BF48974 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

deleting destructor', xrefs: 000001845BF4899A
`vector constructor iterator', xrefs: 000001845BF48A25
deleting destructor', xrefs: 000001845BF48A00
ctor closure', xrefs: 000001845BF489DB

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction ID: 2112eeed5991ed57b2554ea9d727f45c05c098cfdd79fe416daec37c3b6cbcc5
Opcode Fuzzy Hash: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction Fuzzy Hash: 9421C537612A0397FE54DF55F859BAC23A0AB58F40F48C52888CA833A4EF78D248CB05

Function 000001845BF48874 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

deleting destructor', xrefs: 000001845BF4889A
`vector constructor iterator', xrefs: 000001845BF48925
deleting destructor', xrefs: 000001845BF48900
ctor closure', xrefs: 000001845BF488DB

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction ID: ffb873e33f24ff64d72577ffc472100e7d24292a4ee4940022bad741f5a5994a
Opcode Fuzzy Hash: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction Fuzzy Hash: E621D637612A0387FE54DF55F859BAC23A0AB59F51F48C428C8CA833A0EF38D248CB05

Function 000001845BF48774 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

deleting destructor', xrefs: 000001845BF4879A
`vector constructor iterator', xrefs: 000001845BF48825
deleting destructor', xrefs: 000001845BF48800
ctor closure', xrefs: 000001845BF487DB

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction ID: 2b3f0a30c1259a21c04e86109ef383670515a3d33997fa5eeeaeab5e64445a9a
Opcode Fuzzy Hash: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction Fuzzy Hash: A521E737612B0387FE54DF55F859BAC23A0AB58B50F48C428C88A833A0EF3CD248CB05

Function 000001845BF48674 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

deleting destructor', xrefs: 000001845BF4869A
`vector constructor iterator', xrefs: 000001845BF48725
deleting destructor', xrefs: 000001845BF48700
ctor closure', xrefs: 000001845BF486DB

Memory Dump Source

Source File: 00000002.00000002.2982091154.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2982180629.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2982197847.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction ID: cde2585cf13153271a4d7d089664989d999627a01a63d61e9ea037d58361e748
Opcode Fuzzy Hash: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction Fuzzy Hash: E221D837612B0387FE54DF55F859BAC23A0A758B90F48C428C88E833A0EF38D248CB15

Analysis Process: svchost.exePID: 7544, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.2%
Total number of Nodes:	862
Total number of Limit Nodes:	82

Executed Functions

Function 0000000180020680 Relevance: 130.0, APIs: 73, Strings: 1, Instructions: 492
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,0000000180011B37), ref: 0000000180020697
GetCurrentProcess.KERNEL32 ref: 00000001800206C8
OpenProcessToken.ADVAPI32 ref: 00000001800206D9
LookupPrivilegeValueW.ADVAPI32 ref: 0000000180020701
AdjustTokenPrivileges.KERNELBASE ref: 0000000180020721
GetLastError.KERNEL32 ref: 0000000180020727
CloseHandle.KERNEL32 ref: 000000018002073B
VirtualAlloc.KERNEL32 ref: 0000000180020752
InitializeCriticalSection.KERNEL32 ref: 0000000180020764
IsBadReadPtr.KERNEL32 ref: 000000018002077D
EnterCriticalSection.KERNEL32 ref: 0000000180020790
VirtualAlloc.KERNEL32 ref: 00000001800207A7
LeaveCriticalSection.KERNEL32 ref: 00000001800207D6
IsBadReadPtr.KERNEL32 ref: 00000001800207E8
EnterCriticalSection.KERNEL32 ref: 00000001800207FB
VirtualAlloc.KERNEL32 ref: 0000000180020812
LeaveCriticalSection.KERNEL32 ref: 0000000180020841
IsBadReadPtr.KERNEL32 ref: 0000000180020853
EnterCriticalSection.KERNEL32 ref: 0000000180020866
VirtualAlloc.KERNEL32 ref: 000000018002087D
LeaveCriticalSection.KERNEL32 ref: 00000001800208AC
IsBadReadPtr.KERNEL32 ref: 00000001800208BE
EnterCriticalSection.KERNEL32 ref: 00000001800208D1
VirtualAlloc.KERNEL32 ref: 00000001800208E8
LeaveCriticalSection.KERNEL32 ref: 0000000180020917
IsBadReadPtr.KERNEL32 ref: 0000000180020929
EnterCriticalSection.KERNEL32 ref: 000000018002093C
VirtualAlloc.KERNEL32 ref: 0000000180020953
LeaveCriticalSection.KERNEL32 ref: 0000000180020982
IsBadReadPtr.KERNEL32 ref: 0000000180020994
EnterCriticalSection.KERNEL32 ref: 00000001800209A7
VirtualAlloc.KERNEL32 ref: 00000001800209BE
LeaveCriticalSection.KERNEL32 ref: 00000001800209ED
IsBadReadPtr.KERNEL32 ref: 00000001800209FF
EnterCriticalSection.KERNEL32 ref: 0000000180020A12
VirtualAlloc.KERNEL32 ref: 0000000180020A29
LeaveCriticalSection.KERNEL32 ref: 0000000180020A58
IsBadReadPtr.KERNEL32 ref: 0000000180020A6A
EnterCriticalSection.KERNEL32 ref: 0000000180020A7D
VirtualAlloc.KERNEL32 ref: 0000000180020A94
LeaveCriticalSection.KERNEL32 ref: 0000000180020AC3
IsBadReadPtr.KERNEL32 ref: 0000000180020AD5
EnterCriticalSection.KERNEL32 ref: 0000000180020AEB
LeaveCriticalSection.KERNEL32 ref: 0000000180020B16
IsBadReadPtr.KERNEL32 ref: 0000000180020B2E
EnterCriticalSection.KERNEL32 ref: 0000000180020B44
LeaveCriticalSection.KERNEL32 ref: 0000000180020B68
IsBadReadPtr.KERNEL32 ref: 0000000180020B81
EnterCriticalSection.KERNEL32 ref: 0000000180020B97
LeaveCriticalSection.KERNEL32 ref: 0000000180020BBB
IsBadReadPtr.KERNEL32 ref: 0000000180020BD4
EnterCriticalSection.KERNEL32 ref: 0000000180020BEA
LeaveCriticalSection.KERNEL32 ref: 0000000180020C16
IsBadReadPtr.KERNEL32 ref: 0000000180020C2F
EnterCriticalSection.KERNEL32 ref: 0000000180020C45
LeaveCriticalSection.KERNEL32 ref: 0000000180020C69
IsBadReadPtr.KERNEL32 ref: 0000000180020C82
EnterCriticalSection.KERNEL32 ref: 0000000180020C98
LeaveCriticalSection.KERNEL32 ref: 0000000180020CBC
IsBadReadPtr.KERNEL32 ref: 0000000180020CD5
EnterCriticalSection.KERNEL32 ref: 0000000180020CEB
LeaveCriticalSection.KERNEL32 ref: 0000000180020D16
IsBadReadPtr.KERNEL32 ref: 0000000180020D2F
EnterCriticalSection.KERNEL32 ref: 0000000180020D45
LeaveCriticalSection.KERNEL32 ref: 0000000180020D69
LeaveCriticalSection.KERNEL32 ref: 0000000180020DA4
LeaveCriticalSection.KERNEL32 ref: 0000000180020DB6
LeaveCriticalSection.KERNEL32 ref: 0000000180020DC8
LeaveCriticalSection.KERNEL32 ref: 0000000180020DDA
LeaveCriticalSection.KERNEL32 ref: 0000000180020DEC
LeaveCriticalSection.KERNEL32 ref: 0000000180020DFE
LeaveCriticalSection.KERNEL32 ref: 0000000180020E10
LeaveCriticalSection.KERNEL32 ref: 0000000180020E22

Strings

SeDebugPrivilege, xrefs: 00000001800206F0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead$AllocVirtual$ProcessToken$AdjustCloseCurrentErrorHandleInitializeLastLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3221255601-2896544425
Opcode ID: 79b32153c8a47bce9488e86581e1df08a4a5845b2d426890eb6905a67430a941
Instruction ID: 8182a6c1e6bb2c399cdab592ca016c8a5b7603f4b1f61c7e89913c231e199cb3
Opcode Fuzzy Hash: 79b32153c8a47bce9488e86581e1df08a4a5845b2d426890eb6905a67430a941
Instruction Fuzzy Hash: 03320C35301F4986EB9B8F11EA543A97366FB48BC0F64C515EA6A43B95EF38D66CC300

Function 00000001800224E0 Relevance: 124.9, APIs: 54, Strings: 17, Instructions: 614
registrymemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 000000018002258F
memset.NTDLL ref: 00000001800225A3
memset.NTDLL ref: 0000000180022635
memset.NTDLL ref: 0000000180022740
gethostname.WS2_32 ref: 0000000180022751
gethostbyname.WS2_32 ref: 000000018002275E
inet_ntoa.WS2_32 ref: 000000018002276D
wsprintfW.USER32 ref: 0000000180022781
lstrcatW.KERNEL32 ref: 00000001800227B2
GetForegroundWindow.USER32 ref: 00000001800227B8
GetWindowTextW.USER32 ref: 00000001800227D3
VirtualAlloc.KERNEL32 ref: 00000001800227EA
GetModuleHandleW.KERNEL32 ref: 0000000180022809
GetProcAddress.KERNEL32 ref: 0000000180022822
GetModuleHandleW.KERNEL32 ref: 0000000180022854
GetProcAddress.KERNEL32 ref: 0000000180022869
VirtualFree.KERNELBASE ref: 00000001800228A5
GetComputerNameW.KERNEL32 ref: 00000001800228C3
GetCurrentProcess.KERNEL32 ref: 00000001800228E4
IsWow64Process.KERNEL32 ref: 00000001800228F4
RegOpenKeyExW.ADVAPI32 ref: 0000000180022926
RegQueryValueExW.ADVAPI32 ref: 000000018002295A
RegCloseKey.ADVAPI32 ref: 0000000180022969
RegCloseKey.ADVAPI32 ref: 0000000180022971
GetSystemInfo.KERNEL32 ref: 000000018002298A
wsprintfW.USER32 ref: 00000001800229A9
GlobalMemoryStatusEx.KERNEL32 ref: 00000001800229CD
wsprintfW.USER32 ref: 00000001800229E9
VirtualAlloc.KERNEL32 ref: 0000000180022A0A
VirtualAlloc.KERNEL32 ref: 0000000180022A24
GetUserNameW.ADVAPI32 ref: 0000000180022A41
GetCurrentProcessId.KERNEL32 ref: 0000000180022A47
wsprintfW.USER32 ref: 0000000180022A6B
VirtualFree.KERNELBASE ref: 0000000180022A7C
VirtualFree.KERNEL32 ref: 0000000180022A8D
memset.NTDLL ref: 0000000180022AA2
GetWindowsDirectoryW.KERNEL32 ref: 0000000180022ABF
GetLastError.KERNEL32 ref: 0000000180022AC9
GetVolumeInformationW.KERNEL32 ref: 0000000180022B20
wsprintfA.USER32 ref: 0000000180022B88
wsprintfA.USER32 ref: 0000000180022B9C
wsprintfW.USER32 ref: 0000000180022BC0
CoInitializeEx.COMBASE ref: 0000000180022BCB
CoCreateInstance.COMBASE ref: 0000000180022BFB
SysFreeString.OLEAUT32 ref: 0000000180022CB8
CoUninitialize.OLE32 ref: 0000000180022CE2
GetCurrentProcess.KERNEL32 ref: 0000000180022CF3
IsWow64Process.KERNEL32 ref: 0000000180022D03

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNELBASE ref: 0000000180022ECA
VirtualFree.KERNEL32 ref: 0000000180022EF4
VirtualFree.KERNELBASE ref: 0000000180022F0A
VirtualFree.KERNEL32 ref: 0000000180022F34
VirtualFree.KERNEL32 ref: 0000000180022F68
VirtualFree.KERNEL32 ref: 0000000180022F92

Strings

UDP, xrefs: 000000018002279B
RtlGetVersion, xrefs: 0000000180022818
RtlGetNtVersionNumbers, xrefs: 000000018002285F
%X%X%hs, xrefs: 0000000180022BB2
:, xrefs: 0000000180022B12
ntdll.dll, xrefs: 00000001800227FC, 0000000180022835
%dMB, xrefs: 00000001800229D7
[U]:%s | [P]:%s, xrefs: 0000000180022A5A
1216, xrefs: 000000018002269E
TCP, xrefs: 0000000180022792
HTTP, xrefs: 00000001800227A6
HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0, xrefs: 00000001800228FF
%hs, xrefs: 0000000180022776
~MHZ, xrefs: 0000000180022941
%08X, xrefs: 0000000180022B77, 0000000180022B91
FriendlyName, xrefs: 0000000180022C9C
%d*%dMHz, xrefs: 0000000180022997

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$wsprintf$CriticalSection$Processmemset$CurrentEnterRead$AddressCloseHandleInitializeLeaveModuleNameProcWindowWow64$ComputerCreateDirectoryErrorForegroundGlobalInfoInformationInstanceLastMemoryOpenQueryStatusStringSystemTextUninitializeUserValueVolumeWindowsgethostbynamegethostnameinet_ntoalstrcat
String ID: %08X$%X%X%hs$%d*%dMHz$%dMB$%hs$1216$:$FriendlyName$HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0$HTTP$RtlGetNtVersionNumbers$RtlGetVersion$TCP$UDP$[U]:%s | [P]:%s$ntdll.dll$~MHZ
API String ID: 1654958678-2219617641
Opcode ID: 568594e8bc2c5765bfc1ae6a0361cb2a71fe365cdb98b8f02094b72811b38f6b
Instruction ID: 85167b4e31fce27fea4a3dd865718084707bdea1bb1ad3282e4a31ddf71c6b33
Opcode Fuzzy Hash: 568594e8bc2c5765bfc1ae6a0361cb2a71fe365cdb98b8f02094b72811b38f6b
Instruction Fuzzy Hash: 6F628C36A14BC486EB62DF25DC547ED33A1FB9DB88F419215EA5947A64EF38C388C700

Function 0000000180012140 Relevance: 107.0, APIs: 49, Strings: 12, Instructions: 293
memorystringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000018002B990: VirtualAlloc.KERNEL32 ref: 000000018002B9B9
Part of subcall function 000000018002B990: memcpy.NTDLL ref: 000000018002B9DD
Part of subcall function 000000018002B990: VirtualAlloc.KERNEL32 ref: 000000018002BA08
Part of subcall function 000000018002B990: memcpy.NTDLL ref: 000000018002BA3D
Part of subcall function 000000018002B990: memcpy.NTDLL ref: 000000018002BA73
Part of subcall function 000000018002B990: memset.NTDLL ref: 000000018002BB0C
Part of subcall function 000000018002B990: ExpandEnvironmentStringsW.KERNEL32 ref: 000000018002BB23
Part of subcall function 000000018002B990: memset.NTDLL ref: 000000018002BB38

Part of subcall function 000000018002D340: GetModuleHandleW.KERNEL32 ref: 000000018002D35F
Part of subcall function 000000018002D340: GetCurrentProcess.KERNEL32 ref: 000000018002D379
Part of subcall function 000000018002D340: K32GetModuleInformation.KERNEL32 ref: 000000018002D390
Part of subcall function 000000018002D340: memset.NTDLL ref: 000000018002D3A8
Part of subcall function 000000018002D340: GetSystemDirectoryW.KERNEL32 ref: 000000018002D3B7
Part of subcall function 000000018002D340: lstrcatW.KERNEL32 ref: 000000018002D3D9
Part of subcall function 000000018002D340: CreateFileW.KERNEL32 ref: 000000018002D406
Part of subcall function 000000018002D340: CreateFileMappingW.KERNELBASE ref: 000000018002D42D
Part of subcall function 000000018002D340: MapViewOfFile.KERNEL32 ref: 000000018002D457
Part of subcall function 000000018002D340: VirtualProtect.KERNEL32 ref: 000000018002D4F2
Part of subcall function 000000018002D340: memcpy.NTDLL ref: 000000018002D507

WSAStartup.WS2_32 ref: 0000000180012167

Part of subcall function 000000018002D7D0: CoInitializeEx.COMBASE ref: 000000018002D820
Part of subcall function 000000018002D7D0: CoCreateInstance.COMBASE ref: 000000018002D845
Part of subcall function 000000018002D7D0: CoUninitialize.OLE32 ref: 000000018002D86E

GetCommandLineW.KERNEL32 ref: 00000001800121A4
CommandLineToArgvW.SHELL32 ref: 00000001800121B4

Part of subcall function 000000018001AFC0: VirtualAlloc.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001AFD7
Part of subcall function 000000018001AFC0: CreateEventW.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B061
Part of subcall function 000000018001AFC0: VirtualAlloc.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B086
Part of subcall function 000000018001AFC0: InitializeCriticalSection.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B098
Part of subcall function 000000018001AFC0: VirtualAlloc.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B0BD
Part of subcall function 000000018001AFC0: InitializeCriticalSection.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B0CF
Part of subcall function 000000018001AFC0: VirtualAlloc.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B0F4
Part of subcall function 000000018001AFC0: InitializeCriticalSection.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B106
Part of subcall function 000000018001AFC0: VirtualAlloc.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B12B
Part of subcall function 000000018001AFC0: InitializeCriticalSection.KERNEL32(?,?,?,0000000180011E17), ref: 000000018001B13D

VirtualAlloc.KERNEL32 ref: 00000001800121D5
InitializeCriticalSection.KERNEL32 ref: 00000001800121E7
VirtualAlloc.KERNEL32 ref: 000000018001220C
InitializeCriticalSection.KERNEL32 ref: 000000018001221E
memset.NTDLL ref: 000000018001223F
GetCurrentProcessId.KERNEL32 ref: 0000000180012244
lstrcmpiW.KERNEL32 ref: 0000000180012264
lstrcmpiW.KERNEL32 ref: 000000018001227F
ExitThread.KERNEL32 ref: 0000000180012290

Strings

18.166.193.8, xrefs: 00000001800124CA, 00000001800124D6
taskmgr.exe, xrefs: 0000000180012273
Schedule, xrefs: 00000001800122D8, 0000000180012642
Microsoft Mail Update Task MachineCore, xrefs: 0000000180012586
MicrosoftMailUpdateTask, xrefs: 0000000180012532, 0000000180012567
%s\%s, xrefs: 0000000180012504
Inject Test, xrefs: 0000000180012256
C:\Program Files\Windows Mail, xrefs: 0000000180012416, 00000001800124B7, 00000001800124FD
ParphaCrashReport64.exe, xrefs: 00000001800122F4, 00000001800124F6
perfmon.exe, xrefs: 0000000180012297
svchost.exe, xrefs: 00000001800122BE
/Processid:{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 00000001800125CB, 00000001800125F1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$Initialize$CriticalSection$Creatememcpymemset$File$CommandCurrentLineModuleProcesslstrcmpi$ArgvDirectoryEnvironmentEventExitExpandHandleInformationInstanceMappingProtectStartupStringsSystemThreadUninitializeViewlstrcat
String ID: %s\%s$/Processid:{F8284233-48F4-4680-ADDD-F8284233}$18.166.193.8$C:\Program Files\Windows Mail$Inject Test$Microsoft Mail Update Task MachineCore$MicrosoftMailUpdateTask$ParphaCrashReport64.exe$Schedule$perfmon.exe$svchost.exe$taskmgr.exe
API String ID: 3540647475-76250962
Opcode ID: 569088badbbcdac6d42bf1008e5f6975a5e4569a9871405a7f488f6c7dbac2ae
Instruction ID: 2d135b880d5fe02e417b51c7c9d75e0b01d22dc8dd8ce6cea38afdafabf7ab39
Opcode Fuzzy Hash: 569088badbbcdac6d42bf1008e5f6975a5e4569a9871405a7f488f6c7dbac2ae
Instruction Fuzzy Hash: E3E15B31210F8986EBA69B21EC543D92362FB8CBC5F54C229F95A466A5FF38C75DD300

Function 00000001800176E0 Relevance: 73.8, APIs: 26, Strings: 16, Instructions: 273
memorythreadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0000000180017709
GetSystemDirectoryW.KERNEL32 ref: 000000018001771A
GetLastError.KERNEL32 ref: 0000000180017724
lstrcatW.KERNEL32 ref: 00000001800178FB
IsBadReadPtr.KERNEL32 ref: 0000000180017910
EnterCriticalSection.KERNEL32 ref: 0000000180017926
LeaveCriticalSection.KERNEL32 ref: 0000000180017949

Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,0000000180011B37), ref: 0000000180020697
Part of subcall function 0000000180020680: GetCurrentProcess.KERNEL32 ref: 00000001800206C8
Part of subcall function 0000000180020680: OpenProcessToken.ADVAPI32 ref: 00000001800206D9
Part of subcall function 0000000180020680: LookupPrivilegeValueW.ADVAPI32 ref: 0000000180020701
Part of subcall function 0000000180020680: AdjustTokenPrivileges.KERNELBASE ref: 0000000180020721
Part of subcall function 0000000180020680: GetLastError.KERNEL32 ref: 0000000180020727
Part of subcall function 0000000180020680: CloseHandle.KERNEL32 ref: 000000018002073B
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020752
Part of subcall function 0000000180020680: InitializeCriticalSection.KERNEL32 ref: 0000000180020764
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 000000018002077D
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 0000000180020790
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 00000001800207A7
Part of subcall function 0000000180020680: LeaveCriticalSection.KERNEL32 ref: 00000001800207D6
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 00000001800207E8
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 00000001800207FB
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020812

IsBadReadPtr.KERNEL32 ref: 00000001800179C4
EnterCriticalSection.KERNEL32 ref: 00000001800179D7
VirtualAlloc.KERNEL32 ref: 00000001800179EF
LeaveCriticalSection.KERNEL32 ref: 0000000180017A13
CreateThread.KERNEL32 ref: 0000000180017A43
IsBadReadPtr.KERNEL32 ref: 0000000180017A67
EnterCriticalSection.KERNEL32 ref: 0000000180017A7A
VirtualAlloc.KERNEL32 ref: 0000000180017A91
LeaveCriticalSection.KERNEL32 ref: 0000000180017AB5
memset.NTDLL ref: 0000000180017AD5
GetCurrentProcessId.KERNEL32 ref: 0000000180017ADA
wsprintfW.USER32 ref: 0000000180017AF4
IsBadReadPtr.KERNEL32 ref: 0000000180017B17
EnterCriticalSection.KERNEL32 ref: 0000000180017B2A
VirtualAlloc.KERNEL32 ref: 0000000180017B41
LeaveCriticalSection.KERNEL32 ref: 0000000180017B65
CreateThread.KERNEL32 ref: 0000000180017B87
VirtualFree.KERNEL32 ref: 0000000180017BAD
LeaveCriticalSection.KERNEL32 ref: 0000000180017BDD

Strings

:G:, xrefs: 000000018001786F
f:^:, xrefs: 000000018001773B
V:V:, xrefs: 0000000180017747
\\.\Pipe\%d_pipe%d, xrefs: 0000000180017AE3
_:I:, xrefs: 00000001800177BC
A:|:, xrefs: 00000001800177DA
U:Y:, xrefs: 00000001800177B4
I:N:, xrefs: 000000018001775F
j:H:, xrefs: 0000000180017792
B:_:, xrefs: 0000000180017777
~:~:, xrefs: 000000018001784C
R:U:, xrefs: 0000000180017753
:, xrefs: 0000000180017890
^:, xrefs: 00000001800177CC
{:~:, xrefs: 0000000180017845
I:S:, xrefs: 00000001800177C4

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterLeaveRead$Process$CreateCurrentErrorLastThreadTokenmemset$AdjustCloseDirectoryFreeHandleInitializeLookupOpenPrivilegePrivilegesSystemValuelstrcatwsprintf
String ID: :G:$:$A:|:$B:_:$I:N:$I:S:$R:U:$U:Y:$V:V:$\\.\Pipe\%d_pipe%d$^:$_:I:$f:^:$j:H:${:~:$~:~:
API String ID: 1888231936-1994672154
Opcode ID: d1dc49243b75cc45df72bb56242f6d83b0d0b9c438548c6c26e7b7a07f614e83
Instruction ID: 3889ea3ac3043fc74429e799f3028dbf4620c996b15624d143a50c7995104de0
Opcode Fuzzy Hash: d1dc49243b75cc45df72bb56242f6d83b0d0b9c438548c6c26e7b7a07f614e83
Instruction Fuzzy Hash: FCE19373604F848AE7518F31E8407EE77B5FB89B88F549215EE9907A59EF38D648CB00

Function 0000000180015150 Relevance: 52.7, APIs: 22, Strings: 8, Instructions: 248
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0000000180015186
wsprintfW.USER32 ref: 00000001800151A5
CreateFileW.KERNEL32 ref: 00000001800151E3
GetFileSize.KERNEL32 ref: 00000001800151FA
ReadFile.KERNEL32 ref: 0000000180015221
CloseHandle.KERNEL32 ref: 00000001800152AF
SetThreadExecutionState.KERNEL32 ref: 00000001800152C5
SystemParametersInfoW.USER32 ref: 00000001800152D6
SystemParametersInfoW.USER32 ref: 00000001800152E7
lstrlenW.KERNEL32 ref: 0000000180015326
lstrlenA.KERNEL32 ref: 000000018001533B
lstrcmpiW.KERNEL32 ref: 0000000180015353
lstrcmpiW.KERNEL32 ref: 0000000180015375
lstrcmpiW.KERNEL32 ref: 0000000180015396
htons.WS2_32 ref: 00000001800153CE
VirtualFree.KERNEL32 ref: 00000001800153F7
VirtualAlloc.KERNEL32 ref: 0000000180015450
CreateThread.KERNEL32 ref: 00000001800154A0
VirtualFree.KERNEL32 ref: 00000001800154DA
VirtualFree.KERNEL32 ref: 0000000180015504
VirtualFree.KERNEL32 ref: 000000018001551C
WaitForSingleObject.KERNEL32 ref: 000000018001554A

Strings

18.166.193.8, xrefs: 00000001800151B0
TCP, xrefs: 000000018001536E
HTTP, xrefs: 000000018001538F
UDP, xrefs: 000000018001534C
%s\%s, xrefs: 0000000180015199
PTCP, xrefs: 00000001800152B8
C:\Program Files\Windows Mail, xrefs: 0000000180015192
install.cfg, xrefs: 000000018001518B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Filelstrcmpi$CreateInfoParametersSystemThreadlstrlen$AllocCloseExecutionHandleObjectReadSingleSizeStateWaithtonsmemsetwsprintf
String ID: %s\%s$18.166.193.8$C:\Program Files\Windows Mail$HTTP$PTCP$TCP$UDP$install.cfg
API String ID: 1274318034-1950299317
Opcode ID: 663568433656cea89e63caccbc2b97e320fd9943314f34955629d2a210d6f6f0
Instruction ID: 2f6e79b09caedb5c6ecaa2b644d67a3a665af9ed5fdace6e6c7bc957c955e5e0
Opcode Fuzzy Hash: 663568433656cea89e63caccbc2b97e320fd9943314f34955629d2a210d6f6f0
Instruction Fuzzy Hash: E3B14832611B4986EB968F22EC54BD937A6FB8DBC1F548225ED9A47750EF38C64CC700

Function 00000001800194C0 Relevance: 50.9, APIs: 28, Strings: 1, Instructions: 182
memoryprocessstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

CreateToolhelp32Snapshot.KERNEL32 ref: 0000000180019526
GetProcessHeap.KERNEL32 ref: 0000000180019535
HeapAlloc.KERNEL32 ref: 0000000180019549
CloseHandle.KERNEL32 ref: 000000018001955E
WTSGetActiveConsoleSessionId.KERNEL32 ref: 000000018001956D
WaitForSingleObject.KERNEL32 ref: 00000001800195AB
CreateToolhelp32Snapshot.KERNEL32 ref: 00000001800195C8
GetProcessHeap.KERNEL32 ref: 00000001800195D7
HeapAlloc.KERNEL32 ref: 00000001800195EB
CloseHandle.KERNEL32 ref: 0000000180019600
WTSGetActiveConsoleSessionId.KERNEL32 ref: 000000018001960F
WaitForSingleObject.KERNEL32 ref: 000000018001964D
VirtualFree.KERNEL32 ref: 000000018001968D
VirtualFree.KERNEL32 ref: 00000001800196B7
Process32FirstW.KERNEL32 ref: 00000001800196D1
lstrcmpiW.KERNEL32 ref: 00000001800196EB
Process32NextW.KERNEL32 ref: 00000001800196FB
GetProcessHeap.KERNEL32 ref: 000000018001970A
HeapFree.KERNEL32 ref: 0000000180019718
CloseHandle.KERNEL32 ref: 0000000180019721
ProcessIdToSessionId.KERNEL32 ref: 0000000180019739
Process32FirstW.KERNEL32 ref: 000000018001974D
lstrcmpiW.KERNEL32 ref: 000000018001976B
Process32NextW.KERNEL32 ref: 000000018001977B
GetProcessHeap.KERNEL32 ref: 000000018001978A
HeapFree.KERNEL32 ref: 0000000180019798
CloseHandle.KERNEL32 ref: 00000001800197A1
ProcessIdToSessionId.KERNEL32 ref: 00000001800197B9

Strings

explorer.exe, xrefs: 00000001800196E4, 0000000180019764

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Heap$AllocVirtual$CriticalProcessSection$CloseFreeHandleProcess32Session$EnterRead$ActiveConsoleCreateFirstLeaveNextObjectSingleSnapshotToolhelp32Waitlstrcmpi$Initialize
String ID: explorer.exe
API String ID: 2751948232-3187896405
Opcode ID: b05089d6881e8808c4204a9cfe87279db86dff134d3bf9d3ac2242ebd18fc37f
Instruction ID: 32f2e8d2d4c86b41326691215f700daf0fb0283404abdd8ad98e089d9f1d483d
Opcode Fuzzy Hash: b05089d6881e8808c4204a9cfe87279db86dff134d3bf9d3ac2242ebd18fc37f
Instruction Fuzzy Hash: 8C815C31205B4982EB96DF62E85879973A2FB8DFD0F55C214E92A43794EF38C68DD700

Function 000000018001F9E0 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 201
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32 ref: 000000018001FA31
GetLastError.KERNEL32 ref: 000000018001FA3F
VirtualAllocEx.KERNEL32 ref: 000000018001FA6B
WriteProcessMemory.KERNEL32 ref: 000000018001FA8F
GetLastError.KERNEL32 ref: 000000018001FA99

Strings

h, xrefs: 000000018001FB9B
@, xrefs: 000000018001FABA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AllocErrorLastVirtual$MemoryProcessWrite
String ID: @$h
API String ID: 1382438346-1029331998
Opcode ID: 68fc5231bb649cffb2ef201a26c0452fc735f8ffc7358dd3c59d4300c21df8ec
Instruction ID: a7a10f81cb03d2afda9468892e7ca3dc18b483b94c8c543e7091a66b8c703a11
Opcode Fuzzy Hash: 68fc5231bb649cffb2ef201a26c0452fc735f8ffc7358dd3c59d4300c21df8ec
Instruction Fuzzy Hash: F481F832218BC486E7A18B59B85479EAB51F79A7C4F448219FEC647B49DF3CC709CB40

Function 0000000180011AE0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103
memorynativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 0000000180011B02
VirtualAlloc.KERNEL32 ref: 0000000180011B29

Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,0000000180011B37), ref: 0000000180020697
Part of subcall function 0000000180020680: GetCurrentProcess.KERNEL32 ref: 00000001800206C8
Part of subcall function 0000000180020680: OpenProcessToken.ADVAPI32 ref: 00000001800206D9
Part of subcall function 0000000180020680: LookupPrivilegeValueW.ADVAPI32 ref: 0000000180020701
Part of subcall function 0000000180020680: AdjustTokenPrivileges.KERNELBASE ref: 0000000180020721
Part of subcall function 0000000180020680: GetLastError.KERNEL32 ref: 0000000180020727
Part of subcall function 0000000180020680: CloseHandle.KERNEL32 ref: 000000018002073B
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020752
Part of subcall function 0000000180020680: InitializeCriticalSection.KERNEL32 ref: 0000000180020764
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 000000018002077D
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 0000000180020790
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 00000001800207A7
Part of subcall function 0000000180020680: LeaveCriticalSection.KERNEL32 ref: 00000001800207D6
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 00000001800207E8
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 00000001800207FB
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020812

WaitForSingleObject.KERNEL32 ref: 0000000180011B4D
NtQuerySystemInformation.NTDLL ref: 0000000180011B6B
VirtualFree.KERNEL32 ref: 0000000180011B89
VirtualAlloc.KERNEL32 ref: 0000000180011B9D
memset.NTDLL ref: 0000000180011BB9
NtQuerySystemInformation.NTDLL ref: 0000000180011BD2
lstrcmpiW.KERNEL32 ref: 0000000180011BF3
WaitForSingleObject.KERNEL32 ref: 0000000180011C40
CloseHandle.KERNEL32 ref: 0000000180011C54

Strings

taskmgr.exe, xrefs: 0000000180011BEC

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalSection$CloseEnterHandleInformationObjectProcessQueryReadSingleSystemTokenWait$AdjustCreateCurrentErrorEventFreeInitializeLastLeaveLookupOpenPrivilegePrivilegesValuelstrcmpimemset
String ID: taskmgr.exe
API String ID: 441768363-4156271273
Opcode ID: 0621dc44498ae919b7e903597f6a72dc258cdebb099c8e8026c95ccd3122d783
Instruction ID: 8c534c4529b1279cb1ee3dcd0e8a20b8e351fbbc3e98abf8b0580985b8146b18
Opcode Fuzzy Hash: 0621dc44498ae919b7e903597f6a72dc258cdebb099c8e8026c95ccd3122d783
Instruction Fuzzy Hash: BE419331309A4886E79A9F52E9547EAB752FB8CBD1F14C119FD5643A94EF38CA0CC740

Function 0000000180011C70 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103
memorynativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 0000000180011C92
VirtualAlloc.KERNEL32 ref: 0000000180011CB9

Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,0000000180011B37), ref: 0000000180020697
Part of subcall function 0000000180020680: GetCurrentProcess.KERNEL32 ref: 00000001800206C8
Part of subcall function 0000000180020680: OpenProcessToken.ADVAPI32 ref: 00000001800206D9
Part of subcall function 0000000180020680: LookupPrivilegeValueW.ADVAPI32 ref: 0000000180020701
Part of subcall function 0000000180020680: AdjustTokenPrivileges.KERNELBASE ref: 0000000180020721
Part of subcall function 0000000180020680: GetLastError.KERNEL32 ref: 0000000180020727
Part of subcall function 0000000180020680: CloseHandle.KERNEL32 ref: 000000018002073B
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020752
Part of subcall function 0000000180020680: InitializeCriticalSection.KERNEL32 ref: 0000000180020764
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 000000018002077D
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 0000000180020790
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 00000001800207A7
Part of subcall function 0000000180020680: LeaveCriticalSection.KERNEL32 ref: 00000001800207D6
Part of subcall function 0000000180020680: IsBadReadPtr.KERNEL32 ref: 00000001800207E8
Part of subcall function 0000000180020680: EnterCriticalSection.KERNEL32 ref: 00000001800207FB
Part of subcall function 0000000180020680: VirtualAlloc.KERNEL32 ref: 0000000180020812

WaitForSingleObject.KERNEL32 ref: 0000000180011CDD
NtQuerySystemInformation.NTDLL ref: 0000000180011CFB
VirtualFree.KERNEL32 ref: 0000000180011D19
VirtualAlloc.KERNEL32 ref: 0000000180011D2D
memset.NTDLL ref: 0000000180011D49
NtQuerySystemInformation.NTDLL ref: 0000000180011D62
lstrcmpiW.KERNEL32 ref: 0000000180011D83
WaitForSingleObject.KERNEL32 ref: 0000000180011DD0
CloseHandle.KERNEL32 ref: 0000000180011DE4

Strings

perfmon.exe, xrefs: 0000000180011D7C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalSection$CloseEnterHandleInformationObjectProcessQueryReadSingleSystemTokenWait$AdjustCreateCurrentErrorEventFreeInitializeLastLeaveLookupOpenPrivilegePrivilegesValuelstrcmpimemset
String ID: perfmon.exe
API String ID: 441768363-2343862317
Opcode ID: 1ff94469c56b8cc6a5d9ee662ab4a9b8b7f31cb7e0d49a88a5d64ab3ffe76320
Instruction ID: 1ff6f72ff0560bcc7d3ab5e25184d4435df018d7ec391edcb978b88ee9d5e7f7
Opcode Fuzzy Hash: 1ff94469c56b8cc6a5d9ee662ab4a9b8b7f31cb7e0d49a88a5d64ab3ffe76320
Instruction Fuzzy Hash: FC418231305A4C46EB9A8F56F9147EAB762FB8CBD1F14C129FD5643A94DF38C6088780

Function 000000018001AAD0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000000018001AB23
RegisterClassW.USER32 ref: 000000018001AB46
CreateWindowExW.USER32 ref: 000000018001AB9C
SetWindowLongPtrW.USER32 ref: 000000018001ABB9
WTSRegisterSessionNotification.WTSAPI32 ref: 000000018001ABC7
ShowWindow.USER32 ref: 000000018001ABD6
GetMessageW.USER32 ref: 000000018001AC01
TranslateMessage.USER32 ref: 000000018001AC15
DispatchMessageW.USER32 ref: 000000018001AC20
GetMessageW.USER32 ref: 000000018001AC33
WTSUnRegisterSessionNotification.WTSAPI32 ref: 000000018001AC40

Strings

Session Logon, xrefs: 000000018001AB54

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Message$RegisterWindow$NotificationSession$ClassCreateDispatchHandleLongModuleShowTranslate
String ID: Session Logon
API String ID: 1979525249-2950959013
Opcode ID: 0d96d5dafa15c8008ce9f0b536f309e21048c116557f430f552321169d452b8d
Instruction ID: d08fdae4d4f9fdd3136886858d865e0be8124aefc151439e2e8a41504d97a45e
Opcode Fuzzy Hash: 0d96d5dafa15c8008ce9f0b536f309e21048c116557f430f552321169d452b8d
Instruction Fuzzy Hash: 26415532658B8583E751CF25F85439AB3A1FB9D784F64D225EA9942A24EF38C189CB00

Function 0000000180013E10 Relevance: 16.8, APIs: 10, Strings: 1, Instructions: 271
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualAlloc.KERNEL32 ref: 0000000180013E86
VirtualAlloc.KERNEL32 ref: 0000000180013FAD
VirtualFree.KERNEL32 ref: 0000000180013FC6
VirtualFree.KERNEL32 ref: 0000000180013FDC
VirtualFree.KERNELBASE ref: 00000001800140E0
VirtualFree.KERNEL32 ref: 000000018001410A
VirtualFree.KERNELBASE ref: 000000018001411B
VirtualFree.KERNEL32 ref: 0000000180014006

Part of subcall function 0000000180015070: _time64.MSVCRT ref: 00000001800150E0
Part of subcall function 0000000180015070: srand.MSVCRT ref: 00000001800150E9
Part of subcall function 0000000180015070: rand.MSVCRT ref: 0000000180015100

VirtualFree.KERNELBASE ref: 00000001800141CF
VirtualFree.KERNELBASE ref: 00000001800141F9

Strings

:, xrefs: 0000000180014180

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$CriticalSection$EnterRead$Leave$Initialize_time64randsrand
String ID: :
API String ID: 3336294232-336475711
Opcode ID: 320fe126eff4e4079a3c9b3cb6761e39752f23555b150b95cbf71f8c5b9ac005
Instruction ID: ac7c9b2bb9ed7eb79858a5ee46919171fc2b07e9708586d287d69a6b6e660aff
Opcode Fuzzy Hash: 320fe126eff4e4079a3c9b3cb6761e39752f23555b150b95cbf71f8c5b9ac005
Instruction Fuzzy Hash: CDB1C032710B8482EB568F2AE4053A9A7A1FBCEFC4F14D225EE8947755EF38C649C740

Function 000000018002D140 Relevance: 15.1, APIs: 10, Instructions: 95
servicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D165
EnumServicesStatusExW.ADVAPI32 ref: 000000018002D1B1
malloc.MSVCRT ref: 000000018002D1C6
memset.NTDLL ref: 000000018002D1DC
EnumServicesStatusExW.ADVAPI32 ref: 000000018002D21B
CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D228
free.MSVCRT ref: 000000018002D231
CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D24D
lstrcmpiW.KERNEL32(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D26D
free.MSVCRT ref: 000000018002D291

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseEnumHandleServiceServicesStatusfree$ManagerOpenlstrcmpimallocmemset
String ID:
API String ID: 2647132813-0
Opcode ID: c2b9930ff57626eae451ef52e78241fd2a7e99a3c5bb9cb5767dca943c792e03
Instruction ID: 7c73760ca3ebe89c16cf9c31f76af7ec992950ddbeb1bc6f2b7493007aa42a7f
Opcode Fuzzy Hash: c2b9930ff57626eae451ef52e78241fd2a7e99a3c5bb9cb5767dca943c792e03
Instruction Fuzzy Hash: 53418832205B48CAE7A58F25F84479AB7A5FB8CB94F548525EE8D43B14EF38C64DDB00

Function 00000001800223B0 Relevance: 15.1, APIs: 10, Instructions: 74stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000001800223C2
malloc.MSVCRT ref: 00000001800223DE
Process32FirstW.KERNEL32 ref: 0000000180022404
lstrlenW.KERNEL32 ref: 000000018002241B
lstrlenW.KERNEL32 ref: 0000000180022429
Process32NextW.KERNEL32 ref: 0000000180022460
lstrlenW.KERNEL32 ref: 0000000180022474
Process32NextW.KERNEL32 ref: 00000001800224AB
free.MSVCRT ref: 00000001800224BD
CloseHandle.KERNEL32 ref: 00000001800224C6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process32lstrlen$Next$CloseCreateFirstHandleSnapshotToolhelp32freemalloc
String ID:
API String ID: 4027670598-0
Opcode ID: 439f8d2e972513238416a548221f462a94073303e1c60fa0b93f47d4e757f503
Instruction ID: 5ce6378f21c5ee87597c9bb07d5787008eb168cc985a55d02f6761e40f426007
Opcode Fuzzy Hash: 439f8d2e972513238416a548221f462a94073303e1c60fa0b93f47d4e757f503
Instruction Fuzzy Hash: 02315A71204B5582EB919F26E85439967B1FB8CFD0F549225EE5A43B68EF3CC64DCB00

Function 0000000180032C50 Relevance: 13.6, APIs: 9, Instructions: 90networkmemoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180032C83
CreateEventW.KERNEL32 ref: 0000000180032CB4
WSARecv.WS2_32 ref: 0000000180032CEF
WSAGetLastError.WS2_32 ref: 0000000180032CF5
WaitForMultipleObjects.KERNEL32 ref: 0000000180032D13
WSAGetOverlappedResult.WS2_32 ref: 0000000180032D46
WSAGetLastError.WS2_32 ref: 0000000180032D4C
CloseHandle.KERNEL32 ref: 0000000180032D5E
VirtualFree.KERNELBASE ref: 0000000180032D8F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateEventFreeHandleMultipleObjectsOverlappedRecvResultWait
String ID:
API String ID: 425432780-0
Opcode ID: ed0ee6d2a44e02ea4b8664fa35f5b3073364424dd04f963a90776adab9f5fb3d
Instruction ID: 80ddba25ada4c12ba25501bbea63694672ddceb4bf4905497e17ba262c6017a4
Opcode Fuzzy Hash: ed0ee6d2a44e02ea4b8664fa35f5b3073364424dd04f963a90776adab9f5fb3d
Instruction Fuzzy Hash: 19319532314B9482E766CF11F844B9BB7A5FB8DBD0F558125EA9903B24EF78C649CB01

Function 00000001800201A0 Relevance: 12.1, APIs: 8, Instructions: 109processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000000180020207
OpenProcessToken.ADVAPI32 ref: 0000000180020219
GetLastError.KERNEL32 ref: 0000000180020223
DuplicateTokenEx.ADVAPI32 ref: 0000000180020251
SetTokenInformation.ADVAPI32 ref: 000000018002026D
CreateEnvironmentBlock.USERENV ref: 0000000180020282
CreateProcessAsUserW.KERNEL32 ref: 00000001800202CA
CreateProcessAsUserW.ADVAPI32 ref: 0000000180020313

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process$CreateToken$User$BlockCurrentDuplicateEnvironmentErrorInformationLastOpen
String ID:
API String ID: 2924300727-0
Opcode ID: 16c3d07ec9acde65d2acdc43e71b5766c09dd73d369f4e5c742e79ed460f77ea
Instruction ID: 13034978c3ab2fb9f9047006cc71b10522f326b05abda6e4f2bcf0c65b74da56
Opcode Fuzzy Hash: 16c3d07ec9acde65d2acdc43e71b5766c09dd73d369f4e5c742e79ed460f77ea
Instruction Fuzzy Hash: 54513C32B04B858AE791CFA1E8807DD37B5F798788F509215AE8D67B18DF38C259D740

Function 00000001800205A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00000001800205FA
memset.NTDLL ref: 0000000180020615
lstrlenA.KERNEL32 ref: 000000018002061F
DeviceIoControl.KERNEL32 ref: 000000018002065A
CloseHandle.KERNEL32 ref: 0000000180020663

Strings

\\.\{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 00000001800205D8

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandlelstrlenmemset
String ID: \\.\{F8284233-48F4-4680-ADDD-F8284233}
API String ID: 2589617790-329358119
Opcode ID: a3b02f37b284e632ff8c0487233c56c7f58dd63dbc29904f1061be0df106d2bb
Instruction ID: 39cc20b0d125f0f5a721635b497ca12531b62917f9f5da8482c53947056ba4d5
Opcode Fuzzy Hash: a3b02f37b284e632ff8c0487233c56c7f58dd63dbc29904f1061be0df106d2bb
Instruction Fuzzy Hash: 26111F36218B8582E7A2CB54F8547CAB7A1F7CD784F548126EA8D43B58EF7DC648CB40

Function 0000000180027E20 Relevance: 4.5, APIs: 3, Instructions: 36pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32 ref: 0000000180027E5B
ConnectNamedPipe.KERNEL32 ref: 0000000180027E81
GetLastError.KERNEL32 ref: 0000000180027E8B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: NamedPipe$ConnectCreateErrorLast
String ID:
API String ID: 3851520242-0
Opcode ID: 5202d77b4504b343c25026c585eb62c568917b05fbb34b8c84aa117687ab1fdd
Instruction ID: 6bb7147edad98ca35960e2d476685a951813d0cf86fdcec3da0d9f41873a4748
Opcode Fuzzy Hash: 5202d77b4504b343c25026c585eb62c568917b05fbb34b8c84aa117687ab1fdd
Instruction Fuzzy Hash: CC017172304A4482D7518B16F940399B3A6EF8C7F4F148321FA79437A4EF78C9588B00

Function 000000018002D340 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 129
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000000018002D35F
GetCurrentProcess.KERNEL32 ref: 000000018002D379
K32GetModuleInformation.KERNEL32 ref: 000000018002D390
memset.NTDLL ref: 000000018002D3A8
GetSystemDirectoryW.KERNEL32 ref: 000000018002D3B7
lstrcatW.KERNEL32 ref: 000000018002D3D9
CreateFileW.KERNEL32 ref: 000000018002D406
CreateFileMappingW.KERNELBASE ref: 000000018002D42D
MapViewOfFile.KERNEL32 ref: 000000018002D457
VirtualProtect.KERNEL32 ref: 000000018002D4F2
memcpy.NTDLL ref: 000000018002D507
VirtualProtect.KERNEL32 ref: 000000018002D525

Strings

\ntdll.dll, xrefs: 000000018002D3C5
ntdll.dll, xrefs: 000000018002D34C
.text, xrefs: 000000018002D497

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: File$CreateModuleProtectVirtual$CurrentDirectoryHandleInformationMappingProcessSystemViewlstrcatmemcpymemset
String ID: .text$\ntdll.dll$ntdll.dll
API String ID: 992094507-3745270394
Opcode ID: 69df7cb737dd3e51747fbe578d65583dad7475f3be71c5b6a57530708f646bad
Instruction ID: 8bd433b68c42a9f1e6cbfa5eabf8f168c2bd36ca7b2ceeebe8acacb2e18380a2
Opcode Fuzzy Hash: 69df7cb737dd3e51747fbe578d65583dad7475f3be71c5b6a57530708f646bad
Instruction Fuzzy Hash: CB51A372714B9886EBB2CF11E4487DA73A1F78DB84F548115EA9A03B58EF78D648CB00

Function 000002D9773B0508 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000002D9773B0627
GetProcAddressForCaller.KERNELBASE ref: 000002D9773B06C1

Strings

RtlR, xrefs: 000002D9773B0558
RtlA, xrefs: 000002D9773B05A7
lloc, xrefs: 000002D9773B05AE
ateH, xrefs: 000002D9773B05B5
eAll, xrefs: 000002D9773B055F
l.dl, xrefs: 000002D9773B054B
eap, xrefs: 000002D9773B05BC
eHea, xrefs: 000002D9773B056D
ocat, xrefs: 000002D9773B0566
ntdl, xrefs: 000002D9773B0593
l.dl, xrefs: 000002D9773B059A
ntdl, xrefs: 000002D9773B0541

Memory Dump Source

Source File: 00000003.00000002.2976345173.000002D9773B0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D9773B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d9773b0000_svchost.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID: RtlA$RtlR$ateH$eAll$eHea$eap$l.dl$l.dl$lloc$ntdl$ntdl$ocat
API String ID: 4215043672-3994871222
Opcode ID: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction ID: 6cf1561fe823055220923bf2a0633dd9977d23f243ddabc523e0b5ac39feb914
Opcode Fuzzy Hash: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction Fuzzy Hash: C271E570614A098FFF58DF58D84ABA9B3E1FF94710F20411AF809DB295EB35DC828B85

Function 0000000180032930 Relevance: 18.1, APIs: 12, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 000000018003298C
GetLastError.KERNEL32 ref: 000000018003299B
getaddrinfo.WS2_32 ref: 00000001800329CA
WSAGetLastError.WS2_32 ref: 00000001800329D0
WSAGetLastError.WS2_32 ref: 00000001800329DA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$Socketgetaddrinfo
String ID:
API String ID: 1420131935-0
Opcode ID: 588b49dada4d53f0dea3a9a8b5e910038bbe1c700624a725d7562d88239a8e1e
Instruction ID: 97eaf826a2d0138a961afbfcea83aa305bd307fdac7432dd28095282f106e3e8
Opcode Fuzzy Hash: 588b49dada4d53f0dea3a9a8b5e910038bbe1c700624a725d7562d88239a8e1e
Instruction Fuzzy Hash: 8951AA72610B848AE721CFA1E8047ED37B5FB4C798F148225EE5923B98DF39C659DB01

Function 0000000180011E90 Relevance: 15.1, APIs: 10, Instructions: 91threadmemoryCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000180011EBF
IsBadReadPtr.KERNEL32 ref: 0000000180011EF4
EnterCriticalSection.KERNEL32 ref: 0000000180011F0F
VirtualAlloc.KERNEL32 ref: 0000000180011F25
LeaveCriticalSection.KERNEL32 ref: 0000000180011F49
GetNativeSystemInfo.KERNEL32 ref: 0000000180011F7B
CreateThread.KERNEL32 ref: 0000000180011FB2
CloseHandle.KERNEL32 ref: 0000000180011FC0
CreateThread.KERNEL32 ref: 0000000180011FDE
CloseHandle.KERNEL32 ref: 0000000180011FEC

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CreateThread$CloseCriticalHandleSection$AllocEnterInfoLeaveNativeReadSystemVirtual
String ID:
API String ID: 3571750651-0
Opcode ID: 1363fd4b51c054286b4f9f0578cb1f11da93afc1d0dca13003e3c5ae9259af37
Instruction ID: 4cfd0974d185cad5ebef8526de560f1575828462ff0e0d72f99396545f92925d
Opcode Fuzzy Hash: 1363fd4b51c054286b4f9f0578cb1f11da93afc1d0dca13003e3c5ae9259af37
Instruction Fuzzy Hash: FF418132215F8586DBA5CF21E8043D973A5FB88BC5F55C629EE9A03754EF38C699C700

Function 000000018002D7D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 000000018002D820
CoCreateInstance.COMBASE ref: 000000018002D845
CoUninitialize.OLE32 ref: 000000018002D86E
SysAllocString.OLEAUT32 ref: 000000018002D886
SysFreeString.OLEAUT32 ref: 000000018002D8A0
CoUninitialize.COMBASE ref: 000000018002D8BA

Strings

Block All Outbound, xrefs: 000000018002D87A

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: StringUninitialize$AllocCreateFreeInitializeInstance
String ID: Block All Outbound
API String ID: 4211003860-2946277995
Opcode ID: 295a4f62168f5a6f5119dea70b951de674f26a9291ccd047ab80a2b95cdfc5e8
Instruction ID: eff029c1c001f8c9a6eb9d0a089e59113f9457e89b19bb553c66083ed83c8d7d
Opcode Fuzzy Hash: 295a4f62168f5a6f5119dea70b951de674f26a9291ccd047ab80a2b95cdfc5e8
Instruction Fuzzy Hash: FF31E876A00B44CAEB419F35DC4439C77B0F798B88F148926EA1D47B24DF34C669CB50

Function 000000018001F560 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001F59E
memcpy.NTDLL ref: 000000018001F5BA
VirtualFree.KERNEL32 ref: 000000018001F6AF
VirtualFree.KERNEL32 ref: 000000018001F6CF
VirtualFree.KERNELBASE ref: 000000018001F6E4

Strings

Z, xrefs: 000000018001F5C4
M, xrefs: 000000018001F5BF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Allocmemcpy
String ID: M$Z
API String ID: 2981101286-4250246861
Opcode ID: ec89bfb9e9449c1fd831b7383df3345bb054ba2f3537415f9bda132d024155c3
Instruction ID: cf809e79dc0892ad841741375ddc97645b6d00976cb6bac53320efcc6f1ca8b7
Opcode Fuzzy Hash: ec89bfb9e9449c1fd831b7383df3345bb054ba2f3537415f9bda132d024155c3
Instruction Fuzzy Hash: 8E41E232B10FC581FBA28B3DD4103B96751A7DABD4F24C315FA96563A5EF29C6498300

Function 0000000180032B20 Relevance: 10.6, APIs: 7, Instructions: 75networkCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 0000000180032B75
WSASend.WS2_32 ref: 0000000180032BBB
WSAGetLastError.WS2_32 ref: 0000000180032BC1
WaitForMultipleObjects.KERNEL32 ref: 0000000180032BEA
WSAGetLastError.WS2_32 ref: 0000000180032C23
CloseHandle.KERNEL32 ref: 0000000180032C35

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandleMultipleObjectsSendWait
String ID:
API String ID: 248740593-0
Opcode ID: 3d6319584adb544b58c2476fc8f8a49f60c538f7d4a53f43cd1c7f5bcbecd3ed
Instruction ID: b6522aaf7b9705b3331a087d41d1cdb7034589dd00909351bf40176251c1a654
Opcode Fuzzy Hash: 3d6319584adb544b58c2476fc8f8a49f60c538f7d4a53f43cd1c7f5bcbecd3ed
Instruction Fuzzy Hash: 6F319932618B8486E7628F64F8407DEB361FB88794F148226FB9843B54DF7CC698DB00

Function 0000000180027FA0 Relevance: 10.6, APIs: 7, Instructions: 71memoryfilepipeCOMMON

Download Yara Rule

APIs

PeekNamedPipe.KERNEL32 ref: 0000000180027FCF
VirtualAlloc.KERNEL32 ref: 0000000180027FFC
ReadFile.KERNEL32 ref: 0000000180028024
VirtualFree.KERNELBASE ref: 0000000180028047
FlushFileBuffers.KERNEL32 ref: 0000000180028051
GetLastError.KERNEL32 ref: 000000018002805B
GetLastError.KERNEL32 ref: 000000018002807D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorFileLastVirtual$AllocBuffersFlushFreeNamedPeekPipeRead
String ID:
API String ID: 1637252459-0
Opcode ID: 7caf67ba2c754cc6c7e94bd91c5a8169c82a3c47d0c13808e784c8b6e6b47a5f
Instruction ID: 84c90537bd11c363a65bf3c1b8adbf25634bbd752cf977323eecfa1631f8ab92
Opcode Fuzzy Hash: 7caf67ba2c754cc6c7e94bd91c5a8169c82a3c47d0c13808e784c8b6e6b47a5f
Instruction Fuzzy Hash: 58215336304B5486E7A28F66F84079AB3A1FB8CBE5F048124EE5D43B54EF78D5999B00

Function 0000000180017E90 Relevance: 10.6, APIs: 7, Instructions: 69threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000180017EA0
ProcessIdToSessionId.KERNEL32 ref: 0000000180017EAD
WTSEnumerateSessionsW.WTSAPI32 ref: 0000000180017EDC
WTSQuerySessionInformationW.WTSAPI32 ref: 0000000180017F2D
WTSFreeMemory.WTSAPI32 ref: 0000000180017F52

Part of subcall function 00000001800176E0: memset.NTDLL ref: 0000000180017709
Part of subcall function 00000001800176E0: GetSystemDirectoryW.KERNEL32 ref: 000000018001771A
Part of subcall function 00000001800176E0: GetLastError.KERNEL32 ref: 0000000180017724
Part of subcall function 00000001800176E0: lstrcatW.KERNEL32 ref: 00000001800178FB

WTSFreeMemory.WTSAPI32 ref: 0000000180017F6A
CreateThread.KERNEL32 ref: 0000000180017F8C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FreeMemoryProcessSession$CreateCurrentDirectoryEnumerateErrorInformationLastQuerySessionsSystemThreadlstrcatmemset
String ID:
API String ID: 3188162108-0
Opcode ID: a0f1e4af9b35d422d03ebaa43e648843dcc74811eb2673a9a5bc5e68af15dc2a
Instruction ID: 1bc6d48ed340dc3225d4b568e8b82601facd276a6dbc3db6c5582e2979f78f1e
Opcode Fuzzy Hash: a0f1e4af9b35d422d03ebaa43e648843dcc74811eb2673a9a5bc5e68af15dc2a
Instruction Fuzzy Hash: FD310136218B4487E7918F65E84079E77B1F788780F54912AFB8E43B68DF38D659CB00

Function 0000000180027EB0 Relevance: 9.1, APIs: 6, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000000180027ED0
CreateFileW.KERNEL32 ref: 0000000180027EFF
GetLastError.KERNEL32 ref: 0000000180027F10
GetTickCount.KERNEL32 ref: 0000000180027F24
SleepEx.KERNEL32 ref: 0000000180027F38
CreateFileW.KERNEL32 ref: 0000000180027F62

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CountCreateFileTick$ErrorLastSleep
String ID:
API String ID: 2478964991-0
Opcode ID: 44fd06d3c223e048c4d0489ead7cd8fe85b8e69849f9c6ee32731d4873113aa6
Instruction ID: 0d24daabcc90d10d39f6b18fddba5017850f092dcdace4eb30a0eea9189b84cf
Opcode Fuzzy Hash: 44fd06d3c223e048c4d0489ead7cd8fe85b8e69849f9c6ee32731d4873113aa6
Instruction Fuzzy Hash: 91216F31204B4486E3A19F20B95435A77E6F78C7F4F144725FAAA53BD8CF38CA899B41

Function 0000000180026F00 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 0000000180026F0E
EnterCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F2B
VirtualFree.KERNELBASE(?,?,00000000,0000000180011E65), ref: 0000000180026F4F
LeaveCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F66
DeleteCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F70
VirtualFree.KERNELBASE(?,?,00000000,0000000180011E65), ref: 0000000180026F81

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$FreeVirtual$DeleteEnterLeaveRead
String ID:
API String ID: 4123369522-0
Opcode ID: aa19078ca0c6afd7a821f8a8ac8a84ee5709a37a32491cc2cb8c739b25d204c7
Instruction ID: ceee25a761f9f408724335fd3bce8a2bff4b5a7f466412d899da667b3da1218d
Opcode Fuzzy Hash: aa19078ca0c6afd7a821f8a8ac8a84ee5709a37a32491cc2cb8c739b25d204c7
Instruction Fuzzy Hash: C4014C31714B4582EBC68F12EA543996362FB8CBC5F58C124EF6A07B64EF38C2698700

Function 0000000180013180 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 00000001800131D5
VirtualAlloc.KERNEL32 ref: 00000001800131F2
memcpy.NTDLL ref: 0000000180013221
memcpy.NTDLL ref: 0000000180013266

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy$AllocVirtualceil
String ID:
API String ID: 311976409-0
Opcode ID: ed14ec51c383a9a13ba0ce0240a1051b4facac114c8e2550c0a0b869aba092f1
Instruction ID: 533183b41e036c783a1da9afa5a9cdf264f69900d761d72cd9a8306f1bb4b55c
Opcode Fuzzy Hash: ed14ec51c383a9a13ba0ce0240a1051b4facac114c8e2550c0a0b869aba092f1
Instruction Fuzzy Hash: CF31A232305A9496EB8A8F56E951399B3A0F78CBC0F10C429FB1A93B44DF38D57A8700

Function 000000018002C950 Relevance: 7.6, APIs: 5, Instructions: 68processCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018002C974
CreateToolhelp32Snapshot.KERNEL32 ref: 000000018002C97E
Process32FirstW.KERNEL32 ref: 000000018002C9A1
Process32NextW.KERNEL32 ref: 000000018002C9BE
CloseHandle.KERNEL32 ref: 000000018002CA41

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: 44c899de9843c07d997477ea65153a2f26deeedfdeec94036e1e1bc8e67b5a7d
Instruction ID: 873e7e7ddb6e82f6207e00a8e9629a882d6d6560c0b57f88a74779bcce2b5edf
Opcode Fuzzy Hash: 44c899de9843c07d997477ea65153a2f26deeedfdeec94036e1e1bc8e67b5a7d
Instruction Fuzzy Hash: F6315C36A08B8982E752CB28D5083AD7360F79DB98F19E315EF9902256EF34D2C8C700

Function 0000000180012FC0 Relevance: 6.1, APIs: 4, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 0000000180012FF0
VirtualAlloc.KERNEL32 ref: 0000000180013022
memcpy.NTDLL ref: 0000000180013066
VirtualFree.KERNELBASE ref: 0000000180013076

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocFreeceilmemcpy
String ID:
API String ID: 941304502-0
Opcode ID: b42a51ca5293a3dee87d5691d064886e3cec9dc4675c393a7935541609b8591d
Instruction ID: bd9c6ff85a7bdc568ee300e77c50e526046de82073029a9ad3e89b39f8e5a581
Opcode Fuzzy Hash: b42a51ca5293a3dee87d5691d064886e3cec9dc4675c393a7935541609b8591d
Instruction Fuzzy Hash: FC210832714A448AEB869F3AF450399A3A1EB8CFC4F18C125FA4D83749DE38CD958B40

Function 00000001800396EC Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0000000180039801
malloc.MSVCRT ref: 0000000180039879

Strings

X, xrefs: 000000018003973B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: malloc
String ID: X
API String ID: 2803490479-3081909835
Opcode ID: 954f3e60ac22a0164332870d1af20d99b01dc15cbae893ab9263c6fd20abe241
Instruction ID: 03aa7ddfb520b6f23ee5394375c5d4b88d09d0ef85018062d385f97ca1f5de20
Opcode Fuzzy Hash: 954f3e60ac22a0164332870d1af20d99b01dc15cbae893ab9263c6fd20abe241
Instruction Fuzzy Hash: 3671A332106B8487D7A7CF6AE44079E77E8F348B94F12852AEB9A43790DF38D559CB00

Function 000002D9773B0345 Relevance: 1.4, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000002D9773B0395

Memory Dump Source

Source File: 00000003.00000002.2976345173.000002D9773B0000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002D9773B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d9773b0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: 0af41c1d1e5879fe8c70f66feb7f63f33902ba37f79adcaa3f536e281b6807ca
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: A531A27165860487EB5CDA1CF885A68B3D0F755304B20115DF58BCB197EA2BEC438685

Function 0000000180037CBC Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,00000001,000000018003636C), ref: 0000000180037C61

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 980fb9e1d4df5c01db13537fe2d87ee938b67c443b914f2420d5be5b7a1b2b4d
Instruction ID: 73f813260b3a99a6df67f7a2f834371fb8fea02c8dcec4733d69e86dcb6db410
Opcode Fuzzy Hash: 980fb9e1d4df5c01db13537fe2d87ee938b67c443b914f2420d5be5b7a1b2b4d
Instruction Fuzzy Hash: F421B772320A4886FBF7CB15D4503AE63A4E74CBD8F26A128EA0D47796DF35CA858300

Function 0000000180039638 Relevance: 1.3, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,00000000,?,0000000180039992), ref: 000000018003967F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 098f93fbeb42c69fd8f32277914b2ae68ecf3252c39681ab5271f7009817d335
Instruction ID: 0a03297a77ecdba31d11b4f7a20f53efe35493dba5e5a446ec0584fdd327e906
Opcode Fuzzy Hash: 098f93fbeb42c69fd8f32277914b2ae68ecf3252c39681ab5271f7009817d335
Instruction Fuzzy Hash: 43213276301A0886DB65CF1AD18520EB3B1F788FD0B068122EF5D47B18DF32D9A4C340

Non-executed Functions

Function 0000000180029300 Relevance: 98.4, APIs: 53, Strings: 3, Instructions: 425stringprocessmemoryCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 0000000180029315
memset.NTDLL ref: 0000000180029337
memset.NTDLL ref: 000000018002934B
GetCurrentProcess.KERNEL32 ref: 000000018002937A
OpenProcessToken.ADVAPI32 ref: 000000018002938D
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800293B5
AdjustTokenPrivileges.ADVAPI32 ref: 00000001800293D7
GetLastError.KERNEL32 ref: 00000001800293DD
CloseHandle.KERNEL32 ref: 00000001800293F3
CreateToolhelp32Snapshot.KERNEL32 ref: 00000001800293FE
Process32FirstW.KERNEL32 ref: 0000000180029437
OpenProcess.KERNEL32 ref: 000000018002945B
memset.NTDLL ref: 0000000180029487
lstrcpyW.KERNEL32 ref: 0000000180029497
GetPriorityClass.KERNEL32 ref: 00000001800294A9
memset.NTDLL ref: 00000001800294D8
memset.NTDLL ref: 00000001800294EC
OpenProcessToken.ADVAPI32 ref: 0000000180029507
GetTokenInformation.ADVAPI32 ref: 0000000180029539
GlobalAlloc.KERNEL32 ref: 0000000180029554
GetTokenInformation.ADVAPI32 ref: 0000000180029585
LookupAccountSidW.ADVAPI32 ref: 00000001800295E1
LookupAccountSidW.ADVAPI32 ref: 000000018002963E
lstrcpyW.KERNEL32 ref: 0000000180029656
GlobalFree.KERNEL32 ref: 000000018002965F
CloseHandle.KERNEL32 ref: 000000018002966F
ProcessIdToSessionId.KERNEL32 ref: 000000018002967F
K32GetProcessMemoryInfo.KERNEL32 ref: 00000001800296B3
K32EnumProcessModules.KERNEL32 ref: 00000001800296E6
K32GetProcessImageFileNameW.KERNEL32 ref: 00000001800296FC
GetLogicalDriveStringsW.KERNEL32 ref: 000000018002971E
QueryDosDeviceW.KERNEL32 ref: 0000000180029774
lstrlenW.KERNEL32 ref: 0000000180029785
wcsncmp.NTDLL ref: 000000018002979F
lstrcpyW.KERNEL32 ref: 00000001800297D5
CreateFileW.KERNEL32 ref: 00000001800297FF
GetFileSize.KERNEL32 ref: 0000000180029813
CloseHandle.KERNEL32 ref: 000000018002982A
lstrcpyW.KERNEL32 ref: 000000018002983E
lstrcatW.KERNEL32 ref: 0000000180029856
CloseHandle.KERNEL32 ref: 0000000180029885
Process32NextW.KERNEL32 ref: 0000000180029892
GetCurrentProcess.KERNEL32 ref: 00000001800298B8
OpenProcessToken.ADVAPI32 ref: 00000001800298CD
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800298F1
AdjustTokenPrivileges.ADVAPI32 ref: 0000000180029915
GetLastError.KERNEL32 ref: 000000018002991B
CloseHandle.KERNEL32 ref: 0000000180029931
CloseHandle.KERNEL32 ref: 000000018002993F
VirtualFree.KERNEL32 ref: 00000001800299D9
VirtualFree.KERNEL32 ref: 0000000180029A03
VirtualFree.KERNEL32 ref: 0000000180029A21
VirtualFree.KERNEL32 ref: 0000000180029A4B

Strings

SeDebugPrivilege, xrefs: 00000001800293A4, 00000001800298E4
unknown, xrefs: 0000000180029706
H, xrefs: 00000001800296A3

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process$Token$CloseHandle$Freememset$LookupOpenVirtuallstrcpy$File$AccountAdjustCreateCurrentErrorGlobalInformationLastPrivilegePrivilegesProcess32Value$AllocClassDeviceDriveEnumFirstImageInfoLogicalMemoryModulesNameNextPriorityQuerySessionSizeSnapshotStringsToolhelp32__chkstklstrcatlstrlenwcsncmp
String ID: H$SeDebugPrivilege$unknown
API String ID: 976869081-3969872153
Opcode ID: 6a6d9660973f71720e87b200dc9c58f4d9867713f3a693197156d62844a92ba2
Instruction ID: ab662803f13f216cf9587554947d7041853fde5cbf24b98bf2e2890ab3468709
Opcode Fuzzy Hash: 6a6d9660973f71720e87b200dc9c58f4d9867713f3a693197156d62844a92ba2
Instruction Fuzzy Hash: A8226232601B8586EBA2CF61EC547DD73A1FB8DBD8F508215EA5947A98EF38C749C700

Function 0000000180027290 Relevance: 72.1, APIs: 38, Strings: 3, Instructions: 334stringnetworkmemoryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00000001800272B9
lstrlenW.KERNEL32 ref: 00000001800272D6
lstrlenW.KERNEL32 ref: 00000001800272E9
GetCurrentProcess.KERNEL32 ref: 00000001800272FF
OpenProcessToken.ADVAPI32 ref: 0000000180027313
LookupPrivilegeValueW.ADVAPI32 ref: 000000018002733B
AdjustTokenPrivileges.ADVAPI32 ref: 000000018002735D
GetLastError.KERNEL32 ref: 0000000180027363
CloseHandle.KERNEL32 ref: 0000000180027379
GetExtendedTcpTable.IPHLPAPI ref: 000000018002739F
VirtualAlloc.KERNEL32 ref: 00000001800273B7
GetExtendedTcpTable.IPHLPAPI ref: 00000001800273EA
VirtualFree.KERNEL32 ref: 00000001800273FF
memset.NTDLL ref: 000000018002747F
lstrlenW.KERNEL32 ref: 000000018002749A
memset.NTDLL ref: 0000000180027519
inet_ntoa.WS2_32 ref: 0000000180027521
lstrcpyA.KERNEL32 ref: 000000018002752E
lstrlenA.KERNEL32 ref: 0000000180027538
htons.WS2_32 ref: 0000000180027567
memset.NTDLL ref: 00000001800275A6
inet_ntoa.WS2_32 ref: 00000001800275AE
lstrcpyA.KERNEL32 ref: 00000001800275BE
lstrlenA.KERNEL32 ref: 00000001800275CB
htons.WS2_32 ref: 00000001800275FD
memset.NTDLL ref: 000000018002762C
lstrlenW.KERNEL32 ref: 0000000180027647
VirtualFree.KERNEL32 ref: 000000018002769E
GetCurrentProcess.KERNEL32 ref: 00000001800276B4
OpenProcessToken.ADVAPI32 ref: 00000001800276C9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800276EE
AdjustTokenPrivileges.ADVAPI32 ref: 0000000180027712
GetLastError.KERNEL32 ref: 0000000180027718
CloseHandle.KERNEL32 ref: 000000018002772E
VirtualFree.KERNEL32 ref: 00000001800277D7
VirtualFree.KERNEL32 ref: 0000000180027801
VirtualFree.KERNEL32 ref: 000000018002781F
VirtualFree.KERNEL32 ref: 0000000180027849

Strings

TCP, xrefs: 00000001800272C1, 0000000180027500
System, xrefs: 00000001800272DE
SeDebugPrivilege, xrefs: 000000018002732A, 00000001800276E0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Freelstrlen$memset$ProcessToken$AdjustCloseCurrentErrorExtendedHandleLastLookupOpenPrivilegePrivilegesTableValuehtonsinet_ntoalstrcpy$Alloc
String ID: SeDebugPrivilege$System$TCP
API String ID: 2139412910-32757284
Opcode ID: 384d3e7db38810127ba93bf50e6bd7a6e267d232edd2a4c281dac7082b692298
Instruction ID: 7145bea9de9cfa6b5ae00cd6a39de3e2ecb675f5dcbe9c5d5bc2232063b88fed
Opcode Fuzzy Hash: 384d3e7db38810127ba93bf50e6bd7a6e267d232edd2a4c281dac7082b692298
Instruction Fuzzy Hash: ABF19176310B8486EBA5DF25E8047DE77A1FB8DB98F508215EA5A47B58DF38C24CCB40

Function 0000000180016630 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 267stringfileprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001668C
VirtualFree.KERNEL32 ref: 00000001800166B6
VirtualAlloc.KERNEL32 ref: 000000018001671B
VirtualFree.KERNEL32 ref: 000000018001674D
VirtualFree.KERNEL32 ref: 0000000180016777
memcpy.NTDLL ref: 000000018001679D
memcpy.NTDLL ref: 0000000180016848
memset.NTDLL ref: 0000000180016859
memset.NTDLL ref: 000000018001686D
lstrcatW.KERNEL32 ref: 000000018001687D
lstrcatW.KERNEL32 ref: 000000018001688E
lstrcatW.KERNEL32 ref: 000000018001689F
lstrcatW.KERNEL32 ref: 00000001800168B0
lstrcatW.KERNEL32 ref: 00000001800168C4
MoveFileW.KERNEL32 ref: 00000001800168D5
CreateFileW.KERNEL32 ref: 0000000180016909
GetLastError.KERNEL32 ref: 0000000180016918
WriteFile.KERNEL32 ref: 0000000180016937
GetLastError.KERNEL32 ref: 0000000180016941
CloseHandle.KERNEL32 ref: 0000000180016951
MoveFileW.KERNEL32 ref: 0000000180016966
VirtualFree.KERNEL32 ref: 0000000180016977
CloseHandle.KERNEL32 ref: 000000018001698A
DeleteFileW.KERNEL32 ref: 0000000180016997
VirtualFree.KERNEL32 ref: 00000001800169A8
memset.NTDLL ref: 00000001800169FD
lstrcatW.KERNEL32 ref: 0000000180016A10
lstrcatW.KERNEL32 ref: 0000000180016A24
lstrcatW.KERNEL32 ref: 0000000180016A38
CreateProcessW.KERNEL32 ref: 0000000180016A78
GetLastError.KERNEL32 ref: 0000000180016A82
CloseHandle.KERNEL32 ref: 0000000180016A92
CloseHandle.KERNEL32 ref: 0000000180016AA7
GetCurrentProcess.KERNEL32 ref: 0000000180016AB2
TerminateProcess.KERNEL32 ref: 0000000180016AC0

Strings

18.166.193.8, xrefs: 0000000180016790
h, xrefs: 00000001800169C7
.bak, xrefs: 00000001800168B6
C:\Program Files\Windows Mail, xrefs: 0000000180016872, 0000000180016A02
ParphaCrashReport64.exe, xrefs: 0000000180016A2A
arphaDump64.dll, xrefs: 0000000180016894

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$lstrcat$AllocCriticalFreeSection$File$CloseHandle$EnterErrorLastProcessReadmemset$CreateLeaveMovememcpy$CurrentDeleteInitializeTerminateWrite
String ID: .bak$18.166.193.8$C:\Program Files\Windows Mail$ParphaCrashReport64.exe$arphaDump64.dll$h
API String ID: 2211108363-3529859090
Opcode ID: f313ddb08190d7dbab8043538d75833c288af8143399ff6012ff730f18fde2a1
Instruction ID: 6088b806c5e49e4d302fa251c9ee534a615dc6211a463a61944008de05cf0c31
Opcode Fuzzy Hash: f313ddb08190d7dbab8043538d75833c288af8143399ff6012ff730f18fde2a1
Instruction Fuzzy Hash: 66D19332610F8686EBA2CF35DC543E92361FB8DB88F14D215EA4A57A64EF38C359C700

Function 0000000180027870 Relevance: 66.8, APIs: 34, Strings: 4, Instructions: 324stringmemorynetworkCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0000000180027899
lstrlenW.KERNEL32 ref: 00000001800278B6
lstrlenW.KERNEL32 ref: 00000001800278C9
GetCurrentProcess.KERNEL32 ref: 00000001800278DF
OpenProcessToken.ADVAPI32 ref: 00000001800278F3
LookupPrivilegeValueW.ADVAPI32 ref: 000000018002791B
AdjustTokenPrivileges.ADVAPI32 ref: 000000018002793D
GetLastError.KERNEL32 ref: 0000000180027943
CloseHandle.KERNEL32 ref: 0000000180027959
GetExtendedUdpTable.IPHLPAPI ref: 000000018002797F
VirtualAlloc.KERNEL32 ref: 0000000180027997
GetExtendedUdpTable.IPHLPAPI ref: 00000001800279CA
VirtualFree.KERNEL32 ref: 00000001800279DF
memset.NTDLL ref: 0000000180027A5F
lstrlenW.KERNEL32 ref: 0000000180027A7A
memset.NTDLL ref: 0000000180027AF9
inet_ntoa.WS2_32 ref: 0000000180027B01
lstrcpyA.KERNEL32 ref: 0000000180027B0E
lstrlenA.KERNEL32 ref: 0000000180027B18
htons.WS2_32 ref: 0000000180027B47
lstrlenA.KERNEL32 ref: 0000000180027B84
memset.NTDLL ref: 0000000180027BDB
lstrlenW.KERNEL32 ref: 0000000180027BF6
VirtualFree.KERNEL32 ref: 0000000180027C4D
GetCurrentProcess.KERNEL32 ref: 0000000180027C63
OpenProcessToken.ADVAPI32 ref: 0000000180027C78
LookupPrivilegeValueW.ADVAPI32 ref: 0000000180027C9D
AdjustTokenPrivileges.ADVAPI32 ref: 0000000180027CC1
GetLastError.KERNEL32 ref: 0000000180027CC7
CloseHandle.KERNEL32 ref: 0000000180027CDD
VirtualFree.KERNEL32 ref: 0000000180027D84
VirtualFree.KERNEL32 ref: 0000000180027DAE
VirtualFree.KERNEL32 ref: 0000000180027DCC
VirtualFree.KERNEL32 ref: 0000000180027DF6

Part of subcall function 0000000180026F00: IsBadReadPtr.KERNEL32 ref: 0000000180026F0E
Part of subcall function 0000000180026F00: EnterCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F2B
Part of subcall function 0000000180026F00: VirtualFree.KERNELBASE(?,?,00000000,0000000180011E65), ref: 0000000180026F4F
Part of subcall function 0000000180026F00: LeaveCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F66
Part of subcall function 0000000180026F00: DeleteCriticalSection.KERNEL32(?,?,00000000,0000000180011E65), ref: 0000000180026F70
Part of subcall function 0000000180026F00: VirtualFree.KERNELBASE(?,?,00000000,0000000180011E65), ref: 0000000180026F81

Strings

UDP, xrefs: 00000001800278A1, 0000000180027AE0
System, xrefs: 00000001800278BE
SeDebugPrivilege, xrefs: 000000018002790A, 0000000180027C8F
0.0.0.0, xrefs: 0000000180027B7D, 0000000180027BA4

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$lstrlen$ProcessTokenmemset$CriticalSection$AdjustCloseCurrentErrorExtendedHandleLastLookupOpenPrivilegePrivilegesTableValue$AllocDeleteEnterLeaveReadhtonsinet_ntoalstrcpy
String ID: 0.0.0.0$SeDebugPrivilege$System$UDP
API String ID: 3759433425-459619966
Opcode ID: 2bc8028b07d01d9ba69e09a3802a839e12856a2c9f2d2d692c2ea6f1d234ecb0
Instruction ID: e6e0c968282d8882f094be4972add8fe0f252a94b0e244f875fba5a0254720a6
Opcode Fuzzy Hash: 2bc8028b07d01d9ba69e09a3802a839e12856a2c9f2d2d692c2ea6f1d234ecb0
Instruction Fuzzy Hash: 99F18C76310B8486EBA1DF22E8547DE77A1FB8DB98F508115EA5A47B58DF39C24CCB00

Function 0000000180028880 Relevance: 63.3, APIs: 26, Strings: 10, Instructions: 311stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800288D0
VirtualFree.KERNEL32 ref: 00000001800288FA
VirtualAlloc.KERNEL32 ref: 0000000180028949
IsBadReadPtr.KERNEL32 ref: 00000001800289AB
EnterCriticalSection.KERNEL32 ref: 00000001800289D3
LeaveCriticalSection.KERNEL32 ref: 00000001800289F6
IsBadReadPtr.KERNEL32 ref: 0000000180028A5C
VirtualAlloc.KERNEL32 ref: 0000000180028A92
VirtualFree.KERNEL32 ref: 0000000180028AC1
VirtualFree.KERNEL32 ref: 0000000180028AEB
memset.NTDLL ref: 0000000180028B00
lstrcatA.KERNEL32 ref: 0000000180028B21
LeaveCriticalSection.KERNEL32 ref: 0000000180028B3E
lstrcatW.KERNEL32 ref: 0000000180028B66
memcpy.NTDLL ref: 0000000180028C20
memset.NTDLL ref: 0000000180028C46
GetWindowsDirectoryW.KERNEL32 ref: 0000000180028C5D
GetLastError.KERNEL32 ref: 0000000180028C67
lstrcatW.KERNEL32 ref: 0000000180028C78
GetSystemDirectoryW.KERNEL32 ref: 0000000180028C90
GetLastError.KERNEL32 ref: 0000000180028C9A
lstrcatW.KERNEL32 ref: 0000000180028D1D
lstrcatW.KERNEL32 ref: 0000000180028D2E
lstrcatW.KERNEL32 ref: 0000000180028D3B
VirtualFree.KERNEL32 ref: 0000000180028D8B
VirtualFree.KERNEL32 ref: 0000000180028D9C

Strings

TCP, xrefs: 0000000180028B32
\syswow64, xrefs: 0000000180028C6D
HTTP, xrefs: 0000000180028B58
UDP, xrefs: 0000000180028B4D
f:^:, xrefs: 0000000180028CB8
V:V:, xrefs: 0000000180028CB0
B:_:, xrefs: 0000000180028CDB
I:N:, xrefs: 0000000180028CCB
:, xrefs: 0000000180028CE3
R:U:, xrefs: 0000000180028CBD

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Freelstrcat$Read$EnterLeave$DirectoryErrorLastmemset$InitializeSystemWindowsmemcpy
String ID: :$B:_:$HTTP$I:N:$R:U:$TCP$UDP$V:V:$\syswow64$f:^:
API String ID: 1846020110-2823427824
Opcode ID: e9a6c1f68d46521105151d4f1ece7a9abb65f008cd8859d4eff4fac00e1c520e
Instruction ID: dd258f5890ecb2e44b34d13f94b0b07d327da43a26d89795a623b7b3c6110883
Opcode Fuzzy Hash: e9a6c1f68d46521105151d4f1ece7a9abb65f008cd8859d4eff4fac00e1c520e
Instruction Fuzzy Hash: 52E1BD32711B8886EBA6CF26D8547ED63A1FB8DBC4F54C211EE4A47A54EF38D648D700

Function 000000018001E550 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 289memorystringfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001E58B
GetWindowsDirectoryW.KERNEL32 ref: 000000018001E599
GetLastError.KERNEL32 ref: 000000018001E5A3
lstrcatW.KERNEL32 ref: 000000018001E5D4
CreateFileW.KERNEL32 ref: 000000018001E643
GetLastError.KERNEL32 ref: 000000018001E652
WriteFile.KERNEL32 ref: 000000018001E66F
GetLastError.KERNEL32 ref: 000000018001E679
CloseHandle.KERNEL32 ref: 000000018001E687
VirtualAlloc.KERNEL32 ref: 000000018001E6DD
VirtualAlloc.KERNEL32 ref: 000000018001E795
lstrlenW.KERNEL32 ref: 000000018001E7C4
lstrlenW.KERNEL32 ref: 000000018001E7F2
VirtualFree.KERNEL32 ref: 000000018001E814
VirtualAlloc.KERNEL32 ref: 000000018001E840
VirtualAlloc.KERNEL32 ref: 000000018001E875
wsprintfW.USER32 ref: 000000018001E897
VirtualAlloc.KERNEL32 ref: 000000018001E8EF
lstrcatW.KERNEL32 ref: 000000018001E907
PathRemoveFileSpecW.SHLWAPI ref: 000000018001E910
CreateProcessW.KERNEL32 ref: 000000018001E94C
CloseHandle.KERNEL32 ref: 000000018001E95C
CloseHandle.KERNEL32 ref: 000000018001E971
VirtualFree.KERNEL32 ref: 000000018001E987
VirtualFree.KERNEL32 ref: 000000018001E998
VirtualFree.KERNEL32 ref: 000000018001E9A9
VirtualFree.KERNEL32 ref: 000000018001E9BA
VirtualFree.KERNEL32 ref: 000000018001E9D0
VirtualFree.KERNEL32 ref: 000000018001E9FA

Strings

h, xrefs: 000000018001E8DE
\rar.exe, xrefs: 000000018001E5B1
rar.exe a "%s" %s -m5, xrefs: 000000018001E88A

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$CloseErrorFileHandleLast$Createlstrcatlstrlen$DirectoryPathProcessRemoveSpecWindowsWritememsetwsprintf
String ID: \rar.exe$h$rar.exe a "%s" %s -m5
API String ID: 460989278-1571478729
Opcode ID: d6fa1d8524bb85152559a8366e61b1b4fff8d11480b6a2d1cb8cd4eedd6e302b
Instruction ID: c03e5a34a069fda9d454a07d238a75463c5969b9b5c5cf97840925747e468bcd
Opcode Fuzzy Hash: d6fa1d8524bb85152559a8366e61b1b4fff8d11480b6a2d1cb8cd4eedd6e302b
Instruction Fuzzy Hash: D5D17132310B9586EBA58F22E8587DD73A1FB8DBC4F548225EE5A47B58DF38C248C700

Function 000000018002F890 Relevance: 50.0, APIs: 33, Instructions: 451servicestringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

OpenSCManagerW.ADVAPI32 ref: 000000018002F8DA
EnumServicesStatusW.ADVAPI32 ref: 000000018002F91C
LocalAlloc.KERNEL32 ref: 000000018002F92D
EnumServicesStatusW.ADVAPI32 ref: 000000018002F986
memset.NTDLL ref: 000000018002F9AC
OpenServiceW.ADVAPI32 ref: 000000018002F9C9
lstrlenW.KERNEL32 ref: 000000018002F9E0
memcpy.NTDLL ref: 000000018002FA85
lstrlenW.KERNEL32 ref: 000000018002FA8F
memcpy.NTDLL ref: 000000018002FB12
VirtualAlloc.KERNEL32 ref: 000000018002FB28
QueryServiceConfig2W.ADVAPI32 ref: 000000018002FB57
lstrlenW.KERNEL32 ref: 000000018002FB69
memcpy.NTDLL ref: 000000018002FBEF
CloseServiceHandle.ADVAPI32 ref: 000000018002FF40
LocalFree.KERNEL32 ref: 000000018002FF49
VirtualFree.KERNEL32 ref: 000000018002FFF5
VirtualFree.KERNEL32 ref: 000000018003001F
VirtualFree.KERNEL32 ref: 0000000180030035
VirtualFree.KERNEL32 ref: 000000018003005F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalSection$Free$EnterReadServicelstrlenmemcpy$EnumLeaveLocalOpenServicesStatus$CloseConfig2HandleInitializeManagerQuerymemset
String ID:
API String ID: 1976463032-0
Opcode ID: e31869551b353607aec46271203f30b5e22ed9872d805ff8829a815e3cabd60d
Instruction ID: 07ba33366e91f24cf35d8fcc6b8bdfd4e23b1436d3e6e41a5118040a433c0547
Opcode Fuzzy Hash: e31869551b353607aec46271203f30b5e22ed9872d805ff8829a815e3cabd60d
Instruction Fuzzy Hash: 7A327F72A14BC886E752CF29D9447ED3361FB99B88F14E215EF8916A16EF35D2D8C300

Function 0000000180018780 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 274memoryfilestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0000000180018798
lstrcatW.KERNEL32 ref: 00000001800187A9
lstrcatW.KERNEL32 ref: 00000001800187BB
CreateFileW.KERNEL32 ref: 00000001800187F3
GetFileSize.KERNEL32 ref: 000000018001881B
VirtualAlloc.KERNEL32 ref: 0000000180018832
ReadFile.KERNEL32 ref: 000000018001885A
VirtualFree.KERNEL32 ref: 000000018001894C
VirtualAlloc.KERNEL32 ref: 00000001800189A8
VirtualAlloc.KERNEL32 ref: 0000000180018A10
IsBadReadPtr.KERNEL32 ref: 0000000180018A5A
EnterCriticalSection.KERNEL32 ref: 0000000180018A70
LeaveCriticalSection.KERNEL32 ref: 0000000180018A95
IsBadReadPtr.KERNEL32 ref: 0000000180018AAA
EnterCriticalSection.KERNEL32 ref: 0000000180018ABD
VirtualAlloc.KERNEL32 ref: 0000000180018AD4
LeaveCriticalSection.KERNEL32 ref: 0000000180018AF8
VirtualFree.KERNEL32 ref: 0000000180018B3D
VirtualFree.KERNEL32 ref: 0000000180018B67
LeaveCriticalSection.KERNEL32 ref: 0000000180018B7A
IsBadReadPtr.KERNEL32 ref: 0000000180018B99
EnterCriticalSection.KERNEL32 ref: 0000000180018BB4
GetLastError.KERNEL32 ref: 0000000180018BE2
CloseHandle.KERNEL32 ref: 0000000180018C00

Strings

C:\Program Files\Windows Mail, xrefs: 000000018001879D
\cp.cfg, xrefs: 00000001800187AF
@, xrefs: 000000018001887B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocRead$EnterFileFreeLeave$lstrcat$CloseCreateErrorHandleLastSizememset
String ID: @$C:\Program Files\Windows Mail$\cp.cfg
API String ID: 1502650097-1776503346
Opcode ID: 03e5816f0febf9f2516ba56efb62d54b0cca26d4fb6bcd281216f8244b78d330
Instruction ID: c2f19d3434467f5612aefb1ee83e3f8382223a62b74b862b437922862cafa65c
Opcode Fuzzy Hash: 03e5816f0febf9f2516ba56efb62d54b0cca26d4fb6bcd281216f8244b78d330
Instruction Fuzzy Hash: 02C19031315F8882EBA68F25D8543A963A5FF8DBC4F58C215EA5A43B94EF38C719D700

Function 00000001800199F0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 175stringclipboardmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000180019A3A
WideCharToMultiByte.KERNEL32 ref: 0000000180019A66
VirtualAlloc.KERNEL32 ref: 0000000180019A89
lstrlenW.KERNEL32 ref: 0000000180019A9E

Part of subcall function 000000018002C8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,0000000180020EBE), ref: 000000018002C907
Part of subcall function 000000018002C8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,0000000180020EBE), ref: 000000018002C92F

lstrlenW.KERNEL32 ref: 0000000180019B1F
WideCharToMultiByte.KERNEL32 ref: 0000000180019B48
VirtualAlloc.KERNEL32 ref: 0000000180019B5D
lstrlenW.KERNEL32 ref: 0000000180019B76
WideCharToMultiByte.KERNEL32 ref: 0000000180019BA2
WideCharToMultiByte.KERNEL32 ref: 0000000180019BC9
lstrlenA.KERNEL32 ref: 0000000180019BD2
memcpy.NTDLL ref: 0000000180019BE4
OpenClipboard.USER32 ref: 0000000180019BEB
EmptyClipboard.USER32 ref: 0000000180019BF5
lstrlenA.KERNEL32 ref: 0000000180019BFE
GlobalAlloc.KERNEL32 ref: 0000000180019C0E
GlobalLock.KERNEL32 ref: 0000000180019C23
lstrlenA.KERNEL32 ref: 0000000180019C34
memcpy.NTDLL ref: 0000000180019C43
GlobalUnlock.KERNEL32 ref: 0000000180019C4F
SetClipboardData.USER32 ref: 0000000180019C5D
CloseClipboard.USER32 ref: 0000000180019C63
VirtualFree.KERNEL32 ref: 0000000180019C74
VirtualFree.KERNEL32 ref: 0000000180019C85

Strings

!, xrefs: 0000000180019AD6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiWide$ClipboardVirtual$AllocGlobal$Freememcpy$CloseDataEmptyLockOpenUnlock
String ID: !
API String ID: 17242508-2657877971
Opcode ID: d0d0cce1298095d55bda04961aa882279e2f81b3c830c1949f663db54f22f3fc
Instruction ID: 00d56fbf8c4ab3c8f09728c361f09d65826bbb1f7cba3b49fadc20700520b80c
Opcode Fuzzy Hash: d0d0cce1298095d55bda04961aa882279e2f81b3c830c1949f663db54f22f3fc
Instruction Fuzzy Hash: 77719031215B4886EB96CF66E8943D973A6FF8CBC1F448124F98B52B64DF3CC2498740

Function 000000018001E210 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 199stringfilesleepCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000000018001E23C
memset.NTDLL ref: 000000018001E264
memset.NTDLL ref: 000000018001E278
lstrcatW.KERNEL32 ref: 000000018001E287
lstrcatW.KERNEL32 ref: 000000018001E29B
FindFirstFileW.KERNEL32 ref: 000000018001E2E6
FindNextFileW.KERNEL32 ref: 000000018001E305
memset.NTDLL ref: 000000018001E352
lstrcatW.KERNEL32 ref: 000000018001E361
lstrcatW.KERNEL32 ref: 000000018001E372
lstrcatW.KERNEL32 ref: 000000018001E386
Sleep.KERNEL32 ref: 000000018001E391
lstrlenW.KERNEL32 ref: 000000018001E39E
wcsstr.NTDLL ref: 000000018001E3D0
GetCurrentThread.KERNEL32 ref: 000000018001E41F
IsBadReadPtr.KERNEL32 ref: 000000018001E430
EnterCriticalSection.KERNEL32 ref: 000000018001E443
LeaveCriticalSection.KERNEL32 ref: 000000018001E464
FindNextFileW.KERNEL32 ref: 000000018001E4AE
LeaveCriticalSection.KERNEL32 ref: 000000018001E4C2
WaitForSingleObject.KERNEL32 ref: 000000018001E4D5
VirtualFree.KERNEL32 ref: 000000018001E4EF
VirtualFree.KERNEL32 ref: 000000018001E51F

Strings

*.*, xrefs: 000000018001E28D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: lstrcat$CriticalFileFindSectionmemset$FreeLeaveNextVirtual$CurrentEnterFirstObjectReadSingleSleepThreadWait__chkstklstrlenwcsstr
String ID: *.*
API String ID: 491004167-438819550
Opcode ID: b29965504f393d0c0be59b7089e5a45caf17d60b96d961a43351eaaa3ebd01c0
Instruction ID: cade8498daad81a5c2802640b1cebf4252c5f7bdf05394be426f7502779f6333
Opcode Fuzzy Hash: b29965504f393d0c0be59b7089e5a45caf17d60b96d961a43351eaaa3ebd01c0
Instruction Fuzzy Hash: BC918332311F8486EBA6DF21E8547DD63A1FB8DBC4F548126EE5A47A94EF38C649C700

Function 0000000180018230 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 320memoryfilestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001838D
lstrcatW.KERNEL32 ref: 00000001800183A1
lstrcatW.KERNEL32 ref: 00000001800183B6
CreateFileW.KERNEL32 ref: 00000001800183ED
SetFilePointer.KERNEL32 ref: 0000000180018409
WriteFile.KERNEL32 ref: 0000000180018427
CloseHandle.KERNEL32 ref: 0000000180018430
VirtualAlloc.KERNEL32 ref: 000000018001853B
VirtualAlloc.KERNEL32 ref: 00000001800185A3
IsBadReadPtr.KERNEL32 ref: 00000001800185ED
EnterCriticalSection.KERNEL32 ref: 0000000180018603
LeaveCriticalSection.KERNEL32 ref: 0000000180018626
IsBadReadPtr.KERNEL32 ref: 000000018001863B
EnterCriticalSection.KERNEL32 ref: 000000018001864E
VirtualAlloc.KERNEL32 ref: 0000000180018665
LeaveCriticalSection.KERNEL32 ref: 0000000180018689
VirtualFree.KERNEL32 ref: 000000018001869F
VirtualFree.KERNEL32 ref: 00000001800186C9
LeaveCriticalSection.KERNEL32 ref: 0000000180018705
IsBadReadPtr.KERNEL32 ref: 0000000180018724
EnterCriticalSection.KERNEL32 ref: 000000018001873F

Strings

C:\Program Files\Windows Mail, xrefs: 0000000180018392
\cp.cfg, xrefs: 00000001800183A7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$AllocEnterFileLeaveRead$Freelstrcat$CloseCreateHandlePointerWritememset
String ID: C:\Program Files\Windows Mail$\cp.cfg
API String ID: 1370748441-3904790782
Opcode ID: 6ecfbc1e04c89c64a0ee336d11aee912bcb92c8e0a2a77cad56ae9ff53fce122
Instruction ID: 91e17fd98d71c9e8135111786d201d67e54a1e698625a548bfb59b48f32e7dc2
Opcode Fuzzy Hash: 6ecfbc1e04c89c64a0ee336d11aee912bcb92c8e0a2a77cad56ae9ff53fce122
Instruction Fuzzy Hash: 2FE1A272711F8582EBA68F29E4547AD63A1FF8ABC4F54C215EA8903B54EF38C758D700

Function 0000000180026530 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 173filestringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002657F
VirtualFree.KERNEL32 ref: 00000001800265A9
memset.NTDLL ref: 00000001800265E7
lstrcatW.KERNEL32 ref: 00000001800265FB
CreateFileW.KERNEL32 ref: 0000000180026635
htons.WS2_32 ref: 0000000180026668
memset.NTDLL ref: 0000000180026696
GetWindowsDirectoryW.KERNEL32 ref: 00000001800266A8
GetLastError.KERNEL32 ref: 00000001800266B2
lstrcatW.KERNEL32 ref: 00000001800266C7
CreateFileW.KERNEL32 ref: 000000018002670D
GetLastError.KERNEL32 ref: 000000018002671C
WriteFile.KERNEL32 ref: 000000018002673A
GetLastError.KERNEL32 ref: 0000000180026744
CloseHandle.KERNEL32 ref: 0000000180026752
htons.WS2_32 ref: 0000000180026773
VirtualFree.KERNEL32 ref: 000000018002679C
VirtualFree.KERNEL32 ref: 00000001800267B2
VirtualFree.KERNEL32 ref: 00000001800267DC

Strings

18.166.193.8, xrefs: 0000000180026758
\system32\drivers\tpdrivers.sys, xrefs: 00000001800266B8
tpdrivers, xrefs: 00000001800265EC
\\.\{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 0000000180026614

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocFree$EnterErrorFileLastRead$CreateLeavehtonslstrcatmemset$CloseDirectoryHandleInitializeWindowsWrite
String ID: 18.166.193.8$\\.\{F8284233-48F4-4680-ADDD-F8284233}$\system32\drivers\tpdrivers.sys$tpdrivers
API String ID: 3655753775-1054416900
Opcode ID: db220a0706c505ffdfe986e89b00e689603627b43e6aef5444c71a3e61a513cc
Instruction ID: 12d95dd8c975c3e344e93b2daa028ff3376d6e0438f722d060c7a57747c014ac
Opcode Fuzzy Hash: db220a0706c505ffdfe986e89b00e689603627b43e6aef5444c71a3e61a513cc
Instruction Fuzzy Hash: 7171B731715B5482EBE2DF22F95479A63A1FB8CBC5F10C115EA9A43A64DF3CC65C8700

Function 0000000180019190 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 195sleepmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800191E0
VirtualFree.KERNEL32 ref: 000000018001920A
memset.NTDLL ref: 0000000180019256
VirtualFree.KERNEL32 ref: 000000018001928A
VirtualFree.KERNEL32 ref: 00000001800192B4
malloc.MSVCRT ref: 00000001800192BF
wsprintfA.USER32 ref: 00000001800192E5
CreateMutexA.KERNEL32 ref: 00000001800192F2
GetLastError.KERNEL32 ref: 00000001800192FD
free.MSVCRT ref: 000000018001930D
lstrcatW.KERNEL32 ref: 0000000180019327
VirtualAlloc.KERNEL32 ref: 00000001800193CA
memcpy.NTDLL ref: 00000001800193F4
memcpy.NTDLL ref: 000000018001940E
Sleep.KERNEL32 ref: 0000000180019418
GetCurrentProcessId.KERNEL32 ref: 0000000180019426
VirtualFree.KERNEL32 ref: 000000018001945A
VirtualFree.KERNEL32 ref: 0000000180019475
VirtualFree.KERNEL32 ref: 000000018001949F

Strings

%s%d, xrefs: 00000001800192DB
Inject Test, xrefs: 0000000180019318
:, xrefs: 00000001800193A0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$AllocCriticalSection$EnterRead$Leavememcpy$CreateCurrentErrorInitializeLastMutexProcessSleepfreelstrcatmallocmemsetwsprintf
String ID: %s%d$:$Inject Test
API String ID: 3230380526-1060902658
Opcode ID: 8dbd244c4dc7ff5931541ce9d241f2be0e44287da5020331176b23af610f2178
Instruction ID: dfed7ca6f992ea8d7163875ae2deb23361ae0a0e9c0ec7415be465c0bcf352bb
Opcode Fuzzy Hash: 8dbd244c4dc7ff5931541ce9d241f2be0e44287da5020331176b23af610f2178
Instruction Fuzzy Hash: 63919131715B4882EB96CF66E8147A96361FB8DFC4F54C224EA8A43B55EF3CC2498740

Function 000000018002B2D0 Relevance: 37.9, APIs: 25, Instructions: 372registryCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000000018002B2E8
memset.NTDLL ref: 000000018002B30D
memset.NTDLL ref: 000000018002B321

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002B3B6
VirtualFree.KERNEL32 ref: 000000018002B3E0
RegOpenKeyExW.ADVAPI32 ref: 000000018002B41A
VirtualFree.KERNEL32 ref: 000000018002B45C
VirtualFree.KERNEL32 ref: 000000018002B486
memset.NTDLL ref: 000000018002B49D
RegEnumKeyExW.ADVAPI32 ref: 000000018002B4D2
memset.NTDLL ref: 000000018002B528
RegEnumKeyExW.ADVAPI32 ref: 000000018002B55D
memset.NTDLL ref: 000000018002B586
memset.NTDLL ref: 000000018002B59A
RegEnumValueW.ADVAPI32 ref: 000000018002B5F5
memset.NTDLL ref: 000000018002B696
memset.NTDLL ref: 000000018002B6AA
RegEnumValueW.ADVAPI32 ref: 000000018002B705
RegCloseKey.ADVAPI32 ref: 000000018002B718
VirtualFree.KERNEL32 ref: 000000018002B815
VirtualFree.KERNEL32 ref: 000000018002B83F
VirtualFree.KERNEL32 ref: 000000018002B855
VirtualFree.KERNEL32 ref: 000000018002B87F
VirtualFree.KERNEL32 ref: 000000018002B895
VirtualFree.KERNEL32 ref: 000000018002B8BF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$memset$CriticalSection$Alloc$Enum$EnterRead$LeaveValue$CloseInitializeOpen__chkstk
String ID:
API String ID: 2734444383-0
Opcode ID: 0595414e30b50002a461e2897ac5610cd8ac295fcac56b89b3caa5011188017e
Instruction ID: c7a300cf86788d9b2bb3ad5c5f19a5e509c8aa24f0c3c6b9264e97b70b831d55
Opcode Fuzzy Hash: 0595414e30b50002a461e2897ac5610cd8ac295fcac56b89b3caa5011188017e
Instruction Fuzzy Hash: 02F17E32310B8086EBB5CF62D998B9E73A5FB89B85F408115DF5A47B59DF38C219CB00

Function 000000018005B380 Relevance: 35.3, APIs: 4, Strings: 16, Instructions: 315COMMON

Download Yara Rule

Strings

read failed, xrefs: 000000018005B5BA
problems parsing header, xrefs: 000000018005B5AE
proxy conn dead, xrefs: 000000018005B5EA
proxy read err, xrefs: 000000018005B638
%s: %s: WAITING_DNS, xrefs: 000000018005B423
HTTP/1., xrefs: 000000018005B65F
http_proxy fail, xrefs: 000000018005B886
ERROR reading from proxy socket, xrefs: 000000018005B627
error sending h2 preface, xrefs: 000000018005B702
lws_http_client_socket_service, xrefs: 000000018005B41C, 000000018005B4DD
cws, xrefs: 000000018005B7B1
Peer hung up, xrefs: 000000018005B5A2
http_proxy -> %u, xrefs: 000000018005B6A1
Failed to generate handshake for client, xrefs: 000000018005B76D
chs, xrefs: 000000018005B77E
cbail3, xrefs: 000000018005B8A9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: %s: %s: WAITING_DNS$ERROR reading from proxy socket$Failed to generate handshake for client$HTTP/1.$Peer hung up$cbail3$chs$cws$error sending h2 preface$http_proxy -> %u$http_proxy fail$lws_http_client_socket_service$problems parsing header$proxy conn dead$proxy read err$read failed
API String ID: 0-4263491741
Opcode ID: 78671e27a4717be73cabfba6896136bd0789db9dd6b82e4ebb3e1080ba416978
Instruction ID: 21a0462fd45df87ee5edc06867fd4a1a877ee659b96ff9b765cf0eaf7c443289
Opcode Fuzzy Hash: 78671e27a4717be73cabfba6896136bd0789db9dd6b82e4ebb3e1080ba416978
Instruction Fuzzy Hash: A7D1CF3120478C82FBEA9F2594413F96791AB8CBC8F58D121FE16A76D6DF3AD6498700

Function 0000000180030810 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 186pipeprocessstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0000000180030862
CreatePipe.KERNEL32 ref: 000000018003088A
CloseHandle.KERNEL32 ref: 000000018003089C
CloseHandle.KERNEL32 ref: 00000001800308AE
VirtualFree.KERNEL32 ref: 00000001800308C8
VirtualFree.KERNEL32 ref: 00000001800308F2
CreatePipe.KERNEL32 ref: 0000000180030913
CloseHandle.KERNEL32 ref: 0000000180030926
CloseHandle.KERNEL32 ref: 000000018003093D
GetStartupInfoW.KERNEL32 ref: 000000018003097B
lstrcatW.KERNEL32 ref: 00000001800309B7
VirtualFree.KERNEL32 ref: 00000001800309CD
VirtualFree.KERNEL32 ref: 00000001800309F7
CreateProcessW.KERNEL32 ref: 0000000180030A36
CloseHandle.KERNEL32 ref: 0000000180030A48
CloseHandle.KERNEL32 ref: 0000000180030A5A
CloseHandle.KERNEL32 ref: 0000000180030A6D
CloseHandle.KERNEL32 ref: 0000000180030A84
CreateThread.KERNEL32 ref: 0000000180030AC0

Strings

, xrefs: 0000000180030A26

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateFreeVirtual$Pipe$InfoProcessStartupThreadlstrcatmemset
String ID:
API String ID: 3234776578-3916222277
Opcode ID: 92ec81b901bfc6f2a5663ab9ca78efc14cc9e06966c3134a046e798205adb50d
Instruction ID: e36704ce14db8fa55e6c3ef5371abe2a4fb0e12ac5ce8d9abe4d7c9421358c08
Opcode Fuzzy Hash: 92ec81b901bfc6f2a5663ab9ca78efc14cc9e06966c3134a046e798205adb50d
Instruction Fuzzy Hash: 0C915036601F4486EB96CF62F95039E73B5FB88B88F158115EF9A43A14DF38C2A8D744

Function 0000000180047630 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 274networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000000018004776D
setsockopt.WS2_32 ref: 00000001800477AF
setsockopt.WS2_32 ref: 00000001800477CC
setsockopt.WS2_32 ref: 0000000180047913
WSAGetLastError.WS2_32 ref: 000000018004791D
listen.WS2_32 ref: 000000018004792F
closesocket.WS2_32 ref: 000000018004799E
WSAGetLastError.WS2_32 ref: 0000000180047A71
closesocket.WS2_32 ref: 0000000180047AA0
closesocket.WS2_32 ref: 0000000180047AC8

Strings

Out of mem, xrefs: 0000000180047AAD
_lws_vhost_init_server_af, xrefs: 00000001800479CE, 0000000180047A26
listen|%s|%s|%d, xrefs: 0000000180047982
lws_create_vhost, xrefs: 0000000180047638
ERROR opening socket, xrefs: 0000000180047AD5
%s: VH %s: iface %s port %d DOESN'T EXIST, xrefs: 00000001800479D5
%s: VH %s: iface %s port %d NOT USABLE, xrefs: 0000000180047A2D
reuseaddr failed, xrefs: 0000000180047AB6
listen failed with error %d, xrefs: 0000000180047A77

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: closesocketsetsockopt$ErrorLast$listensocket
String ID: %s: VH %s: iface %s port %d DOESN'T EXIST$%s: VH %s: iface %s port %d NOT USABLE$ERROR opening socket$Out of mem$_lws_vhost_init_server_af$listen failed with error %d$listen|%s|%s|%d$lws_create_vhost$reuseaddr failed
API String ID: 3630065070-1684632830
Opcode ID: 3b880312eee11432debff261864d0151b6d610a403db296dabe4168ddc5b799d
Instruction ID: 2766f3bb6dc4fce403585f370064895871a90e0ac9ff3b4998f931d318ec6775
Opcode Fuzzy Hash: 3b880312eee11432debff261864d0151b6d610a403db296dabe4168ddc5b799d
Instruction Fuzzy Hash: E7D18C72300B8886EB96CB16D4887DD33A1F78CBD8F558226EA2D477A1DF34C699C705

Function 000000018001C850 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 244filestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001C895
lstrcatW.KERNEL32 ref: 000000018001C8A4
lstrcatW.KERNEL32 ref: 000000018001C8B8
memset.NTDLL ref: 000000018001C8CB
FindFirstFileW.KERNEL32 ref: 000000018001C8DC

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

FindNextFileW.KERNEL32 ref: 000000018001C935
FindNextFileW.KERNEL32 ref: 000000018001C999
VirtualFree.KERNEL32 ref: 000000018001CA54
VirtualFree.KERNEL32 ref: 000000018001CA7E
VirtualFree.KERNEL32 ref: 000000018001CA94
VirtualFree.KERNEL32 ref: 000000018001CABE
VirtualFree.KERNEL32 ref: 000000018001CAD9
VirtualFree.KERNEL32 ref: 000000018001CB03
FindClose.KERNEL32 ref: 000000018001CB0C
VirtualFree.KERNEL32 ref: 000000018001CB2C
VirtualFree.KERNEL32 ref: 000000018001CB56
VirtualFree.KERNEL32 ref: 000000018001CB71
VirtualFree.KERNEL32 ref: 000000018001CB9B

Strings

*.*, xrefs: 000000018001C8AA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$Find$EnterFileRead$LeaveNextlstrcatmemset$CloseFirstInitialize
String ID: *.*
API String ID: 3909642798-438819550
Opcode ID: 4ce18a9b90196395475cfb8a2b41f3e008fbd196779cbce07c17fbf59d62ab14
Instruction ID: 0c4d991779888e973b7db5cd2e96938188924a16c3f10448eab00e3ce2e85064
Opcode Fuzzy Hash: 4ce18a9b90196395475cfb8a2b41f3e008fbd196779cbce07c17fbf59d62ab14
Instruction Fuzzy Hash: 0DA19E36301B4482EBA6DF62E8587AA63A5FB8DFC8F14C024EE4A43754DF39C649D705

Function 00000001800263C0 Relevance: 33.3, APIs: 15, Strings: 4, Instructions: 76servicestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00000001800263D9
lstrcatW.KERNEL32 ref: 00000001800263ED
memset.NTDLL ref: 0000000180026400
GetWindowsDirectoryW.KERNEL32 ref: 000000018002640F
GetLastError.KERNEL32 ref: 0000000180026419
lstrcatW.KERNEL32 ref: 000000018002642B
OpenSCManagerW.ADVAPI32 ref: 000000018002643B
GetLastError.KERNEL32 ref: 0000000180026449
CreateServiceW.ADVAPI32 ref: 00000001800264C0
GetLastError.KERNEL32 ref: 00000001800264CE
CloseServiceHandle.ADVAPI32 ref: 00000001800264D7
GetLastError.KERNEL32 ref: 00000001800264DD
StartServiceW.ADVAPI32 ref: 00000001800264FC
CloseServiceHandle.ADVAPI32 ref: 0000000180026505
CloseServiceHandle.ADVAPI32 ref: 000000018002650E

Strings

\system32\drivers\tpdrivers.sys, xrefs: 000000018002641F
FltMgr, xrefs: 0000000180026467
FSFilter Activity Monitor, xrefs: 000000018002648D
tpdrivers, xrefs: 00000001800263DE

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$lstrcatmemset$CreateDirectoryManagerOpenStartWindows
String ID: FSFilter Activity Monitor$FltMgr$\system32\drivers\tpdrivers.sys$tpdrivers
API String ID: 4233479461-606275738
Opcode ID: 38649f7966a210fa7a925492f7da8da3f08e55cc04dda45abaec5e3d19128508
Instruction ID: be4161d35e4edffc8d18653c63b0145683f113417105ade20d90917bd565f143
Opcode Fuzzy Hash: 38649f7966a210fa7a925492f7da8da3f08e55cc04dda45abaec5e3d19128508
Instruction Fuzzy Hash: 63318F35604B8482EB928B54F8543DA73A2FB8C7D4F548125EA9E42B68EF3CC34DCB00

Function 000000018002E4D0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 120injectionmemorystringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000018002E4DE
Process32FirstW.KERNEL32 ref: 000000018002E4F7
lstrcmpiW.KERNEL32 ref: 000000018002E529
OpenProcess.KERNEL32 ref: 000000018002E545
VirtualAllocEx.KERNEL32 ref: 000000018002E56C
WriteProcessMemory.KERNEL32 ref: 000000018002E58E
CreateRemoteThread.KERNEL32 ref: 000000018002E5B1
CloseHandle.KERNEL32 ref: 000000018002E5BF
Process32NextW.KERNEL32 ref: 000000018002E5CD
lstrcmpiW.KERNEL32 ref: 000000018002E5EC
OpenProcess.KERNEL32 ref: 000000018002E606
VirtualAllocEx.KERNEL32 ref: 000000018002E62D
WriteProcessMemory.KERNEL32 ref: 000000018002E653
CreateRemoteThread.KERNEL32 ref: 000000018002E676
CloseHandle.KERNEL32 ref: 000000018002E684
Process32NextW.KERNEL32 ref: 000000018002E692

Strings

winlogon.exe, xrefs: 000000018002E51A, 000000018002E5E5
@, xrefs: 000000018002E616

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process$CreateProcess32$AllocCloseHandleMemoryNextOpenRemoteThreadVirtualWritelstrcmpi$FirstSnapshotToolhelp32
String ID: @$winlogon.exe
API String ID: 2717908072-2705468112
Opcode ID: 9adab53390aa097aff988e1355229478ff467b453e21ebe2fac670c522015f7e
Instruction ID: 4f48c20b5f6e5e976debb9c4ef6a3f07c2835b05d0dbc98f6ef438c5d6a82c9a
Opcode Fuzzy Hash: 9adab53390aa097aff988e1355229478ff467b453e21ebe2fac670c522015f7e
Instruction Fuzzy Hash: 65517431345B8986EBE68F12B8547967395EB8EBC4F588128EA4D47754FF3CC24D8B04

Function 000000018001A190 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 149filestringmemoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000000018001A1AB
memset.NTDLL ref: 000000018001A1C4
lstrcatW.KERNEL32 ref: 000000018001A1D5
lstrcatW.KERNEL32 ref: 000000018001A1E7
CreateFileW.KERNEL32 ref: 000000018001A21E
CreateFileW.KERNEL32 ref: 000000018001A253
SetFilePointer.KERNEL32 ref: 000000018001A268
WriteFile.KERNEL32 ref: 000000018001A297
SetFileAttributesW.KERNEL32 ref: 000000018001A2A6
SetFilePointer.KERNEL32 ref: 000000018001A2BA
VirtualAlloc.KERNEL32 ref: 000000018001A2CF
WriteFile.KERNEL32 ref: 000000018001A3BA
VirtualFree.KERNEL32 ref: 000000018001A3CB
SetFileAttributesW.KERNEL32 ref: 000000018001A3DB
CloseHandle.KERNEL32 ref: 000000018001A3E9

Strings

\temp.key, xrefs: 000000018001A1DB
C:\Program Files\Windows Mail, xrefs: 000000018001A1C9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: File$AttributesCreatePointerVirtualWritelstrcat$AllocCloseCountFreeHandleTickmemset
String ID: C:\Program Files\Windows Mail$\temp.key
API String ID: 573267298-229217837
Opcode ID: 56780571c3b5b24d83ae8df9fa4e23bd7118c424518018f72ede47bea234dd3e
Instruction ID: 39fad07a16c8704c8e09e2da5d2261186e7f98d000fc3352d74f7c3f3773f4dc
Opcode Fuzzy Hash: 56780571c3b5b24d83ae8df9fa4e23bd7118c424518018f72ede47bea234dd3e
Instruction Fuzzy Hash: 9E619172614F9982EBA18F25E808BDA7761FB89BC4F50C211EA9657B54EF3CC709C700

Function 00000001800197D0 Relevance: 28.7, APIs: 19, Instructions: 155clipboardstringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000018001983F
LeaveCriticalSection.KERNEL32 ref: 000000018001986F
EnterCriticalSection.KERNEL32 ref: 000000018001988F
LeaveCriticalSection.KERNEL32 ref: 00000001800198C1
lstrlenW.KERNEL32 ref: 00000001800198F7
memcmp.MSVCRT ref: 0000000180019908
lstrlenW.KERNEL32 ref: 0000000180019934
lstrlenW.KERNEL32 ref: 000000018001993F
lstrlenW.KERNEL32 ref: 000000018001994F
memcpy.NTDLL ref: 0000000180019960
OpenClipboard.USER32 ref: 0000000180019967
CloseClipboard.USER32 ref: 0000000180019971
EmptyClipboard.USER32 ref: 0000000180019977
GlobalAlloc.KERNEL32 ref: 0000000180019985
GlobalLock.KERNEL32 ref: 0000000180019996
memcpy.NTDLL ref: 00000001800199AD
GlobalUnlock.KERNEL32 ref: 00000001800199B5
SetClipboardData.USER32 ref: 00000001800199C3
CloseClipboard.USER32 ref: 00000001800199C9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Clipboard$CriticalSectionlstrlen$Global$CloseEnterLeavememcpy$AllocDataEmptyLockOpenUnlockmemcmp
String ID:
API String ID: 1993803941-0
Opcode ID: f9a916733851e6dc62f61d2f66a0daea919dc5e740a42f29a2d1ffc9bea0251b
Instruction ID: 58dd28c6ce58bb26b4bd6f8d61a77f28d171b14bf80a9d30c92ec28687e864cc
Opcode Fuzzy Hash: f9a916733851e6dc62f61d2f66a0daea919dc5e740a42f29a2d1ffc9bea0251b
Instruction Fuzzy Hash: 67515F31202F0985FF9A9FA699543A963A1FF4DBC0F58C425EE1A077A4EF38D6598300

Function 000000018001F710 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 196memoryinjectionlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000018001F560: VirtualAlloc.KERNEL32 ref: 000000018001F59E
Part of subcall function 000000018001F560: memcpy.NTDLL ref: 000000018001F5BA
Part of subcall function 000000018001F560: VirtualFree.KERNEL32 ref: 000000018001F6AF

VirtualAllocEx.KERNEL32 ref: 000000018001F764
GetLastError.KERNEL32 ref: 000000018001F772
WriteProcessMemory.KERNEL32 ref: 000000018001F793
VirtualAllocEx.KERNEL32 ref: 000000018001F7B3
WriteProcessMemory.KERNEL32 ref: 000000018001F7D6
VirtualAllocEx.KERNEL32 ref: 000000018001F7F7
WriteProcessMemory.KERNEL32 ref: 000000018001F8D7
VirtualProtectEx.KERNEL32 ref: 000000018001F900
VirtualProtectEx.KERNEL32 ref: 000000018001F91C
GetModuleHandleW.KERNEL32 ref: 000000018001F937
GetProcAddress.KERNEL32 ref: 000000018001F947

Strings

ZwCreateThreadEx, xrefs: 000000018001F940
h, xrefs: 000000018001F88F
ntdll.dll, xrefs: 000000018001F928
@, xrefs: 000000018001F7E2

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$MemoryProcessWrite$Protect$AddressErrorFreeHandleLastModuleProcmemcpy
String ID: @$ZwCreateThreadEx$h$ntdll.dll
API String ID: 2541485474-1855171776
Opcode ID: 396edaa950aea8bb2834e9a8a087e273c859751424a80b509f85d4148d5affe0
Instruction ID: b914b1c6b4854bd9bbe5246b375c866756148f1a68b4d635330a0ff3f8bed5ac
Opcode Fuzzy Hash: 396edaa950aea8bb2834e9a8a087e273c859751424a80b509f85d4148d5affe0
Instruction Fuzzy Hash: 3881E232714B848AF766CF69A8447AD3A61F74A7C8F444319EE9957B88DF38C30AC750

Function 0000000180033760 Relevance: 25.7, APIs: 17, Instructions: 183filememoryCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00000001800337A7
memcpy.NTDLL ref: 00000001800337B9
CreateFileW.KERNEL32 ref: 00000001800337F8
GetFileSize.KERNEL32 ref: 0000000180033821
SetFilePointer.KERNEL32 ref: 000000018003383D
VirtualAlloc.KERNEL32 ref: 0000000180033854
GetLastError.KERNEL32 ref: 0000000180033862
free.MSVCRT ref: 0000000180033876
ReadFile.KERNEL32 ref: 00000001800338BC
VirtualFree.KERNEL32 ref: 0000000180033988
VirtualFree.KERNEL32 ref: 00000001800339B2
VirtualFree.KERNEL32 ref: 00000001800339C8
VirtualFree.KERNEL32 ref: 00000001800339F2
GetLastError.KERNEL32 ref: 00000001800339FA
VirtualFree.KERNEL32 ref: 0000000180033A16

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

GetLastError.KERNEL32 ref: 0000000180033A21
free.MSVCRT ref: 0000000180033A35

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Free$FileRead$EnterErrorLast$Leavefree$CreateInitializePointerSizemallocmemcpy
String ID:
API String ID: 1128571104-0
Opcode ID: af9bb7d1b2c8ca7110cb3b755bcb326d2b0b0e4f4ea9e483cf88b5d16ac75476
Instruction ID: 7e6667f5687e21de03c6395f9980a8ab6106eacff8aa6e952de2fb0cb8ce4fda
Opcode Fuzzy Hash: af9bb7d1b2c8ca7110cb3b755bcb326d2b0b0e4f4ea9e483cf88b5d16ac75476
Instruction Fuzzy Hash: 63718136305B8486EBA5CF22E95879B73A1FB8DBD4F108115EE9A43B54DF38C259DB00

Function 000000018002E010 Relevance: 25.7, APIs: 17, Instructions: 170keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 000000018002E024
BlockInput.USER32 ref: 000000018002E061
GetDC.USER32 ref: 000000018002E0A4
GetDeviceCaps.GDI32 ref: 000000018002E10C
GetDeviceCaps.GDI32 ref: 000000018002E11A
GetDeviceCaps.GDI32 ref: 000000018002E128
GetDeviceCaps.GDI32 ref: 000000018002E156
MapVirtualKeyW.USER32 ref: 000000018002E1BC
keybd_event.USER32 ref: 000000018002E1D0
BlockInput.USER32 ref: 000000018002E355

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CapsDevice$BlockInput$Virtualkeybd_event
String ID:
API String ID: 4019288356-0
Opcode ID: 80f6854fd55cfec3db650c4c49a6fd06f20ce82fbc0cb067e63b0ba8c2a67ee0
Instruction ID: 51607d66c44d631e5514e6cc14082b91fee79f825fdabc4b9e198b8b7d56ef02
Opcode Fuzzy Hash: 80f6854fd55cfec3db650c4c49a6fd06f20ce82fbc0cb067e63b0ba8c2a67ee0
Instruction Fuzzy Hash: 8861EB326147C887E397DB31A8487AA73A5FB8E7C5F54C211FA4A03664EF39D689C700

Function 0000000180056670 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 258stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 000000018005669A

Strings

%s: malformed ip address, xrefs: 0000000180056991
lws_create_vhost, xrefs: 000000018005667D
lws_parse_numeric_address, xrefs: 000000018005693B, 0000000180056985
%s: ended on e %d, xrefs: 0000000180056942

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: strchr
String ID: %s: ended on e %d$%s: malformed ip address$lws_create_vhost$lws_parse_numeric_address
API String ID: 2830005266-2525933588
Opcode ID: 70010e423fb3755efd61014bceaeae7baf17920ebf1afdbeec04516e640b8e02
Instruction ID: d636d15f552ec0f279111f20eb57849166517b3c99d00c477bd79e5d42a6d3a3
Opcode Fuzzy Hash: 70010e423fb3755efd61014bceaeae7baf17920ebf1afdbeec04516e640b8e02
Instruction Fuzzy Hash: 05A14632B0468C45FAE38A2894043EA7A51E74A7E8F64C311FAA7277F5CE36C74D8701

Function 00000001800173D0 Relevance: 24.2, APIs: 16, Instructions: 212pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180017423

Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134EB
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800134FD
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013510
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013527
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013556
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013568
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001357B
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013592
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135C1
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800135D3
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135E6
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135FD
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001362C
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 000000018001363E
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013654

Part of subcall function 0000000180016C70: memcpy.NTDLL ref: 0000000180016C8E
Part of subcall function 0000000180016C70: memset.NTDLL ref: 0000000180016CA0
Part of subcall function 0000000180016C70: lstrcatA.KERNEL32 ref: 0000000180016CC0
Part of subcall function 0000000180016C70: lstrcatW.KERNEL32 ref: 0000000180016CF4

VirtualFree.KERNEL32 ref: 000000018001744D
VirtualFree.KERNEL32 ref: 000000018001749D
VirtualFree.KERNEL32 ref: 00000001800174C7
VirtualFree.KERNEL32 ref: 00000001800174EF
VirtualFree.KERNEL32 ref: 0000000180017519
DisconnectNamedPipe.KERNEL32 ref: 0000000180017546
CloseHandle.KERNEL32 ref: 0000000180017555
DeleteCriticalSection.KERNEL32 ref: 0000000180017563
VirtualFree.KERNEL32 ref: 0000000180017574
VirtualFree.KERNEL32 ref: 0000000180017615
VirtualFree.KERNEL32 ref: 000000018001763F
VirtualFree.KERNEL32 ref: 0000000180017655
VirtualFree.KERNEL32 ref: 000000018001767F
VirtualFree.KERNEL32 ref: 0000000180017695

Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013678
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013691
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136A7
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136CB
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800136E4
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136FA
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013726
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 000000018001373F
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013755
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013779
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013792
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800137A8

Part of subcall function 0000000180016BC0: IsBadReadPtr.KERNEL32 ref: 0000000180016BE3
Part of subcall function 0000000180016BC0: EnterCriticalSection.KERNEL32(?,?,00000038,00000001800171A6), ref: 0000000180016BFE
Part of subcall function 0000000180016BC0: LeaveCriticalSection.KERNEL32(?,?,00000038,00000001800171A6), ref: 0000000180016C21

VirtualFree.KERNEL32 ref: 00000001800176BF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Free$EnterRead$Leave$Alloc$lstrcat$CloseDeleteDisconnectHandleInitializeNamedPipememcpymemset
String ID:
API String ID: 4255235403-0
Opcode ID: 487ab0318e1d18530209ff1e23f5e332d75461c33a839119e161c17338c97bb7
Instruction ID: babdb363706aaf13186cd58188e906dd6551b25749ad794e3c97fd5ce7c8e0dc
Opcode Fuzzy Hash: 487ab0318e1d18530209ff1e23f5e332d75461c33a839119e161c17338c97bb7
Instruction Fuzzy Hash: 9D911836705F4486EBA6DF66E95036973A1FB8DFC0F08C114EA8A43B56DF38D2588700

Function 0000000180021520 Relevance: 24.1, APIs: 16, Instructions: 140networkmemorythreadCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0000000180021548
VirtualFree.KERNEL32 ref: 00000001800215AF
VirtualFree.KERNEL32 ref: 00000001800215D9
socket.WS2_32 ref: 00000001800215ED
setsockopt.WS2_32 ref: 000000018002161F
htons.WS2_32 ref: 000000018002163A
inet_addr.WS2_32 ref: 000000018002164F
htonl.WS2_32 ref: 0000000180021659
bind.WS2_32 ref: 0000000180021672
WSAGetLastError.WS2_32 ref: 000000018002167C
listen.WS2_32 ref: 0000000180021696
CreateThread.KERNEL32 ref: 00000001800216C4
IsBadReadPtr.KERNEL32 ref: 00000001800216DD
EnterCriticalSection.KERNEL32 ref: 00000001800216F0
VirtualAlloc.KERNEL32 ref: 0000000180021707
LeaveCriticalSection.KERNEL32 ref: 000000018002172B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalFreeSection$AllocCreateEnterErrorLastLeaveReadThreadbindhtonlhtonsinet_addrlistenmemsetsetsockoptsocket
String ID:
API String ID: 1206800484-0
Opcode ID: 3b4ce19dcc75c1c8cdbd46baa2501b7c779ff89514a24e43775d64ba7dc00e07
Instruction ID: 8c37b3e26c9d2b08fb46051b3eba7674f5bc302b0b96bdb988dfcbce2372576e
Opcode Fuzzy Hash: 3b4ce19dcc75c1c8cdbd46baa2501b7c779ff89514a24e43775d64ba7dc00e07
Instruction Fuzzy Hash: 19516C36305B5486EBA68F21E8543DD73B1FB8CF85F548125EA4A43B94EF38C659DB00

Function 00000001800486E0 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 485COMMON

Download Yara Rule

APIs

_atoi64.MSVCRT ref: 0000000180048809
_stricmp.MSVCRT ref: 00000001800488C0
_stricmp.MSVCRT ref: 00000001800488D9

Strings

no mount hit, xrefs: 0000000180048950
close, xrefs: 00000001800488CE
index.html, xrefs: 0000000180048B2E
Unable to find plugin '%s', xrefs: 0000000180048A35
http_action HTTP, xrefs: 0000000180048BCC
Basic realm="lwsws", xrefs: 0000000180048DBC
lws_http_action, xrefs: 0000000180048CF9
http action CALLBACK bind, xrefs: 0000000180048A49
keep-alive, xrefs: 00000001800488B1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _stricmp$_atoi64
String ID: Basic realm="lwsws"$Unable to find plugin '%s'$close$http action CALLBACK bind$http_action HTTP$index.html$keep-alive$lws_http_action$no mount hit
API String ID: 3615839938-539034854
Opcode ID: 42451850e58ed0897b44b1e692b0d652687ccba59d4a3584232ad48d43f11056
Instruction ID: c85f8a637d88cc95b17b7b12485c421cb72b9085f7fd7bb2a0c8fa8c61fd7d62
Opcode Fuzzy Hash: 42451850e58ed0897b44b1e692b0d652687ccba59d4a3584232ad48d43f11056
Instruction Fuzzy Hash: DB22B472300B8996EBA69F22D4803DD27A5FB49BCCF458836EE4957799EF34C609D304

Function 000000018001A410 Relevance: 21.3, APIs: 14, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76960f33f7b699ea47f10996dbc376ab567cd27cc47711776d389580683e5e3
Instruction ID: 60423ae12fd94438baa3cf898bd68c6d21163082e13b3844440245a4f48370d1
Opcode Fuzzy Hash: a76960f33f7b699ea47f10996dbc376ab567cd27cc47711776d389580683e5e3
Instruction Fuzzy Hash: 22B1D231649A8D8AFB9BD768F9403E42391F70D7D1F91C126F49987690DE2C8B8F9306

Function 00000001800230FE Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150sleepCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 0000000180026AC8
VirtualFree.KERNEL32 ref: 0000000180026AF2
malloc.MSVCRT ref: 0000000180026B7D
malloc.MSVCRT ref: 0000000180026B89
VirtualFree.KERNEL32 ref: 0000000180026BE2
VirtualFree.KERNEL32 ref: 0000000180026C0C
NetUserAdd.NETAPI32 ref: 0000000180026C46
Sleep.KERNEL32 ref: 0000000180026C51
NetLocalGroupAddMembers.NETAPI32 ref: 0000000180026C76
free.MSVCRT ref: 0000000180026C89
free.MSVCRT ref: 0000000180026C92

Strings

Administrators, xrefs: 0000000180026C6D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FreeVirtual$freemalloc$GroupLocalMembersSleepUser
String ID: Administrators
API String ID: 2980277588-3395160503
Opcode ID: da3a28424a5a67998ed531bb1b5f40b6d27e172e32b39df16f7556483a8c1416
Instruction ID: 7f64238c5f2db27e2cb8eceb7629a4ddaca5bd09597119c914e0740545c426d3
Opcode Fuzzy Hash: da3a28424a5a67998ed531bb1b5f40b6d27e172e32b39df16f7556483a8c1416
Instruction Fuzzy Hash: D4517F32B00B048AEB56DF75D8543ED33A1FB8DB89F14C125EE4A56B58DE38C659C740

Function 00000001800334F0 Relevance: 19.7, APIs: 13, Instructions: 162fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000000018003351A
CreateFileW.KERNEL32 ref: 000000018003357E
SetFilePointer.KERNEL32 ref: 00000001800335C1
WriteFile.KERNEL32 ref: 00000001800335E3
GetFileSize.KERNEL32 ref: 00000001800335F3
GetLastError.KERNEL32 ref: 0000000180033601
VirtualFree.KERNEL32 ref: 00000001800336A3
VirtualFree.KERNEL32 ref: 00000001800336CD
VirtualFree.KERNEL32 ref: 00000001800336E3
VirtualFree.KERNEL32 ref: 000000018003370D
free.MSVCRT ref: 0000000180033716

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FileFreeVirtual$CreateErrorLastPointerSizeWritefreemalloc
String ID:
API String ID: 287149550-0
Opcode ID: 0223230c3a5642bc6ac120d5f3bc129a0fc1910174e513a298f1f88523c3db28
Instruction ID: 80e45b664543585f4643f9112c24d8a843cc9f14f2b8051dce630e8d098ad42e
Opcode Fuzzy Hash: 0223230c3a5642bc6ac120d5f3bc129a0fc1910174e513a298f1f88523c3db28
Instruction Fuzzy Hash: AA618072311B8486EB65CF22E95479A73A5FB8CFD4F108215EE9A07B54DF38C259C700

Function 000000018001C4E0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 115stringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001C51F
memset.NTDLL ref: 000000018001C540
memset.NTDLL ref: 000000018001C552
QueryDosDeviceW.KERNEL32 ref: 000000018001C58A
GetDriveTypeW.KERNEL32 ref: 000000018001C5A5
lstrlenW.KERNEL32 ref: 000000018001C5B9
GetVolumeInformationW.KERNEL32 ref: 000000018001C628
lstrlenW.KERNEL32 ref: 000000018001C633
GetDiskFreeSpaceExW.KERNEL32 ref: 000000018001C682

Strings

:, xrefs: 000000018001C582
\, xrefs: 000000018001C59D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memset$lstrlen$DeviceDiskDriveFreeInformationQuerySpaceTypeVolume
String ID: :$\
API String ID: 2115141164-1166558509
Opcode ID: 2477ab74630cff7d9f10f7953b90637281b9d5ed11b09ba90bcaab8a2ec660d9
Instruction ID: 08b8c3128405f4ed23382147f1039dffd5c43d6198621a424984a10230734bc2
Opcode Fuzzy Hash: 2477ab74630cff7d9f10f7953b90637281b9d5ed11b09ba90bcaab8a2ec660d9
Instruction Fuzzy Hash: 76515E32214B8487EB71CF25E8447DE7761F78AB89F505111EB8A47A68EF38D74ACB00

Function 0000000180020480 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001800204B2
OpenProcessToken.ADVAPI32 ref: 00000001800204C3
LookupPrivilegeValueW.ADVAPI32 ref: 00000001800204EB
AdjustTokenPrivileges.ADVAPI32 ref: 000000018002050B
GetLastError.KERNEL32 ref: 0000000180020511
CloseHandle.KERNEL32 ref: 0000000180020525
VirtualAlloc.KERNEL32 ref: 000000018002053E
GetLastError.KERNEL32 ref: 000000018002054C
memcpy.NTDLL ref: 000000018002055E

Strings

SeDebugPrivilege, xrefs: 00000001800204DA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastProcessToken$AdjustAllocCloseCurrentHandleLookupOpenPrivilegePrivilegesValueVirtualmemcpy
String ID: SeDebugPrivilege
API String ID: 941393880-2896544425
Opcode ID: 13ad378ceb3cf1b95ba2275f286f3521988d44e0188879ad38e1d67537cb33ea
Instruction ID: ea4f92aae033d01013d5b6c73fd74f6cf41a10a7a00df61154ea5ed3773aceec
Opcode Fuzzy Hash: 13ad378ceb3cf1b95ba2275f286f3521988d44e0188879ad38e1d67537cb33ea
Instruction Fuzzy Hash: 0E318271214B4486E796DF26F84478A77A1FB8CBD4F148225BE56437A5DF3CC649CB00

Function 0000000180026200 Relevance: 15.1, APIs: 10, Instructions: 118clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002624A
VirtualFree.KERNEL32 ref: 0000000180026274
OpenClipboard.USER32 ref: 0000000180026302
GlobalAlloc.KERNEL32 ref: 000000018002631A
GlobalLock.KERNEL32 ref: 000000018002632B
GlobalUnlock.KERNEL32 ref: 0000000180026349
SetClipboardData.USER32 ref: 0000000180026357
CloseClipboard.USER32 ref: 000000018002635D
VirtualFree.KERNEL32 ref: 0000000180026373
VirtualFree.KERNEL32 ref: 000000018002639D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Free$ClipboardEnterGlobalRead$Leave$CloseDataInitializeLockOpenUnlock
String ID:
API String ID: 1362927461-0
Opcode ID: 14aff5e7281eb0515db2efaaa05bc0cffdcae11165ae12660c773d397ca1b196
Instruction ID: d64dd42c3dc8fb4412f7557b5568284cb69eb52a1192a69af238dbfe421c115e
Opcode Fuzzy Hash: 14aff5e7281eb0515db2efaaa05bc0cffdcae11165ae12660c773d397ca1b196
Instruction Fuzzy Hash: AF416031715B4486EBA9DF22EA5436D63A1FB8DFC1F44C114EA9A43F54EF38D2698700

Function 0000000180064130 Relevance: 15.1, APIs: 10, Instructions: 88COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000018006415B
memset.NTDLL ref: 00000001800641B0
RtlCaptureContext.KERNEL32 ref: 00000001800641CC
RtlLookupFunctionEntry.KERNEL32 ref: 00000001800641E4
RtlVirtualUnwind.KERNEL32 ref: 0000000180064222
IsDebuggerPresent.KERNEL32 ref: 0000000180064263
SetUnhandledExceptionFilter.KERNEL32 ref: 000000018006426D
UnhandledExceptionFilter.KERNEL32 ref: 0000000180064278
GetCurrentProcess.KERNEL32 ref: 0000000180064290
TerminateProcess.KERNEL32 ref: 000000018006429E

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentProcessUnhandled$CaptureContextCurrentDebuggerEntryFeatureFunctionLookupProcessorTerminateUnwindVirtualmemset
String ID:
API String ID: 2775880128-0
Opcode ID: e54aba6c139d99624c5fc929576f719923c2ee98f6e17d40784d5d8f2ef1c0b0
Instruction ID: 4765e8045a5846deb9287ac6894a5dec6d9a063d7bfc4cb050589aecf0a9d8b0
Opcode Fuzzy Hash: e54aba6c139d99624c5fc929576f719923c2ee98f6e17d40784d5d8f2ef1c0b0
Instruction Fuzzy Hash: D8416332A14B8586E750CF64EC503EE3371F799748F519229EB9D47A55EF78C298C700

Function 000000018002D060 Relevance: 15.1, APIs: 10, Instructions: 61serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 000000018002D077
OpenServiceW.ADVAPI32 ref: 000000018002D0A7
GetLastError.KERNEL32 ref: 000000018002D0B5
CloseServiceHandle.ADVAPI32 ref: 000000018002D0C0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: OpenService$CloseErrorHandleLastManager
String ID:
API String ID: 2659350385-0
Opcode ID: d1f9e974718dfdc27abd3533510aa15af3a5deb6cf2be6aac275e286971032ce
Instruction ID: 287740d799c7e1e53cdf3a8a1bbdcd1450047062a2d3c82c89dea545571af17d
Opcode Fuzzy Hash: d1f9e974718dfdc27abd3533510aa15af3a5deb6cf2be6aac275e286971032ce
Instruction Fuzzy Hash: A5215135714B4882FBC68B66B95436953A2EB8CFD0F149521FE1A43B15EE7CC68D9B00

Function 000000018001D420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001D449

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001D482
VirtualFree.KERNEL32 ref: 000000018001D4AC
VirtualFree.KERNEL32 ref: 000000018001D504
VirtualFree.KERNEL32 ref: 000000018001D52E
ShellExecuteW.SHELL32 ref: 000000018001D55A
ShellExecuteW.SHELL32 ref: 000000018001D589

Strings

open, xrefs: 000000018001D551, 000000018001D580

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$ExecuteLeaveShell$Initializememset
String ID: open
API String ID: 3986399138-2758837156
Opcode ID: df41ce004a0aaed4cbd927262bd2ebd9c58ead5be3ffc2416f51e3800e93ca49
Instruction ID: 1b8a6c642bf93aa42689e3d3a50d3f6becf4bfffa3bac452e60f994c4d2ec9e9
Opcode Fuzzy Hash: df41ce004a0aaed4cbd927262bd2ebd9c58ead5be3ffc2416f51e3800e93ca49
Instruction Fuzzy Hash: 7D418032304B4886EBA5DF62E59479A73A1FB8CBC4F448115EB8A43F54DF39D259CB00

Function 000000018002A7F0 Relevance: 13.7, APIs: 9, Instructions: 171COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 000000018002A865
VirtualFree.KERNEL32 ref: 000000018002A88F
VirtualFree.KERNEL32 ref: 000000018002A9EB
VirtualFree.KERNEL32 ref: 000000018002AA15

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7fc2db687d2db18f914aee26642cc12e023eef4ef06861d8de73db2aff1532c5
Instruction ID: aea3e42844f27a4b6fcd00041571d0e8665cba4bdf9a2ae2b4636f6f6e3ab17e
Opcode Fuzzy Hash: 7fc2db687d2db18f914aee26642cc12e023eef4ef06861d8de73db2aff1532c5
Instruction Fuzzy Hash: AA513E36305B0487EB96DF26EA547A96361FB8DBC1F048025EF4A47B54DF38D2AA9700

Function 0000000180026810 Relevance: 13.7, APIs: 9, Instructions: 162stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

NetUserEnum.NETAPI32 ref: 000000018002688C
lstrlenW.KERNEL32 ref: 00000001800268CE
NetApiBufferFree.NETAPI32 ref: 0000000180026929
malloc.MSVCRT ref: 0000000180026945
VirtualFree.KERNEL32 ref: 00000001800269F7
VirtualFree.KERNEL32 ref: 0000000180026A21
free.MSVCRT ref: 0000000180026A2A
VirtualFree.KERNEL32 ref: 0000000180026A54
VirtualFree.KERNEL32 ref: 0000000180026A7E

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocFree$EnterRead$Leave$BufferEnumInitializeUserfreelstrlenmalloc
String ID:
API String ID: 1638303497-0
Opcode ID: 65d04138dd441912b688736d00cc8846464790f10e23658900d22c822e7612d9
Instruction ID: 9d01f30fdecdfa47eab4b76daec8ef7d272a8d152d8755b9856a203f9184ed57
Opcode Fuzzy Hash: 65d04138dd441912b688736d00cc8846464790f10e23658900d22c822e7612d9
Instruction Fuzzy Hash: 62616032711B8486DBA5CF22E45439E73A4FB8DF85F148115EE8A43B64DF38C588C700

Function 0000000180060770 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000018006078C
memset.NTDLL ref: 00000001800607B0
RtlCaptureContext.KERNEL32 ref: 00000001800607B9
RtlLookupFunctionEntry.KERNEL32 ref: 00000001800607D3
RtlVirtualUnwind.KERNEL32 ref: 0000000180060814
memset.NTDLL ref: 0000000180060847
IsDebuggerPresent.KERNEL32 ref: 0000000180060868
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180060889
UnhandledExceptionFilter.KERNEL32 ref: 0000000180060894

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: fced86a50b5f4d5d3129ffe2981d026b2ee8365b80e06c9babcd097b05baaf7f
Instruction ID: 0ffb4c5fbcd34b747e6f469b42c1a821251671632104904ca667225ffb1171b8
Opcode Fuzzy Hash: fced86a50b5f4d5d3129ffe2981d026b2ee8365b80e06c9babcd097b05baaf7f
Instruction Fuzzy Hash: EB315272205B8489EBA18F60E8503EE7365F748784F54852AEB9D47B94EF38C64CC710

Function 0000000180030180 Relevance: 13.6, APIs: 9, Instructions: 60serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001800301A8
GetLastError.KERNEL32 ref: 00000001800301B6

Part of subcall function 0000000180012760: VirtualFree.KERNEL32 ref: 00000001800127E5
Part of subcall function 0000000180012760: VirtualFree.KERNEL32 ref: 000000018001280F

OpenServiceW.ADVAPI32 ref: 00000001800301E1
GetLastError.KERNEL32 ref: 00000001800301EF
CloseServiceHandle.ADVAPI32 ref: 0000000180030205

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorFreeLastOpenServiceVirtual$CloseHandleManager
String ID:
API String ID: 3563172158-0
Opcode ID: ce12c43ad3cf74fd47867ee24130c725be5bd76402bb544879ce041abdb63390
Instruction ID: d853d0b98551e1dd37f12d62e368e99fc344b7ef29ec276600ea8822682d95be
Opcode Fuzzy Hash: ce12c43ad3cf74fd47867ee24130c725be5bd76402bb544879ce041abdb63390
Instruction Fuzzy Hash: D6217234755B4942FBD69B63AC243AA53A2AF4CFD0F148424AE1B43B55EE3CC64D9700

Function 000000018004A830 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000000018004A85D
socket.WS2_32 ref: 000000018004A87B
htonl.WS2_32 ref: 000000018004A89A
bind.WS2_32 ref: 000000018004A8C1
getsockname.WS2_32 ref: 000000018004A8E6

Strings

lws_plat_pipe_create, xrefs: 000000018004A900
%s: failed, xrefs: 000000018004A90C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: socket$bindgetsocknamehtonl
String ID: %s: failed$lws_plat_pipe_create
API String ID: 858234250-3012564250
Opcode ID: 3e06797931bfed255cca20481481bcc32daeca8df7cbd3f6bce5922f777b38ac
Instruction ID: 171ef0a4507c028552a7e679f9d6c5b90a4d9efde4cac8bac7dc40c3e90f5e81
Opcode Fuzzy Hash: 3e06797931bfed255cca20481481bcc32daeca8df7cbd3f6bce5922f777b38ac
Instruction Fuzzy Hash: 5B219532714B9492E7818F24E8443DA3361EB49BE8F585335EA79473E8DF34CA89C745

Function 0000000180032660 Relevance: 12.2, APIs: 8, Instructions: 180commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000000018003267C
CoInitializeSecurity.OLE32 ref: 00000001800326B5
CoCreateInstance.OLE32 ref: 00000001800326EF
VariantInit.OLEAUT32 ref: 0000000180032706
SysAllocString.OLEAUT32 ref: 00000001800327DA
SysFreeString.OLEAUT32 ref: 00000001800327FA
VirtualFree.KERNEL32 ref: 00000001800328CD
VirtualFree.KERNEL32 ref: 00000001800328F7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Free$InitializeStringVirtual$AllocCreateInitInstanceSecurityVariant
String ID:
API String ID: 1458724981-0
Opcode ID: a98515b45f30c999fd584888f1fb30ce494dfbb6bf43997bf48997d6c69b94f9
Instruction ID: 549c418005b411b6b48b9dc52a4b3670d67e6df93f8f4fd9b1b4d3b19c29d487
Opcode Fuzzy Hash: a98515b45f30c999fd584888f1fb30ce494dfbb6bf43997bf48997d6c69b94f9
Instruction Fuzzy Hash: 06816D32614B9486EB52CF66E84879E77B5FB8CF94F118216EE4947B58DF38C249CB00

Function 000000018002F1B0 Relevance: 12.1, APIs: 8, Instructions: 68clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 000000018002F209
Sleep.KERNEL32 ref: 000000018002F216
GetLastError.KERNEL32 ref: 000000018002F223
GlobalAlloc.KERNEL32 ref: 000000018002F244
GlobalLock.KERNEL32 ref: 000000018002F255
GlobalUnlock.KERNEL32 ref: 000000018002F26C
SetClipboardData.USER32 ref: 000000018002F27A
CloseClipboard.USER32 ref: 000000018002F280

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataErrorLastLockOpenSleepUnlock
String ID:
API String ID: 3499886738-0
Opcode ID: 4b723c17ec104936dfe9111a579a009fbd450c761b1b8f465c76b1695d4f4b3d
Instruction ID: 80f6778766f7b10afb52bff45b6d567137dcc008b4616613c89e7630be8ac35f
Opcode Fuzzy Hash: 4b723c17ec104936dfe9111a579a009fbd450c761b1b8f465c76b1695d4f4b3d
Instruction Fuzzy Hash: BC21A136324A5483DAA69B61F88436D63A1FB8DFC0F549124FA5743B58EF38C9998B00

Function 0000000180063770 Relevance: 10.6, APIs: 7, Instructions: 149pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000000018006379C
_getdrive.MSVCRT ref: 00000001800637FC
GetFileInformationByHandle.KERNEL32 ref: 0000000180063828
_errno.MSVCRT ref: 00000001800638D2
_errno.MSVCRT ref: 0000000180063904
GetLastError.KERNEL32 ref: 0000000180063913
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,0000000180063697), ref: 0000000180063964

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: File_errno$ErrorHandleInformationLastNamedPeekPipeType_getdrive
String ID:
API String ID: 3135900542-0
Opcode ID: 3dc6ecccb6be3afdbef7dbbd49be3c0297514fd0acc6620c2216f9eee7634cd3
Instruction ID: 6f05e2a8eb8dd371f599fb736fa6b55fafaf9b36043a0ea6e0bc6e624f6d7854
Opcode Fuzzy Hash: 3dc6ecccb6be3afdbef7dbbd49be3c0297514fd0acc6620c2216f9eee7634cd3
Instruction Fuzzy Hash: 9D51D4726147488AEBE18F24D8527ED73A2E798BC8F30C115F66947785DF78C648CB90

Function 00000001800244B0 Relevance: 10.2, APIs: 8, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180024504
VirtualFree.KERNEL32 ref: 000000018002452E
VirtualAlloc.KERNEL32 ref: 0000000180024545
VirtualFree.KERNEL32 ref: 000000018002463C
VirtualFree.KERNEL32 ref: 0000000180024666
VirtualFree.KERNEL32 ref: 000000018002468B
VirtualFree.KERNEL32 ref: 00000001800246B5
VirtualFree.KERNEL32 ref: 00000001800246DA

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 596298e50b01ed8f643993e2f4d92b6ac2ecaa8b621bb896cb70dc7b0923128e
Instruction ID: 64ae41a8cee7ab66ca288a66ccfc0691979ea804a72ad088179f8830a55565e0
Opcode Fuzzy Hash: 596298e50b01ed8f643993e2f4d92b6ac2ecaa8b621bb896cb70dc7b0923128e
Instruction Fuzzy Hash: 7C612D36601F4486EBA6DF62E85479A73A5FB4CB80F55C125EE8A43B24EF38D258C740

Function 00000001800257C0 Relevance: 10.2, APIs: 8, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180025814
VirtualFree.KERNEL32 ref: 000000018002583E
VirtualAlloc.KERNEL32 ref: 0000000180025855
VirtualFree.KERNEL32 ref: 000000018002594C
VirtualFree.KERNEL32 ref: 0000000180025976
VirtualFree.KERNEL32 ref: 000000018002599B
VirtualFree.KERNEL32 ref: 00000001800259C5
VirtualFree.KERNEL32 ref: 00000001800259EA

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 2398d3e56b10dcafaaf99b981a30711067a2213169235feba3d334b158cf1ca3
Instruction ID: 52c6f64c64522746488a48a2738a721751fb02ae6e97e406a9f0e7fa2333df47
Opcode Fuzzy Hash: 2398d3e56b10dcafaaf99b981a30711067a2213169235feba3d334b158cf1ca3
Instruction Fuzzy Hash: 79614E32601F4486EBA6DF22F45479A73A5FB8CB81F55C125EE8A43B24EF38D258C744

Function 0000000180025340 Relevance: 10.1, APIs: 8, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180025394
VirtualFree.KERNEL32 ref: 00000001800253BE
VirtualAlloc.KERNEL32 ref: 00000001800253D5
VirtualFree.KERNEL32 ref: 00000001800254C1
VirtualFree.KERNEL32 ref: 00000001800254EB
VirtualFree.KERNEL32 ref: 0000000180025510
VirtualFree.KERNEL32 ref: 000000018002553A
VirtualFree.KERNEL32 ref: 000000018002555F

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: a2f3d28db6f5c7a542f089183b464a35e1dffb07d7f729c69724856baa88be71
Instruction ID: e1ed2f7b30fdbbafaf83607e2b920250547d7d04a51b70330a41ad624c924d4a
Opcode Fuzzy Hash: a2f3d28db6f5c7a542f089183b464a35e1dffb07d7f729c69724856baa88be71
Instruction Fuzzy Hash: D6614E36601F4486EBA6DF22E85479A73A5FB8CB81F44C125EE8A43B14EF38D258D744

Function 0000000180025590 Relevance: 10.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800255E4
VirtualFree.KERNEL32 ref: 000000018002560E
VirtualAlloc.KERNEL32 ref: 0000000180025625
VirtualFree.KERNEL32 ref: 00000001800256FB
VirtualFree.KERNEL32 ref: 0000000180025725
VirtualFree.KERNEL32 ref: 000000018002574A
VirtualFree.KERNEL32 ref: 0000000180025774
VirtualFree.KERNEL32 ref: 0000000180025799

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: c4c301c77432ef5703f60f68f188faa43b288a4f8a8c10df986e60a82f244a90
Instruction ID: a098d769e738cf4516be0d4c0e9b8bb2eaeea588b20fa9ae2b6ee3b858d7c8c5
Opcode Fuzzy Hash: c4c301c77432ef5703f60f68f188faa43b288a4f8a8c10df986e60a82f244a90
Instruction Fuzzy Hash: EB514F36711F4486EBA6CF22E85479A73A5FB8CB81F44C125EE8A43B14DF38D2588744

Function 0000000180024700 Relevance: 10.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180024754
VirtualFree.KERNEL32 ref: 000000018002477E
VirtualAlloc.KERNEL32 ref: 0000000180024795
VirtualFree.KERNEL32 ref: 000000018002486B
VirtualFree.KERNEL32 ref: 0000000180024895
VirtualFree.KERNEL32 ref: 00000001800248BA
VirtualFree.KERNEL32 ref: 00000001800248E4
VirtualFree.KERNEL32 ref: 0000000180024909

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 80f34942a8f8c4bc9a5d5aa5a2718efda92b851cc4559cc26846c331e5552837
Instruction ID: 72a2896740c9137efb1b418fa442e73962727cb62168e6376ed2afb5ae8d32a4
Opcode Fuzzy Hash: 80f34942a8f8c4bc9a5d5aa5a2718efda92b851cc4559cc26846c331e5552837
Instruction Fuzzy Hash: 6C516E36711F4486EBA6CF62E85479A73A5FB8CB80F45C124EE8A43B14DF38D258C740

Function 0000000180024930 Relevance: 10.1, APIs: 8, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180024984

Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D3D
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D50
Part of subcall function 0000000180014D20: CloseHandle.KERNEL32 ref: 0000000180014D66
Part of subcall function 0000000180014D20: DeleteCriticalSection.KERNEL32 ref: 0000000180014D8D
Part of subcall function 0000000180014D20: VirtualFree.KERNEL32 ref: 0000000180014DBA

VirtualFree.KERNEL32 ref: 00000001800249AE
VirtualAlloc.KERNEL32 ref: 00000001800249C5
VirtualFree.KERNEL32 ref: 0000000180024A90
VirtualFree.KERNEL32 ref: 0000000180024ABA
VirtualFree.KERNEL32 ref: 0000000180024ADF
VirtualFree.KERNEL32 ref: 0000000180024B09
VirtualFree.KERNEL32 ref: 0000000180024B2E

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: d577543977fa0da55da5beeaf9c154f68529e181afdaea789ff489f112afd6f9
Instruction ID: cae2041a7490879f6122b9c6866ac4f26f8c704f9ffb2fa0f11d788942084910
Opcode Fuzzy Hash: d577543977fa0da55da5beeaf9c154f68529e181afdaea789ff489f112afd6f9
Instruction Fuzzy Hash: 73514E32701B4486EBA6DF22E85479A73A5FB8CBC0F05C125EE8A43B14DF38D2588744

Function 0000000180012830 Relevance: 7.6, APIs: 5, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,00001000,000000018001228E), ref: 000000018001284A
GetModuleHandleW.KERNEL32(?,?,00001000,000000018001228E), ref: 000000018001285D
GetModuleHandleW.KERNEL32(?,?,00001000,000000018001228E), ref: 0000000180012888
VirtualProtect.KERNEL32(?,?,00001000,000000018001228E), ref: 00000001800128BC
VirtualProtect.KERNEL32(?,?,00001000,000000018001228E), ref: 00000001800128D7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: HandleModule$ProtectVirtual
String ID:
API String ID: 3544755384-0
Opcode ID: f336a93fce01c34d2cdd8dc85c5afcd615c05bd6414b2de0b853565f956b5444
Instruction ID: a2d771934d000c58fcc9031eaded12856c90504e436152513d678f0d3ac56f1b
Opcode Fuzzy Hash: f336a93fce01c34d2cdd8dc85c5afcd615c05bd6414b2de0b853565f956b5444
Instruction Fuzzy Hash: 29216D32612B4886EB968F15F85439973A0FB4CBD5F548126FA5A03794EF38C6A9C740

Function 0000000180062327 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

wctomb_s.MSVCRT ref: 000000018006238D

Strings

0, xrefs: 00000001800626B7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: wctomb_s
String ID: 0
API String ID: 2215178078-4108050209
Opcode ID: 1492f7c15eab4061bc7f6a32edb82fc2110c3162b8146593b7aa99b753d1092c
Instruction ID: b78a43dfde99f40485895c579130c87ca7fca1f2de56ca6245298c2957896ae2
Opcode Fuzzy Hash: 1492f7c15eab4061bc7f6a32edb82fc2110c3162b8146593b7aa99b753d1092c
Instruction Fuzzy Hash: 76D1B372204F8886DBA68F28C84079C77A2F349BD8F749215EF6947798DF35CA89C750

Function 00000001800642E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018006430D

Strings

gfffffff, xrefs: 00000001800645C6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno
String ID: gfffffff
API String ID: 2918714741-1523873471
Opcode ID: 50460a0e52648f72767fa19e63171c8a82114c62844ae90395d0efa7ecbc3a04
Instruction ID: d8f414e0bef8b82fe1a4a168c370e8312f43b1049c0ea29667bfe1c97a47490c
Opcode Fuzzy Hash: 50460a0e52648f72767fa19e63171c8a82114c62844ae90395d0efa7ecbc3a04
Instruction Fuzzy Hash: D39115B37057C986EBA28F29E9513EA7792A7657C0F148022EB994B7C1DF3CC259C701

Function 00000001800367B8 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 410COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 0000000180036739
unknown header flags set, xrefs: 00000001800367FF
header crc mismatch, xrefs: 0000000180036C50

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-1578397619
Opcode ID: e25e35bceeda68fd401eb5c3d57224b9677d2a7e1ffcce3a57853ce86f0d9926
Instruction ID: 5fbcd8546d4c2baf4d7c5694415ebe309d501ad50e67c97bd790a69d028e859a
Opcode Fuzzy Hash: e25e35bceeda68fd401eb5c3d57224b9677d2a7e1ffcce3a57853ce86f0d9926
Instruction Fuzzy Hash: 0D028172A006588BE7AB8F25C5443AE7BB0F308788F16C519EF5957BA0DF74D668CB40

Function 000000018004C410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 000000018004C48B
memmove.MSVCRT ref: 000000018004C50E

Strings

#, xrefs: 000000018004C53F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _readmemmove
String ID: #
API String ID: 2793665766-1885708031
Opcode ID: 987fd676393602e5fbf9a4f4c9d3c45c4ce8d85387bfab112573a77dbf0a2f81
Instruction ID: 204fe7763e42409cfe4ae1be45cc68f9e315ee3c51830df5655797995f9cd38c
Opcode Fuzzy Hash: 987fd676393602e5fbf9a4f4c9d3c45c4ce8d85387bfab112573a77dbf0a2f81
Instruction Fuzzy Hash: CB411C33224F9895FBF28A65A580BFEA691F3C87C8F069111FE4903684DF74D68C8B45

Function 00000001800138D0 Relevance: 5.2, APIs: 4, Instructions: 215memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180013A07
VirtualAlloc.KERNEL32 ref: 0000000180013A27
VirtualFree.KERNEL32 ref: 0000000180013A63
VirtualFree.KERNEL32 ref: 0000000180013B36

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 04065c5e2a1c05127fb750dc6d994f61d80097cc70ac26d1f1ef4872fede59b7
Instruction ID: 5b382ee37adfeb0f04d4f502de3e1eb60bf9a47383fd2d17446f52300043a7dc
Opcode Fuzzy Hash: 04065c5e2a1c05127fb750dc6d994f61d80097cc70ac26d1f1ef4872fede59b7
Instruction Fuzzy Hash: 6081C332714F8442EB568B3695857AE6351FBDABC0F109615EF8A53B50EF38D2598700

Function 0000000180023464 Relevance: 5.1, APIs: 4, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001442D
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001445F
Part of subcall function 0000000180014410: InitializeCriticalSection.KERNEL32 ref: 0000000180014474
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 0000000180014490
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 00000001800144A3
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 00000001800144BA
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 00000001800144E9
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 00000001800144FE
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 0000000180014511
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014528
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 0000000180014557
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 000000018001456C
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 000000018001457F
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014596

VirtualAlloc.KERNEL32 ref: 0000000180023503

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180023548
VirtualFree.KERNEL32 ref: 000000018002357E
VirtualFree.KERNEL32 ref: 000000018002358F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$Leave$Free$Initialize
String ID:
API String ID: 4189992183-0
Opcode ID: a25cbe2398620dd5aade8412fca36b0dba362fd9746facf50c7945402be94b72
Instruction ID: b7787bbd8a325aeebdcde614afb160aa7d11d0e3a8624fbc1606faf4384ac525
Opcode Fuzzy Hash: a25cbe2398620dd5aade8412fca36b0dba362fd9746facf50c7945402be94b72
Instruction Fuzzy Hash: 6931C572301B8486EB878F26E95439977A1BF4DFD4F08C125EE5A87B45DF28C569C700

Function 0000000180013330 Relevance: 64.1, APIs: 51, Instructions: 358memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
IsBadReadPtr.KERNEL32 ref: 00000001800133BC
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
IsBadReadPtr.KERNEL32 ref: 0000000180013427
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
IsBadReadPtr.KERNEL32 ref: 0000000180013492
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134EB
IsBadReadPtr.KERNEL32 ref: 00000001800134FD
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013510
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013527
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013556
IsBadReadPtr.KERNEL32 ref: 0000000180013568
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001357B
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013592
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135C1
IsBadReadPtr.KERNEL32 ref: 00000001800135D3
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135E6
VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135FD
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001362C
IsBadReadPtr.KERNEL32 ref: 000000018001363E
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013654
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013678
IsBadReadPtr.KERNEL32 ref: 0000000180013691
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136A7
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136CB
IsBadReadPtr.KERNEL32 ref: 00000001800136E4
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800136FA
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013726
IsBadReadPtr.KERNEL32 ref: 000000018001373F
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013755
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013779
IsBadReadPtr.KERNEL32 ref: 0000000180013792
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800137A8
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800137CC
IsBadReadPtr.KERNEL32 ref: 00000001800137E5
EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800137FB
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013826
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001384B
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001385D
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001386F
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013881
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013893
LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800138A5

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead$AllocVirtual$Initialize
String ID:
API String ID: 3051317124-0
Opcode ID: 6ebc8dea4b0ea736fefb6cc6a4b904e09ee724be14cbd8c2d79b4aff0744f4dc
Instruction ID: 8d79aea406c2d95edea1836f54f9f7be0f00163c332968c48641294727d518e6
Opcode Fuzzy Hash: 6ebc8dea4b0ea736fefb6cc6a4b904e09ee724be14cbd8c2d79b4aff0744f4dc
Instruction Fuzzy Hash: 9AF1F972200F4986EB9A8F21E8153A973A5FB5CFC4F58C525EE5A477A4EF38D658C300

Function 000000018004C060 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB54
Part of subcall function 000000018004BB10: Sleep.KERNEL32 ref: 000000018004BB6D
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB83
Part of subcall function 000000018004BB10: _close.MSVCRT ref: 000000018004BB8E
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BBA3
Part of subcall function 000000018004BB10: _unlink.MSVCRT ref: 000000018004BBB4

_unlink.MSVCRT ref: 000000018004C0C2
_open.MSVCRT ref: 000000018004C0D5
_write.MSVCRT ref: 000000018004C0F3
_write.MSVCRT ref: 000000018004C110
_write.MSVCRT ref: 000000018004C12F
_close.MSVCRT ref: 000000018004C18F
_unlink.MSVCRT ref: 000000018004C1A0
rename.MSVCRT ref: 000000018004C1AE
_close.MSVCRT ref: 000000018004C1DA
_unlink.MSVCRT ref: 000000018004C1E4
_close.MSVCRT ref: 000000018004C209
_unlink.MSVCRT ref: 000000018004C216

Strings

nsc_regen, xrefs: 000000018004C081
# Netscape HTTP Cookie File, xrefs: 000000018004C0EC
%s.LCK, xrefs: 000000018004C1ED
%s.tmp, xrefs: 000000018004C0A9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _unlink$_close_open$_write$Sleeprename
String ID: # Netscape HTTP Cookie File$%s.LCK$%s.tmp$nsc_regen
API String ID: 3831667237-754349171
Opcode ID: 5ad480a65cf6fe72315309d2af5a2d32d7a8d9a5e723e02816f8326c51347cc7
Instruction ID: 3a75f7037613c534b31f398f9f7e10cfc46e488a0411f9bffbb7e4ffe011920f
Opcode Fuzzy Hash: 5ad480a65cf6fe72315309d2af5a2d32d7a8d9a5e723e02816f8326c51347cc7
Instruction Fuzzy Hash: 8D41C632204B4882F792EF21E8907D97361F7897C8F658026FA994B696CF79CA09C740

Function 000000018003D3D0 Relevance: 27.5, APIs: 1, Strings: 17, Instructions: 460COMMON

Download Yara Rule

APIs

Part of subcall function 000000018004A990: WSAStartup.WS2_32 ref: 000000018004A9A1

memset.NTDLL ref: 000000018003D7E4

Strings

OOM, xrefs: 000000018003DC20
context, xrefs: 000000018003D46F
NSC, xrefs: 000000018003DAC1
lws_free, xrefs: 000000018003DC0D
mux, xrefs: 000000018003D584
lws_create_context, xrefs: 000000018003D844, 000000018003DA7C, 000000018003DBE9
prot_init, xrefs: 000000018003DA00
wsi, xrefs: 000000018003D55A
info->ka_interval can't be 0 if ka_time used, xrefs: 000000018003D831
OOM allocating %d fds, xrefs: 000000018003DBDD
wsisrv, xrefs: 000000018003D576
system, xrefs: 000000018003D9E4
Failed to init cookiejar, xrefs: 000000018003DB69
wsicli, xrefs: 000000018003D592
Failed to create default vhost, xrefs: 000000018003DA5F
unknown, xrefs: 000000018003D9D2
fds table, xrefs: 000000018003D863

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Startupmemset
String ID: Failed to create default vhost$Failed to init cookiejar$NSC$OOM$OOM allocating %d fds$context$fds table$info->ka_interval can't be 0 if ka_time used$lws_create_context$lws_free$mux$prot_init$system$unknown$wsi$wsicli$wsisrv
API String ID: 1873301828-3289243303
Opcode ID: 16ff8c9513e61e8d05d3a42471cc09235c13313f4bf578ebfff565fe686a6f90
Instruction ID: 3b559553d32f2118d47c1827e12155a903dd1219b53e8335ef171119bd7a8236
Opcode Fuzzy Hash: 16ff8c9513e61e8d05d3a42471cc09235c13313f4bf578ebfff565fe686a6f90
Instruction Fuzzy Hash: 29325F36605B8985EB96CF21F8803EA73A5F748B88F458136EE9D47394EF38D258C750

Function 000000018002D5A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 124memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000000018002D62F
CoCreateInstance.OLE32 ref: 000000018002D654
CoCreateInstance.OLE32 ref: 000000018002D68A
CoUninitialize.OLE32 ref: 000000018002D6A8
SysAllocString.OLEAUT32 ref: 000000018002D6D0
SysAllocString.OLEAUT32 ref: 000000018002D6E0
SysAllocString.OLEAUT32 ref: 000000018002D6F0
SysFreeString.OLEAUT32 ref: 000000018002D76A
SysFreeString.OLEAUT32 ref: 000000018002D773
SysFreeString.OLEAUT32 ref: 000000018002D77C
CoUninitialize.OLE32 ref: 000000018002D7A0

Strings

Block all outbound traffic, xrefs: 000000018002D6D6
i33L, xrefs: 000000018002D5B7
BlockAllGroup, xrefs: 000000018002D6E6
Block All Outbound, xrefs: 000000018002D6BF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: String$AllocFree$CreateInstanceUninitialize$Initialize
String ID: Block All Outbound$Block all outbound traffic$BlockAllGroup$i33L
API String ID: 2562062002-1644180588
Opcode ID: 8deb0ea224b165b1f84c5336fa06fe8aa485b50349956e7146a47af700a7992b
Instruction ID: 24ee4ad5e576ebab54034bfc9a1020dbb273c5f654aeecea88066f1c8707723b
Opcode Fuzzy Hash: 8deb0ea224b165b1f84c5336fa06fe8aa485b50349956e7146a47af700a7992b
Instruction Fuzzy Hash: 9951D276600B448AEB41DF76D84439C37B1F788B88F208526EE5E57B28DF38C659C741

Function 00000001800236D0 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00000001800236F4
ProcessIdToSessionId.KERNEL32 ref: 0000000180023704
memset.NTDLL ref: 0000000180023717
wsprintfW.USER32 ref: 0000000180023734
GetCurrentProcess.KERNEL32 ref: 0000000180023748
TerminateProcess.KERNEL32 ref: 0000000180023753
memset.NTDLL ref: 0000000180023769
wsprintfW.USER32 ref: 0000000180023789
GetCurrentProcess.KERNEL32 ref: 00000001800237A8
TerminateProcess.KERNEL32 ref: 00000001800237B3
WaitForSingleObject.KERNEL32 ref: 00000001800237CA
GetCurrentProcess.KERNEL32 ref: 00000001800237D4
TerminateProcess.KERNEL32 ref: 00000001800237DF

Strings

\\.\Pipe\%d_Local_%d, xrefs: 0000000180023776
\\.\Pipe\%d_pipe%d, xrefs: 0000000180023724

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process$Current$Terminate$memsetwsprintf$ObjectSessionSingleWait
String ID: \\.\Pipe\%d_Local_%d$\\.\Pipe\%d_pipe%d
API String ID: 1631145905-82101934
Opcode ID: ab10d55d452ab6b41233c7c6c5d6ad339ec73cd5f29839cb69e3900e23e60465
Instruction ID: 2ca27b65026b01a0e2614ebc2938c806b5a8a65987fe76e9e7616e4d15ed07f3
Opcode Fuzzy Hash: ab10d55d452ab6b41233c7c6c5d6ad339ec73cd5f29839cb69e3900e23e60465
Instruction Fuzzy Hash: 4B318675304B8982EBA29B21EC543DA63A2FB8CFC5F14C115E95A43664EE3CC74DD710

Function 0000000180021760 Relevance: 25.7, APIs: 17, Instructions: 151networkmemorysleepCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 0000000180021780
setsockopt.WS2_32 ref: 00000001800217DC
setsockopt.WS2_32 ref: 0000000180021800
setsockopt.WS2_32 ref: 000000018002182B
WSAIoctl.WS2_32 ref: 0000000180021881
setsockopt.WS2_32 ref: 00000001800218B0

Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001442D
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001445F
Part of subcall function 0000000180014410: InitializeCriticalSection.KERNEL32 ref: 0000000180014474
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 0000000180014490
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 00000001800144A3
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 00000001800144BA
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 00000001800144E9
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 00000001800144FE
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 0000000180014511
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014528
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 0000000180014557
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 000000018001456C
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 000000018001457F
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014596

VirtualAlloc.KERNEL32 ref: 00000001800218D5
CreateThread.KERNEL32 ref: 0000000180021927
IsBadReadPtr.KERNEL32 ref: 000000018002193F
EnterCriticalSection.KERNEL32 ref: 0000000180021952
VirtualAlloc.KERNEL32 ref: 0000000180021968
LeaveCriticalSection.KERNEL32 ref: 000000018002198C
CancelIo.KERNEL32 ref: 000000018002199F
closesocket.WS2_32 ref: 00000001800219A8
VirtualFree.KERNEL32 ref: 00000001800219B9
Sleep.KERNEL32 ref: 00000001800219C2
accept.WS2_32 ref: 00000001800219D1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterReadsetsockopt$Leave$accept$CancelCreateFreeInitializeIoctlSleepThreadclosesocket
String ID:
API String ID: 241427152-0
Opcode ID: 8054d77f63a71bffb60c6de152fa376652fa5a9bac917f7a9e8e23a3707f0d6a
Instruction ID: db9d5a1902b2427f2b8aa5890d40cac3057804daef993d423312326c5f4ee3cf
Opcode Fuzzy Hash: 8054d77f63a71bffb60c6de152fa376652fa5a9bac917f7a9e8e23a3707f0d6a
Instruction Fuzzy Hash: 3D61A072204B8586EBA58F11E8147DA77A5FB8CB85F148229EF8A07B54DF3DC65DCB00

Function 0000000180048110 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 338stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00000001800482FC

Part of subcall function 0000000180047FD0: strncmp.MSVCRT ref: 0000000180048027

_stricmp.MSVCRT ref: 00000001800483F2
_stricmp.MSVCRT ref: 0000000180048405
strchr.MSVCRT ref: 000000018004849D
atoi.MSVCRT ref: 00000001800484B1
_stricmp.MSVCRT ref: 00000001800484F3
_stricmp.MSVCRT ref: 000000018004851B

Strings

h2n, xrefs: 0000000180048597
lws_handshake_server, xrefs: 000000018004815C, 000000018004817B, 00000001800486AF
%s: bad wsi role 0x%x, xrefs: 00000001800486B6
h2c, xrefs: 00000001800483FB, 0000000180048511
%s: assert: NULL ah, xrefs: 0000000180048187
%s: assert: len %ld, xrefs: 0000000180048163
websocket, xrefs: 00000001800483E5, 00000001800484E9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _stricmp$atoistrchrstrncmpstrstr
String ID: %s: assert: NULL ah$%s: assert: len %ld$%s: bad wsi role 0x%x$h2c$h2n$lws_handshake_server$websocket
API String ID: 772635384-2030653601
Opcode ID: 3e545e06de1398776efe2b32ebf9aaed83d313d5bc47e434b252dda6cce64d6b
Instruction ID: d49f17e4c13066866941a8c03b63ad3af1a2a4addf82eecd73d35d4d049f7a5d
Opcode Fuzzy Hash: 3e545e06de1398776efe2b32ebf9aaed83d313d5bc47e434b252dda6cce64d6b
Instruction Fuzzy Hash: 74E1B131304B8951FAE69B269A803EE6352AB8D7C8F46C421FE1947792EF38C659D304

Function 000000018002F3F0 Relevance: 24.1, APIs: 16, Instructions: 95keyboardsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F40B
WaitForSingleObject.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F421
CloseHandle.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F430
VirtualFree.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F463
VirtualFree.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F48D
BlockInput.USER32(?,?,?,0000000180024297), ref: 000000018002F49C
CloseHandle.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F4AB
ReleaseDC.USER32 ref: 000000018002F4C0
SelectObject.GDI32 ref: 000000018002F4D1
SelectObject.GDI32 ref: 000000018002F4EC
DeleteObject.GDI32 ref: 000000018002F4FD
DeleteObject.GDI32 ref: 000000018002F50A
DeleteDC.GDI32 ref: 000000018002F514
DeleteDC.GDI32 ref: 000000018002F521
VirtualFree.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F538
VirtualFree.KERNEL32(?,?,?,0000000180024297), ref: 000000018002F556

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Object$DeleteFreeVirtual$CloseHandleSelect$BlockEventInputReleaseSingleWait
String ID:
API String ID: 3967251967-0
Opcode ID: 3a07132e1f9d7ba23aabf59264424579120ae970d8e9deebab850e7ccb55037e
Instruction ID: 294975e9c67eb738fc8a76c6dfbd6f8425bfb77a95e6eb5f1d41b0cb1a161822
Opcode Fuzzy Hash: 3a07132e1f9d7ba23aabf59264424579120ae970d8e9deebab850e7ccb55037e
Instruction Fuzzy Hash: 8E414836201F5481EB96DF62E9503A93366FF88FC4F18C125EE5A47B58DF38C65A8301

Function 0000000180017240 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 96synchronizationpipeCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000000018001725A

Part of subcall function 0000000180028120: VirtualAlloc.KERNEL32(?,?,00000000,0000000180026D58), ref: 0000000180028137
Part of subcall function 0000000180028120: InitializeCriticalSection.KERNEL32(?,?,00000000,0000000180026D58), ref: 0000000180028165

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

memset.NTDLL ref: 0000000180017295
GetCurrentProcessId.KERNEL32 ref: 000000018001729A
wsprintfW.USER32 ref: 00000001800172B6
WaitForSingleObject.KERNEL32 ref: 00000001800172D3
WaitForSingleObject.KERNEL32 ref: 000000018001731B
VirtualFree.KERNEL32 ref: 000000018001733A
VirtualFree.KERNEL32 ref: 0000000180017364
DisconnectNamedPipe.KERNEL32 ref: 000000018001737B
CloseHandle.KERNEL32 ref: 000000018001738A
DeleteCriticalSection.KERNEL32 ref: 0000000180017398
VirtualFree.KERNEL32 ref: 00000001800173A9

Strings

\\.\Pipe\%d_Local_%d, xrefs: 00000001800172A7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Read$EnterFree$InitializeLeaveObjectSingleWait$CloseCurrentDeleteDisconnectHandleNamedPipeProcessmemsetwsprintf
String ID: \\.\Pipe\%d_Local_%d
API String ID: 2297721380-251893267
Opcode ID: 36990aca3978a3dea961cae16a781325bd347a7ac9c8a3c5f6a009e8abbcbd45
Instruction ID: df745b0456b80d04bc256779a35986cf992e6c2ed35c23266841cb860a50cde9
Opcode Fuzzy Hash: 36990aca3978a3dea961cae16a781325bd347a7ac9c8a3c5f6a009e8abbcbd45
Instruction Fuzzy Hash: 10415E35300A4582EBA69B62E8543AE63A1FF8CFC4F54C121EE6A47A95DF3CC7499700

Function 0000000180040950 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0000000180040992
WSAGetLastError.WS2_32 ref: 000000018004099C
WSAIoctl.WS2_32 ref: 0000000180040A1D
WSAGetLastError.WS2_32 ref: 0000000180040A27
getprotobyname.WS2_32 ref: 0000000180040A75
setsockopt.WS2_32 ref: 0000000180040AA2
ioctlsocket.WS2_32 ref: 0000000180040AC3
WSAGetLastError.WS2_32 ref: 0000000180040AD2

Strings

WSAIoctl SIO_KEEPALIVE_VALS 1 %lu %lu failed with error %d, xrefs: 0000000180040A32
TCP, xrefs: 0000000180040A63
setsockopt SO_KEEPALIVE 1 failed with error %d, xrefs: 00000001800409A5
ioctlsocket FIONBIO 1 failed with error %d, xrefs: 0000000180040AD8

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$setsockopt$Ioctlgetprotobynameioctlsocket
String ID: TCP$WSAIoctl SIO_KEEPALIVE_VALS 1 %lu %lu failed with error %d$ioctlsocket FIONBIO 1 failed with error %d$setsockopt SO_KEEPALIVE 1 failed with error %d
API String ID: 689193069-3784515845
Opcode ID: 8a574de51de2f7b9e0da6b50ddb537149f76536c045387673f248ec90f46c37e
Instruction ID: d85322c19fa9419ce3c0f24e89c20480943d0ad7818c6f72330d3572df486373
Opcode Fuzzy Hash: 8a574de51de2f7b9e0da6b50ddb537149f76536c045387673f248ec90f46c37e
Instruction Fuzzy Hash: C641B132604B8486E750CF11E8847D9B7A1F78CBC8F688126EA5843754DF3DCA8DCB40

Function 000000018005032B Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 215stringCOMMON

Download Yara Rule

APIs

_atoi64.MSVCRT ref: 000000018005042A
strncmp.MSVCRT ref: 0000000180050628
_stricmp.MSVCRT ref: 000000018005066F

Strings

dyntable resize last in headers, xrefs: 000000018005033D
Banning service on CLOSED_REMOTE, xrefs: 00000001800506DC
Pseudoheader checks, xrefs: 00000001800506CB
LWS_H2S_IDLE, xrefs: 000000018005065D
Illegal transfer-encoding, xrefs: 0000000180050631
hpack incomplete, xrefs: 000000018005039B
client done, xrefs: 0000000180050529
trailers, xrefs: 000000018005061B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _atoi64_stricmpstrncmp
String ID: Banning service on CLOSED_REMOTE$Illegal transfer-encoding$LWS_H2S_IDLE$Pseudoheader checks$client done$dyntable resize last in headers$hpack incomplete$trailers
API String ID: 3622546912-2715351296
Opcode ID: 850a7d48c15578104734be1d17ab6fe13f68133994dd60894492c7c8482764ff
Instruction ID: 2738031c5a13f8d2a9113236ef16879ec5afd259850b3dca8db5443b4f1c11f3
Opcode Fuzzy Hash: 850a7d48c15578104734be1d17ab6fe13f68133994dd60894492c7c8482764ff
Instruction Fuzzy Hash: DDA15031205A88C9FBE29B25C4953ED2791E788BC8F29C431FE4D5B396DF26C74A8711

Function 0000000180015070 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 46COMMON

Download Yara Rule

APIs

_time64.MSVCRT ref: 00000001800150E0
srand.MSVCRT ref: 00000001800150E9
rand.MSVCRT ref: 0000000180015100

Strings

<=>?, xrefs: 00000001800150D9
0123, xrefs: 00000001800150C4
!"#, xrefs: 00000001800150A8
89:;, xrefs: 00000001800150D2
()*+, xrefs: 00000001800150B6
4567, xrefs: 00000001800150CB
$%&', xrefs: 00000001800150AF
,-./, xrefs: 00000001800150BD

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _time64randsrand
String ID: !"#$$%&'$()*+$,-./$0123$4567$89:;$<=>?
API String ID: 1363323005-2655883160
Opcode ID: 495eb2bc3968464ad3b4467f9e3bb0dc08ae24cb2b23406463a58bd7f9b74657
Instruction ID: c51e40b0117ec8def28ddec8a1b2912ad07eefb3fc6356cac202c9ea0a687b5c
Opcode Fuzzy Hash: 495eb2bc3968464ad3b4467f9e3bb0dc08ae24cb2b23406463a58bd7f9b74657
Instruction Fuzzy Hash: 4A118476B107908EE705CF61A88429D7BB0F308B88F944628DE5A27B0CCB34D241CF51

Function 000000018003E480 Relevance: 18.3, APIs: 8, Strings: 4, Instructions: 336COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 000000018003E6B7
memcpy.NTDLL ref: 000000018003E709
memcpy.NTDLL ref: 000000018003E757
memcpy.NTDLL ref: 000000018003E7A6
memcpy.NTDLL ref: 000000018003E802
memcpy.NTDLL ref: 000000018003E858
memcpy.NTDLL ref: 000000018003E8B2
memcpy.NTDLL ref: 000000018003E902

Strings

(, xrefs: 000000018003E606
client stash, xrefs: 000000018003E5B3
lws_client_connect_via_info, xrefs: 000000018003E482
free, xrefs: 000000018003E59E

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID: ($client stash$free$lws_client_connect_via_info
API String ID: 3510742995-2507652003
Opcode ID: 9fb5c97349f956897b386c71c7d51adbd1a5d1a1ce7cacacf1f16eb9e8c103cd
Instruction ID: fece761c7d5914db26e48d005023e2e74e12c3d64d436247abcb8b77079efcde
Opcode Fuzzy Hash: 9fb5c97349f956897b386c71c7d51adbd1a5d1a1ce7cacacf1f16eb9e8c103cd
Instruction Fuzzy Hash: 12D1A472A04B9846EB978B2599403AA2790F75ABF4F599321EE7E037D1DF38C5968300

Function 000000018005C7B0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 211COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 000000018005C8E5
memcpy.NTDLL ref: 000000018005C93C
memcpy.NTDLL ref: 000000018005C95A
memcpy.NTDLL ref: 000000018005C972

Strings

%s: OOM, xrefs: 000000018005C9FA
%s: can't parse date %.*s, xrefs: 000000018005C9AD
lws_cookie_write_nsc, xrefs: 000000018005C9A2, 000000018005C9D4, 000000018005CADA
%s: malformed c, xrefs: 000000018005CAD3
%.*s%s%.*s%s%llu%.*s%.*s, xrefs: 000000018005CA76
TRUE, xrefs: 000000018005CA0B
lws_free, xrefs: 000000018005CABC
FALSE, xrefs: 000000018005CA16

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy$memchr
String ID: %.*s%s%.*s%s%llu%.*s%.*s$%s: OOM$%s: can't parse date %.*s$%s: malformed c$FALSE$TRUE$lws_cookie_write_nsc$lws_free
API String ID: 1523488950-4097611029
Opcode ID: a1c06f8486ea18e7f7bfbb723cf4af0ea40f4458e0c81876f8efe29b7c23c13a
Instruction ID: 8df87e5d74b452ca54b599032c2b60c22e5bfa1acf36d0dd6c3964ed66178607
Opcode Fuzzy Hash: a1c06f8486ea18e7f7bfbb723cf4af0ea40f4458e0c81876f8efe29b7c23c13a
Instruction Fuzzy Hash: 63918A72301B489AEAA6CF15E5807EA27A0F74CBC8F488126EF4D57B51DF39D269C341

Function 0000000180016430 Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

malloc.MSVCRT ref: 00000001800164D4
memset.NTDLL ref: 00000001800164F0
memcpy.NTDLL ref: 0000000180016565
malloc.MSVCRT ref: 000000018001656F
memset.NTDLL ref: 0000000180016588
memcpy.NTDLL ref: 000000018001659D
free.MSVCRT ref: 00000001800165B4
free.MSVCRT ref: 00000001800165BD
VirtualFree.KERNEL32 ref: 00000001800165D3
VirtualFree.KERNEL32 ref: 00000001800165FD

Strings

18.166.193.8, xrefs: 0000000180016590, 00000001800165A5
1216, xrefs: 000000018001655B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeavefreemallocmemcpymemset$Initialize
String ID: 1216$18.166.193.8
API String ID: 532055762-2156589267
Opcode ID: 4ce7d3970b924012d0fbf1c1f527a2620021745c6c51cf997aeaa958acbe5b0c
Instruction ID: 582e9a51cf9fe368b1d6b2089614ae23831cbc2162aea492bb2fd5e535a51b7f
Opcode Fuzzy Hash: 4ce7d3970b924012d0fbf1c1f527a2620021745c6c51cf997aeaa958acbe5b0c
Instruction Fuzzy Hash: DC517431A14B4486E7A29B26E9443E973A1FF9DBC4F14D214EE9A43B55EF38D3898700

Function 0000000180014220 Relevance: 18.1, APIs: 12, Instructions: 93sleepsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 0000000180014237
Sleep.KERNEL32 ref: 000000018001424C
IsBadReadPtr.KERNEL32 ref: 000000018001426B
EnterCriticalSection.KERNEL32 ref: 0000000180014281
LeaveCriticalSection.KERNEL32 ref: 00000001800142A2
LeaveCriticalSection.KERNEL32 ref: 00000001800142AF
SetEvent.KERNEL32 ref: 000000018001431E
WaitForSingleObject.KERNEL32 ref: 000000018001433F
CloseHandle.KERNEL32 ref: 0000000180014351

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$EventLeave$CloseEnterHandleObjectReadSingleSleepWait
String ID:
API String ID: 1497552152-0
Opcode ID: 3e701f299464fa1840a3c59915c173aa47d40fd4326d99a42f10eb8f84c94787
Instruction ID: b6fb680b84b29870d8408f0db8a669e560a49f39b75c397a2ccc2e4b14d49071
Opcode Fuzzy Hash: 3e701f299464fa1840a3c59915c173aa47d40fd4326d99a42f10eb8f84c94787
Instruction Fuzzy Hash: 95410D32305F45C6EB9A9F22D8503A823A0FB4CFC4F588520FE5A4B764DF38C6998300

Function 000000018002B990 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018002B9B9
memcpy.NTDLL ref: 000000018002B9DD
VirtualAlloc.KERNEL32 ref: 000000018002BA08
memcpy.NTDLL ref: 000000018002BA3D
memcpy.NTDLL ref: 000000018002BA73
memset.NTDLL ref: 000000018002BB0C
ExpandEnvironmentStringsW.KERNEL32 ref: 000000018002BB23
memset.NTDLL ref: 000000018002BB38

Strings

18.166.193.8, xrefs: 000000018002BA48
C:\Program Files\Windows Mail, xrefs: 000000018002BB1C, 000000018002BB2B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy$AllocVirtualmemset$EnvironmentExpandStrings
String ID: 18.166.193.8$C:\Program Files\Windows Mail
API String ID: 791498746-1411162985
Opcode ID: 2b26ddc07f84ee4290e8d8fcb28feba32ce194d0abf94b4343b1801c1ea13578
Instruction ID: d94bfe5a405dcc6a00cd158cabac0fcb932bbc383ae311747216a2a74efef833
Opcode Fuzzy Hash: 2b26ddc07f84ee4290e8d8fcb28feba32ce194d0abf94b4343b1801c1ea13578
Instruction Fuzzy Hash: A971B332A15B8987E752CB28E9517E83760FB9DBC8F14D315EE8953612EF389399C700

Function 0000000180023920 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78stringthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000180023941
ProcessIdToSessionId.KERNEL32 ref: 0000000180023951
memset.NTDLL ref: 00000001800239A9
lstrcmpiW.KERNEL32 ref: 00000001800239CE
lstrcmpiW.KERNEL32 ref: 00000001800239F3
CreateThread.KERNEL32 ref: 0000000180023A61

Strings

TCP, xrefs: 00000001800239BF
HTTP, xrefs: 0000000180023A05
UDP, xrefs: 00000001800239E4

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Processlstrcmpi$CreateCurrentSessionThreadmemset
String ID: HTTP$TCP$UDP
API String ID: 1333632082-3864057669
Opcode ID: 79ca34c42b3aab9032cd5f6da8ec8d408d609f69abcf2edea33bd93b63b32bf1
Instruction ID: f284a5f0d6b5b17f234fedd842583cf4595dc16da8c51406b2e8c17d34ccde1e
Opcode Fuzzy Hash: 79ca34c42b3aab9032cd5f6da8ec8d408d609f69abcf2edea33bd93b63b32bf1
Instruction Fuzzy Hash: 11319631624B8896E791CF21FC543DA73A5FB8CBC4F548226E98A42654EF38C789CB41

Function 0000000180030260 Relevance: 16.6, APIs: 11, Instructions: 101servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001800302AB
OpenServiceW.ADVAPI32 ref: 00000001800302C8
QueryServiceStatus.ADVAPI32 ref: 00000001800302D9
LockServiceDatabase.ADVAPI32 ref: 00000001800302E2
ChangeServiceConfigW.ADVAPI32 ref: 0000000180030340
UnlockServiceDatabase.ADVAPI32 ref: 000000018003034E
CloseServiceHandle.ADVAPI32 ref: 0000000180030357
CloseServiceHandle.ADVAPI32 ref: 0000000180030360
Sleep.KERNEL32 ref: 000000018003036B
VirtualFree.KERNEL32 ref: 0000000180030381
VirtualFree.KERNEL32 ref: 00000001800303AB

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Service$CloseDatabaseFreeHandleOpenVirtual$ChangeConfigLockManagerQuerySleepStatusUnlock
String ID:
API String ID: 3731607402-0
Opcode ID: a9eb4e77f0189a9487206b475b1535da776a34eb102c6930cb2e8e0098df8897
Instruction ID: 5d8b5e5c2509a2156ec9f6ed001428137373d39bb2af93de72171ddb575701ec
Opcode Fuzzy Hash: a9eb4e77f0189a9487206b475b1535da776a34eb102c6930cb2e8e0098df8897
Instruction Fuzzy Hash: 52418235301B4482E7AADF12A824B9A73A9FB8DFD0F65C114EE5603714DF39C649D740

Function 000000018002F590 Relevance: 16.6, APIs: 11, Instructions: 55threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000018002F5A4
GetThreadDesktop.USER32 ref: 000000018002F5AC
memset.NTDLL ref: 000000018002F5C2
GetUserObjectInformationW.USER32 ref: 000000018002F5E5
OpenInputDesktop.USER32 ref: 000000018002F5F5
memset.NTDLL ref: 000000018002F60E
GetUserObjectInformationW.USER32 ref: 000000018002F634
lstrcmpiW.KERNEL32 ref: 000000018002F647
SetThreadDesktop.USER32 ref: 000000018002F654
CloseDesktop.USER32 ref: 000000018002F662
CloseDesktop.USER32 ref: 000000018002F66B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUsermemset$CurrentInputOpenlstrcmpi
String ID:
API String ID: 2480204736-0
Opcode ID: a7e5f87c476b32af149d3a23a836e4c12a9df15ddd786ef6baeaf1639c8a2ace
Instruction ID: eb276260ccc1891881afc150e594b9866f0886d6e094768467674585afdc8472
Opcode Fuzzy Hash: a7e5f87c476b32af149d3a23a836e4c12a9df15ddd786ef6baeaf1639c8a2ace
Instruction Fuzzy Hash: B4215E35314B8496EB65DB11F8587DA73A2FB8CB84F949226EA5A43B54EF3CC309C740

Function 000000018004C5F0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 282COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 000000018004C9D3

Strings

YZ[\X]^_RAW, xrefs: 000000018004C5FC
UDP, xrefs: 000000018004C739
DNS NXDOMAIN, xrefs: 000000018004CA2A
client_connect2, xrefs: 000000018004CA3F
POST, xrefs: 000000018004C691
MQTT, xrefs: 000000018004C69F, 000000018004C849
GET, xrefs: 000000018004C68A
PUT, xrefs: 000000018004C698

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: getaddrinfo
String ID: DNS NXDOMAIN$GET$MQTT$POST$PUT$UDP$YZ[\X]^_RAW$client_connect2
API String ID: 300660673-2214405465
Opcode ID: 0880df214e9cd3c2f1cf25e5b96380e1b1ca444558782d537dd0fee6feb36dbb
Instruction ID: 68e36fe551a056b0132e3184e2ed47a50fea2595561cf4aa0b5d9e6023a6a639
Opcode Fuzzy Hash: 0880df214e9cd3c2f1cf25e5b96380e1b1ca444558782d537dd0fee6feb36dbb
Instruction Fuzzy Hash: C5C1D532214ACC86EBE38B1194907F83790F34ABCCF8AD136FB4646685DF249649C71A

Function 000000018005C4C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 000000018005C540
_mktime64.MSVCRT(?,?,?,?,?,?,00000000,00000000,?,000000018005C99A), ref: 000000018005C69E

Strings

anfebmaraprnayjunjulaugsepoctnovdec, xrefs: 000000018005C501
VUUU, xrefs: 000000018005C5D3

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _mktime64atoi
String ID: VUUU$anfebmaraprnayjunjulaugsepoctnovdec
API String ID: 4184807649-2104782412
Opcode ID: 1c10f032e27ea18b77686cd2d84d617b20476ae09abb30765c8792ea9fbc2fa6
Instruction ID: c2613ff36e010a457e46afe763ee94a76d49c71e9ebcce3f3232a4706abe0a77
Opcode Fuzzy Hash: 1c10f032e27ea18b77686cd2d84d617b20476ae09abb30765c8792ea9fbc2fa6
Instruction Fuzzy Hash: 9C5139726086488FE7A6DB209540BED77D1E35D7D0F549722F69A821C1EF26CB9CCB02

Function 0000000180034090 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 138timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00000001800340C2
malloc.MSVCRT ref: 00000001800340E5
malloc.MSVCRT ref: 000000018003415B
free.MSVCRT ref: 00000001800341A2
malloc.MSVCRT ref: 00000001800342B3
free.MSVCRT ref: 00000001800342E6

Strings

d, xrefs: 0000000180034267
<, xrefs: 000000018003426E
d, xrefs: 0000000180034225

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: malloc$free$Timetime
String ID: <$d$d
API String ID: 3424428123-2034941416
Opcode ID: 67633af4dfc8252cf45609dabaea5b26b53f42197f8e2474752b99a928027a60
Instruction ID: 466f5aad14050bf64cc8956bdc065fa340445efa7d208640b60abaa076653a21
Opcode Fuzzy Hash: 67633af4dfc8252cf45609dabaea5b26b53f42197f8e2474752b99a928027a60
Instruction Fuzzy Hash: F6713E72102B84C6EB96CF21D58439E37E8F748B88F59C528DB982B764DF74C5A8D720

Function 00000001800639F0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

wcsrchr.NTDLL ref: 0000000180063A87
_wcsicmp.NTDLL ref: 0000000180063A9E
_wcsicmp.NTDLL ref: 0000000180063AB1
_wcsicmp.NTDLL ref: 0000000180063AC4
_wcsicmp.NTDLL ref: 0000000180063AD7

Strings

.exe, xrefs: 0000000180063A94
.cmd, xrefs: 0000000180063AA7
.com, xrefs: 0000000180063ACD
.bat, xrefs: 0000000180063ABA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _wcsicmp$wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 2496260227-4019086052
Opcode ID: aaf78908e6856ded87bf450d59c28f7bfc91e0aa7a4343ebb231347f647f7836
Instruction ID: f9354b7791fc2c725eb93ba74bec30147ee32d18ff5a6900e61ec3ccaf05cefc
Opcode Fuzzy Hash: aaf78908e6856ded87bf450d59c28f7bfc91e0aa7a4343ebb231347f647f7836
Instruction Fuzzy Hash: 2B31EF34A1030E85FAE7625589623F712D2D7497D4F68D021E9E2872C0EE5DC78CA382

Function 000000018002E392 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 77processstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018002E3D9
GetSystemDirectoryW.KERNEL32 ref: 000000018002E3EB
lstrcatW.KERNEL32 ref: 000000018002E400
CreateProcessW.KERNEL32 ref: 000000018002E493
CloseHandle.KERNEL32 ref: 000000018002E4A3
CloseHandle.KERNEL32 ref: 000000018002E4B8

Strings

\cmd.exe, xrefs: 000000018002E3F1
WinSta0\Winlogon, xrefs: 000000018002E420
h, xrefs: 000000018002E473

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateDirectoryProcessSystemlstrcatmemset
String ID: WinSta0\Winlogon$\cmd.exe$h
API String ID: 3110162951-1128999311
Opcode ID: 377d92c3c3f7588309b3223c4e866e91415498e2d0b57ba55e9f7e9773e501a6
Instruction ID: 8a8f30963343f0c1642ff8c9ad02eeefcd5bb9c44978aec2e11ef53a48a7f9e7
Opcode Fuzzy Hash: 377d92c3c3f7588309b3223c4e866e91415498e2d0b57ba55e9f7e9773e501a6
Instruction Fuzzy Hash: DB319233958BC582E762CB50E8543DA77A0F7DA784F54C226A6C942A65EF78C298CB00

Function 00000001800353E0 Relevance: 15.1, APIs: 10, Instructions: 145networksynchronizationCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018003541B
memset.NTDLL ref: 00000001800354D6
SetEvent.KERNEL32 ref: 0000000180035536
WSACreateEvent.WS2_32 ref: 000000018003553C
WSAEventSelect.WS2_32 ref: 0000000180035551
WSAWaitForMultipleEvents.WS2_32 ref: 000000018003557C
WSAEnumNetworkEvents.WS2_32 ref: 000000018003559F
WaitForSingleObject.KERNEL32 ref: 00000001800355D4
WSAWaitForMultipleEvents.WS2_32 ref: 0000000180035629
WSACloseEvent.WS2_32 ref: 0000000180035640

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Event$EventsWait$Multiplememset$CloseCreateEnumNetworkObjectSelectSingle
String ID:
API String ID: 4111286588-0
Opcode ID: cb05e26348fc5fa680f74ac7f4703aa7f24feaffb504ccfcfa995c813edf2173
Instruction ID: 546d487ed4a885a0f1727a2aab1a2d449dd24cc8967c8d5c63f42d9527891ca4
Opcode Fuzzy Hash: cb05e26348fc5fa680f74ac7f4703aa7f24feaffb504ccfcfa995c813edf2173
Instruction Fuzzy Hash: 43618F32201B848AE7A2CF25D8407DE73A5F7497D8F558215EA9D47BA8DF34C759CB00

Function 00000001800592A0 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 137COMMON

Download Yara Rule

APIs

_strnicmp.MSVCRT ref: 000000018005933C

Strings

ws upgrade default pcol, xrefs: 00000001800593FE
%s: protocol list too long, xrefs: 0000000180059387
lws_process_ws_upgrade, xrefs: 000000018005937B, 00000001800593A9, 00000001800594A6, 00000001800594D4
upgrade, xrefs: 0000000180059330
%s: malformed or absent conn hdr, xrefs: 00000001800593B5
%s: malformatted protocol list, xrefs: 00000001800594E0
NULL protocol at lws_read, xrefs: 00000001800592B8
%s: pcol name too long, xrefs: 00000001800594B2
ws upg pcol, xrefs: 000000018005947B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _strnicmp
String ID: %s: malformatted protocol list$%s: malformed or absent conn hdr$%s: pcol name too long$%s: protocol list too long$NULL protocol at lws_read$lws_process_ws_upgrade$upgrade$ws upg pcol$ws upgrade default pcol
API String ID: 2635805826-3436673557
Opcode ID: 4ff8d91c8aa0005156a51a5dfb16b6fc1044c44ad5f8a3d9a3d1f04027fe3cda
Instruction ID: 20cb35c50caca3f10adfcea1c45ea1a57c874502099cf0df93d652b848d7663d
Opcode Fuzzy Hash: 4ff8d91c8aa0005156a51a5dfb16b6fc1044c44ad5f8a3d9a3d1f04027fe3cda
Instruction Fuzzy Hash: 35517172301A8881FBA79B55F4503D96350F78C7C8F848126FA485B6A6EF6ECB5DCB40

Function 00000001800345A0 Relevance: 15.1, APIs: 10, Instructions: 100memorytimethreadCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00000001800345C5
VirtualAlloc.KERNEL32 ref: 0000000180034647
IsBadReadPtr.KERNEL32 ref: 0000000180034677
EnterCriticalSection.KERNEL32 ref: 000000018003468E
send.WS2_32 ref: 00000001800346A1
GetLastError.KERNEL32 ref: 00000001800346A7
IsBadReadPtr.KERNEL32 ref: 00000001800346B7
ExitThread.KERNEL32 ref: 00000001800346C3
LeaveCriticalSection.KERNEL32 ref: 00000001800346CE
VirtualFree.KERNEL32 ref: 00000001800346E4

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalReadSectionVirtual$AllocEnterErrorExitFreeLastLeaveThreadTimesendtime
String ID:
API String ID: 3122330297-0
Opcode ID: 51404108585b7ff1db373e89b646bf7e8d42d759f0de1be0177d3c4d76274544
Instruction ID: f7eac1dd2de70b53d53e3eab7ec8ea87249c30c15c0ef925b5336bb8e0fd8ac6
Opcode Fuzzy Hash: 51404108585b7ff1db373e89b646bf7e8d42d759f0de1be0177d3c4d76274544
Instruction Fuzzy Hash: C7418032300A4487E7968F26E95439E73A1FB49FC4F14C129EB5A8B754DF38DA59CB01

Function 00000001800360B0 Relevance: 15.1, APIs: 10, Instructions: 94stringthreadwindowCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00000001800360ED
memset.NTDLL ref: 0000000180036101
memset.NTDLL ref: 0000000180036115
GetWindowThreadProcessId.USER32 ref: 0000000180036124

Part of subcall function 000000018002C950: memset.NTDLL ref: 000000018002C974
Part of subcall function 000000018002C950: CreateToolhelp32Snapshot.KERNEL32 ref: 000000018002C97E
Part of subcall function 000000018002C950: Process32FirstW.KERNEL32 ref: 000000018002C9A1
Part of subcall function 000000018002C950: Process32NextW.KERNEL32 ref: 000000018002C9BE
Part of subcall function 000000018002C950: CloseHandle.KERNEL32 ref: 000000018002CA41

lstrlenW.KERNEL32 ref: 0000000180036143
GetClassNameW.USER32 ref: 0000000180036161
lstrlenW.KERNEL32 ref: 000000018003616C
GetWindowTextW.USER32 ref: 000000018003618E
lstrlenW.KERNEL32 ref: 000000018003619B
IsWindowVisible.USER32 ref: 00000001800361B0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memset$Windowlstrlen$Process32$ClassCloseCreateFirstHandleNameNextProcessSnapshotTextThreadToolhelp32Visible
String ID:
API String ID: 4082481662-0
Opcode ID: f3f6308184de1336c682d88350a7a94f45cac4e12ff12976c06c3bffbcc68aeb
Instruction ID: d0f507396e64800563df14b166d5fa831775ab325477c94ed690f18abff4640a
Opcode Fuzzy Hash: f3f6308184de1336c682d88350a7a94f45cac4e12ff12976c06c3bffbcc68aeb
Instruction Fuzzy Hash: 05411776310A849ADB71DF26DD447EA2361FB89B99F409111DE0E8BE58EF39C358CB00

Function 00000001800303E0 Relevance: 15.1, APIs: 10, Instructions: 74servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 0000000180030405
OpenServiceW.ADVAPI32 ref: 0000000180030422
QueryServiceStatus.ADVAPI32 ref: 0000000180030433
ControlService.ADVAPI32 ref: 000000018003045E
ControlService.ADVAPI32 ref: 000000018003047A
ControlService.ADVAPI32 ref: 0000000180030496
StartServiceW.ADVAPI32 ref: 00000001800304AD
CloseServiceHandle.ADVAPI32 ref: 00000001800304B6
CloseServiceHandle.ADVAPI32 ref: 00000001800304BF
Sleep.KERNEL32 ref: 00000001800304CA

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Service$Control$CloseHandleOpen$ManagerQuerySleepStartStatus
String ID:
API String ID: 2453229493-0
Opcode ID: 2273a004fea410f7597165bb23289446dcc16b9a87cf60cf92e4a93607a0279b
Instruction ID: a827f19ee3d39340aa7ff37006d083c65898c79fdd008705067775172c250e71
Opcode Fuzzy Hash: 2273a004fea410f7597165bb23289446dcc16b9a87cf60cf92e4a93607a0279b
Instruction Fuzzy Hash: C431A77160574482E6E68B56A92839B73A1FB8CBD1F25C521EA4A03754EE7CC74C8B00

Function 000000018002B8E0 Relevance: 15.0, APIs: 5, Strings: 5, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000000018002B8F9
lstrcmpiW.KERNEL32 ref: 000000018002B916
lstrcmpiW.KERNEL32 ref: 000000018002B933
lstrcmpiW.KERNEL32 ref: 000000018002B950
lstrcmpiW.KERNEL32 ref: 000000018002B96D

Strings

HKEY_LOCAL_MACHINE, xrefs: 000000018002B906
HKEY_CLASSES_ROOT, xrefs: 000000018002B95D
HKEY_CURRENT_CONFIG, xrefs: 000000018002B940
HKEY_CURRENT_USER, xrefs: 000000018002B8F2
HKEY_USERS, xrefs: 000000018002B923

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 1586166983-3507829934
Opcode ID: 92d67e1772ed5d27b35ffe2b6b4ab96e07dede8ed643a73d65189ae7ffbca217
Instruction ID: c5102dafba556a099cf21811f283ae19e0cd38949c6be2cc2dbabf3547937893
Opcode Fuzzy Hash: 92d67e1772ed5d27b35ffe2b6b4ab96e07dede8ed643a73d65189ae7ffbca217
Instruction Fuzzy Hash: DF010920340B4855FA859B36AD993A17252AF4CBF0F94D324B93B837E8EF68C2489305

Function 0000000180032180 Relevance: 13.8, APIs: 9, Instructions: 260COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 000000018003223A

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 948343c06ea8565a1ec3a8f72c563dc0c748cdd4bbb0149151ad3a0c17d1f3f7
Instruction ID: df31702713cfb229a575d7950fa945f7c7faf68abf407ff6d34f975fbd772260
Opcode Fuzzy Hash: 948343c06ea8565a1ec3a8f72c563dc0c748cdd4bbb0149151ad3a0c17d1f3f7
Instruction Fuzzy Hash: B3C10576701B448AEB62CF79D4847AD23B1FB88B98F118516EE0E57B28DF38C649C740

Function 0000000180065020 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

0, xrefs: 00000001800650B1
localeconv, xrefs: 000000018006502C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: 0$localeconv
API String ID: 0-1694054256
Opcode ID: 62c991d504baceb27228d7619c59d8f6b300d3d360e6c3cc75c69b9d69c5f280
Instruction ID: e29cbc192d5b5fa776c4183e2a42224c504630d66b273c1672e9d2f84518f776
Opcode Fuzzy Hash: 62c991d504baceb27228d7619c59d8f6b300d3d360e6c3cc75c69b9d69c5f280
Instruction Fuzzy Hash: F6C1A172205B8486E7A18F25E85039C37A6F709FD5F248219EBED07B95DF39C6A9C700

Function 0000000180012000 Relevance: 13.6, APIs: 9, Instructions: 73memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

GetCurrentProcessId.KERNEL32 ref: 0000000180012020
ProcessIdToSessionId.KERNEL32 ref: 0000000180012030

Part of subcall function 0000000180026CA0: VirtualAlloc.KERNEL32 ref: 0000000180026CBE
Part of subcall function 0000000180026CA0: GetCurrentProcessId.KERNEL32 ref: 0000000180026D39

VirtualAlloc.KERNEL32 ref: 0000000180012096
InitializeCriticalSection.KERNEL32 ref: 00000001800120A8
VirtualAlloc.KERNEL32 ref: 00000001800120CD
InitializeCriticalSection.KERNEL32 ref: 00000001800120DF
CreateThread.KERNEL32 ref: 0000000180012117
WaitForSingleObject.KERNEL32 ref: 000000018001212D
CloseHandle.KERNEL32 ref: 0000000180012136

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AllocCriticalSectionVirtual$EnterInitializeProcessRead$CurrentLeave$CloseCreateHandleObjectSessionSingleThreadWait
String ID:
API String ID: 1571644542-0
Opcode ID: dcf58f8bd94f4b4f5eefa7d45e8e40f62b7c11d8478bf447f9b59908b2d98ac2
Instruction ID: c803f1937374879516fc36001848ea71169e9560d2ca95881579869001e17f0a
Opcode Fuzzy Hash: dcf58f8bd94f4b4f5eefa7d45e8e40f62b7c11d8478bf447f9b59908b2d98ac2
Instruction Fuzzy Hash: 11313D32215B8482E796DF21F814399B7A5FB8CBD0F548219FA9647B94EF38C658CB40

Function 0000000180028630 Relevance: 12.6, APIs: 10, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualAlloc.KERNEL32 ref: 0000000180028683
VirtualAlloc.KERNEL32 ref: 00000001800286CF
IsBadReadPtr.KERNEL32 ref: 0000000180028711
EnterCriticalSection.KERNEL32 ref: 0000000180028729
VirtualAlloc.KERNEL32 ref: 0000000180028740
LeaveCriticalSection.KERNEL32 ref: 0000000180028764
VirtualFree.KERNEL32 ref: 0000000180028789
VirtualFree.KERNEL32 ref: 00000001800287B3
VirtualFree.KERNEL32 ref: 00000001800287C9
VirtualFree.KERNEL32 ref: 00000001800287F3

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 46fff95910c23406eb469c503979ea30ae88de5af3fad95f670b18fa206ae6df
Instruction ID: d0ad719fa565a145eaef6b7726f9e7cff3c3b88db48e1dcf6b865918ce14aec4
Opcode Fuzzy Hash: 46fff95910c23406eb469c503979ea30ae88de5af3fad95f670b18fa206ae6df
Instruction Fuzzy Hash: 51517C35315B4482EB9A9F26E9543AA63A1FF8CFC1F54C024EF8A43B54DF38D6198700

Function 0000000180059930 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 00000001800599D5
closesocket.WS2_32 ref: 0000000180059AC1

Part of subcall function 0000000180040950: setsockopt.WS2_32 ref: 0000000180040992
Part of subcall function 0000000180040950: WSAGetLastError.WS2_32 ref: 000000018004099C

closesocket.WS2_32 ref: 0000000180059AB6

Part of subcall function 000000018005BCC0: closesocket.WS2_32 ref: 000000018005BD18

Part of subcall function 0000000180040B00: select.WS2_32 ref: 0000000180040B36

WSAGetLastError.WS2_32 ref: 0000000180059ACE
WSAGetLastError.WS2_32 ref: 0000000180059ADB
WSAGetLastError.WS2_32 ref: 0000000180059AE8

Strings

accept: errno %d, xrefs: 0000000180059AEE

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$closesocket$acceptselectsetsockopt
String ID: accept: errno %d
API String ID: 202107160-3139583270
Opcode ID: c3f00e874f1ac731178f54c9e58ecc05abcf660705855fa9d8f8be190f44be0b
Instruction ID: d344d24f1f520dc8d36f83eb6c9f7fde8187a9fa3a5f2ba2036925cdfc61fb5c
Opcode Fuzzy Hash: c3f00e874f1ac731178f54c9e58ecc05abcf660705855fa9d8f8be190f44be0b
Instruction Fuzzy Hash: 6451BE32606BC882F7A1CF51E9483E96361F788B94F199216FE9913794DF39DAC9C300

Function 000000018002C760 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

WTSEnumerateSessionsW.WTSAPI32 ref: 000000018002C79F
WTSQuerySessionInformationW.WTSAPI32 ref: 000000018002C7FB
lstrlenW.KERNEL32 ref: 000000018002C813
WTSFreeMemory.WTSAPI32 ref: 000000018002C892
WTSFreeMemory.WTSAPI32 ref: 000000018002C8AC

Strings

system, xrefs: 000000018002C839, 000000018002C860

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FreeMemory$EnumerateInformationQuerySessionSessionslstrlen
String ID: system
API String ID: 3618899143-3377271179
Opcode ID: b32c9ff873edc57c0f6f3c7361fb97fa384e6bee228724bcac05ea03c1df1bf5
Instruction ID: 5004bf5ab9f511ae30339ed98b93da59ddf5133012d5f48a47ed23bc630cf909
Opcode Fuzzy Hash: b32c9ff873edc57c0f6f3c7361fb97fa384e6bee228724bcac05ea03c1df1bf5
Instruction Fuzzy Hash: 144167B6B10A608AEB51CF65E8847DD37B4F748B88F509516EF0A43B58DF35C698CB00

Function 00000001800222F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39stringfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018002230D
lstrcatW.KERNEL32 ref: 000000018002231E
lstrcatW.KERNEL32 ref: 0000000180022330
DeleteFileW.KERNEL32 ref: 0000000180022369
GetLastError.KERNEL32 ref: 0000000180022379

Strings

\temp.key, xrefs: 0000000180022324
C:\Program Files\Windows Mail, xrefs: 0000000180022312

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: lstrcat$DeleteErrorFileLastmemset
String ID: C:\Program Files\Windows Mail$\temp.key
API String ID: 3002015462-229217837
Opcode ID: 75718442f7fc29e2b7bc083eea7b4b405c17fcc48b4aa1abb5b1d73d3bcafe19
Instruction ID: 418552250ced0e4a5d951a15a9e44788c617947f6cb3901df8409ae19f2d7500
Opcode Fuzzy Hash: 75718442f7fc29e2b7bc083eea7b4b405c17fcc48b4aa1abb5b1d73d3bcafe19
Instruction Fuzzy Hash: 8D113D32608B89D6D7618F55F84439AB3A5FBDD7C4F508216F69A42A68EF7CC24CCB00

Function 0000000180034900 Relevance: 12.1, APIs: 8, Instructions: 108memorytimenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180033BB0: socket.WS2_32 ref: 0000000180033BF3
Part of subcall function 0000000180033BB0: GetLastError.KERNEL32 ref: 0000000180033C02

send.WS2_32 ref: 000000018003495E
timeGetTime.WINMM ref: 0000000180034964
VirtualAlloc.KERNEL32 ref: 0000000180034994
VirtualFree.KERNEL32 ref: 00000001800349E6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocErrorFreeLastTimesendsockettime
String ID:
API String ID: 675528727-0
Opcode ID: ffa402f768c8f16eaddf7cabb92685b8e3fc598e86ccd357d1f3be0cf34130b3
Instruction ID: 7d09a61f6278589bbabcc35533cf6e2b87e2baaa12461d56da63d21fb922d4c8
Opcode Fuzzy Hash: ffa402f768c8f16eaddf7cabb92685b8e3fc598e86ccd357d1f3be0cf34130b3
Instruction Fuzzy Hash: B641A436310B4442EB96CF26E90479B67A1FB8DBC0F19C025EF5A8BB94DF39D6598700

Function 000000018006248C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 225stringCOMMON

Download Yara Rule

APIs

wcsnlen.MSVCRT ref: 00000001800624F3
strnlen.MSVCRT ref: 0000000180062513

Strings

(null), xrefs: 00000001800624E1
0, xrefs: 00000001800626B7
(null), xrefs: 0000000180062505

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: strnlenwcsnlen
String ID: (null)$(null)$0
API String ID: 3725369605-212571832
Opcode ID: 67498eb6120f9a87af12e93a27b0a3bfdbad7a3d9dcff1efb83aa52a075b076c
Instruction ID: 66fce8290cce2b71c14474b78f598dfd8bd286b4286ac5328ae3c4fc44f0a64c
Opcode Fuzzy Hash: 67498eb6120f9a87af12e93a27b0a3bfdbad7a3d9dcff1efb83aa52a075b076c
Instruction Fuzzy Hash: AAA1D372214F4885EBA68F28D8407EC77A2F359BD8F749105FE6947684DF35CA8AC740

Function 000000018005C120 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 000000018005C1E2
memchr.MSVCRT ref: 000000018005C25B
memcpy.NTDLL ref: 000000018005C28D
memcpy.NTDLL ref: 000000018005C2AA

Strings

lws_cookie_attach_cookies, xrefs: 000000018005C42D, 000000018005C467
%s:no cookiejar, xrefs: 000000018005C473
%s: failed to get c '%s', xrefs: 000000018005C434

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memchrmemcpy
String ID: %s: failed to get c '%s'$%s:no cookiejar$lws_cookie_attach_cookies
API String ID: 3039221550-101748955
Opcode ID: 2240d8001afbd33d5b716c548b6dd03b428f2b485bf9da117c7a8488b072aaa3
Instruction ID: 78b98571fa2367f6c2707e6fa4df3d7cfaf4dd4838afe4a07a99c5f21938646c
Opcode Fuzzy Hash: 2240d8001afbd33d5b716c548b6dd03b428f2b485bf9da117c7a8488b072aaa3
Instruction Fuzzy Hash: B771D132604B8889FBA28B65D450BE927A0FB5D7D8F48D216FE58277D5DF39C289C301

Function 0000000180064750 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 142stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018006477D
memmove.MSVCRT ref: 00000001800647E5
strcpy_s.MSVCRT ref: 0000000180064865
memmove.MSVCRT ref: 00000001800648F9

Strings

gfff, xrefs: 00000001800648C4
e+000, xrefs: 0000000180064843

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memmove$_errnostrcpy_s
String ID: e+000$gfff
API String ID: 2254902591-3030954782
Opcode ID: e6ad066e48c9a8430003dcdfd77ad5ec9309e1d8e4c1c01db61fe6eef5906141
Instruction ID: 6cba9cfaa347f7440b6c2f7b1d52b6e9a4fa326de3a75132d8f99ee068a4b5b2
Opcode Fuzzy Hash: e6ad066e48c9a8430003dcdfd77ad5ec9309e1d8e4c1c01db61fe6eef5906141
Instruction Fuzzy Hash: 085137777187D885E7A68E25AC0039EAB92F348BC4F58C111EBA44BAD5CF7DC649C700

Function 0000000180045740 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 128COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 0000000180045766

Strings

__lws_close_free_wsi_final, xrefs: 00000001800458A7
failed to get ah, xrefs: 0000000180045892
lws_free, xrefs: 0000000180045967
client_reset, xrefs: 0000000180045851
free, xrefs: 00000001800457CF, 000000018004592B

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: closesocket
String ID: __lws_close_free_wsi_final$client_reset$failed to get ah$free$lws_free
API String ID: 2781271927-1207365477
Opcode ID: 25f6bb898b64ce15532d64514156a68591c670a9a80de1def1c087238b177e9a
Instruction ID: b11989734cbcc3ef02deb52aac5978c09b8d5929b6a9c59948ee33c9b6b24a02
Opcode Fuzzy Hash: 25f6bb898b64ce15532d64514156a68591c670a9a80de1def1c087238b177e9a
Instruction Fuzzy Hash: A8518332300B8891EA9ADB25D6803ED63A5F789BE4F558316BB78077D2DF34D6698304

Function 000000018001E010 Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000000018001E01D
memset.NTDLL ref: 000000018001E048
memset.NTDLL ref: 000000018001E05A

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001E09B
VirtualFree.KERNEL32 ref: 000000018001E0C5
VirtualFree.KERNEL32 ref: 000000018001E197
VirtualFree.KERNEL32 ref: 000000018001E1C1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leavememset$Initialize__chkstk
String ID:
API String ID: 2598321309-0
Opcode ID: 19803d78e17f30e281bc56e6a6dc2545e298c1294dfc20e4aef617dcccde76fa
Instruction ID: 0923d7b35471971d6684b23f2a4c2e262b1c464dcb08f8d5d554864809a20f42
Opcode Fuzzy Hash: 19803d78e17f30e281bc56e6a6dc2545e298c1294dfc20e4aef617dcccde76fa
Instruction Fuzzy Hash: 5C518F32318A9492EBB5DF22E6443AE7361FBCABC0F448115EB8A43F44DF38D1598B04

Function 000000018001D6F0 Relevance: 10.6, APIs: 7, Instructions: 103memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001D790
VirtualFree.KERNEL32 ref: 000000018001D7BA
CreateThread.KERNEL32 ref: 000000018001D7E8
IsBadReadPtr.KERNEL32 ref: 000000018001D80C
EnterCriticalSection.KERNEL32 ref: 000000018001D81F
VirtualAlloc.KERNEL32 ref: 000000018001D836
LeaveCriticalSection.KERNEL32 ref: 000000018001D85A

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$Leave$Free$CreateInitializeThread
String ID:
API String ID: 1508740679-0
Opcode ID: 1b3e0e81731cd236f1cdf85c7afb2c4caa27aaabd1b84022f2bb5430b119c807
Instruction ID: 47bfe805559daebc681f189077da3042b76b9ee6a1aecc8a2dd6721ab6eacd7f
Opcode Fuzzy Hash: 1b3e0e81731cd236f1cdf85c7afb2c4caa27aaabd1b84022f2bb5430b119c807
Instruction Fuzzy Hash: A041A332211B848AEB95CF22E95439EB7A5FB8CBD4F148125EF4A43B54DF38C569CB00

Function 0000000180023119 Relevance: 10.6, APIs: 7, Instructions: 102memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00000001800231A2
VirtualAlloc.KERNEL32 ref: 00000001800231E8
NetUserSetInfo.NETAPI32 ref: 000000018002322B
VirtualFree.KERNEL32 ref: 000000018002323C
lstrcmpiW.KERNEL32 ref: 0000000180023255
VirtualFree.KERNEL32 ref: 000000018002326E
VirtualFree.KERNEL32 ref: 00000001800233C1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$InfoUserlstrcmpi
String ID:
API String ID: 2840552451-0
Opcode ID: 60893066e3bbf6b45f4eeb8daf225cdee7bfb0fcc925a5af3644fbef4d97a442
Instruction ID: c1d67c104191be5984c5444be8733811377b2fe01a978be8abee619fd7df6acf
Opcode Fuzzy Hash: 60893066e3bbf6b45f4eeb8daf225cdee7bfb0fcc925a5af3644fbef4d97a442
Instruction Fuzzy Hash: 31413131715A4486EBB6CF26E84479EA3A1FB8DBC4F048118EE8A43B54DF3DD64D8B00

Function 00000001800635F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

__doserrno.MSVCRT ref: 000000018006360A
_errno.MSVCRT ref: 0000000180063613
CreateFileW.KERNEL32 ref: 0000000180063675
CloseHandle.KERNEL32 ref: 00000001800636AC

Strings

:, xrefs: 00000001800636FB

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseCreateFileHandle__doserrno_errno
String ID: :
API String ID: 3226408381-336475711
Opcode ID: d8f6f999a0288e3d3718b893e4e6263fed8d78bffeb59cf0f3621bcd21b7dd4a
Instruction ID: 41fd35c3217f5f7fbe6db79c11ede0f5e5b19f733a9a86a3fa6781e28d94cc8d
Opcode Fuzzy Hash: d8f6f999a0288e3d3718b893e4e6263fed8d78bffeb59cf0f3621bcd21b7dd4a
Instruction Fuzzy Hash: B141B1B2A0878486E7A29F2599013DD6362F7597E4F24C315F7B443AC2EF74D6E88780

Function 0000000180024080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95librarymemoryloaderCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180024097
LoadLibraryW.KERNEL32 ref: 00000001800240B5
GetProcAddress.KERNEL32 ref: 00000001800240CD
FreeLibrary.KERNEL32 ref: 00000001800240DD

Strings

SetProcessDPIAware, xrefs: 00000001800240C3
user32.dll, xrefs: 00000001800240A9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Library$AddressAllocFreeLoadProcVirtual
String ID: SetProcessDPIAware$user32.dll
API String ID: 3041263384-1137607222
Opcode ID: 2d5c190feabc2370d29f15f15ffb36fb6660cf0171777757c6844a959bed01c6
Instruction ID: 9723d36197fd1670b71a0407276ede353324b63a1e3ef1b57012246c70083299
Opcode Fuzzy Hash: 2d5c190feabc2370d29f15f15ffb36fb6660cf0171777757c6844a959bed01c6
Instruction Fuzzy Hash: 4E513835252F8895EB939F20E8953D933A9FB0DB84F948636E94D06364EF78825DC350

Function 000000018001D5B0 Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018001D5F7
memset.NTDLL ref: 000000018001D60C
memcpy.NTDLL ref: 000000018001D627
memcpy.NTDLL ref: 000000018001D641
VirtualFree.KERNEL32 ref: 000000018001D656
VirtualFree.KERNEL32 ref: 000000018001D680
SHFileOperationW.SHELL32 ref: 000000018001D6C7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: FreeVirtualmemcpymemset$FileOperation
String ID:
API String ID: 467530429-0
Opcode ID: 14cb9642c533215b7a2e2bfcfdb6d7d7cadd70b785f3dc976475013d93c55a53
Instruction ID: 44e6a9c3418865c4a63161637f115ce8dfda5ddef16edb2867b74c34f4f1e956
Opcode Fuzzy Hash: 14cb9642c533215b7a2e2bfcfdb6d7d7cadd70b785f3dc976475013d93c55a53
Instruction Fuzzy Hash: C8316F32214B8586DB61CF12F58078FB7A5FB89B84F148515EB9D03B59DF39D22ACB00

Function 0000000180020360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66processthreadinjectionCOMMON

Download Yara Rule

APIs

CreateProcessWithTokenW.ADVAPI32 ref: 00000001800203F4
GetLastError.KERNEL32 ref: 00000001800203FE
CloseHandle.KERNEL32 ref: 0000000180020410
CloseHandle.KERNEL32 ref: 0000000180020425
SuspendThread.KERNEL32 ref: 0000000180020434

Strings

h, xrefs: 00000001800203EC

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcessSuspendThreadTokenWith
String ID: h
API String ID: 1678065097-2439710439
Opcode ID: 34fa300228c636eaa0f0248c957d63175a617a8d2a4f03bc85cdcff5c74062eb
Instruction ID: 0b407ff62ca030b67dc5b43d4f4e9c4a1a1ed4b4a811e6081f2b678ded490bba
Opcode Fuzzy Hash: 34fa300228c636eaa0f0248c957d63175a617a8d2a4f03bc85cdcff5c74062eb
Instruction Fuzzy Hash: 24313A72A18B8482E751CB51E88439AB3A5FB98BD0F219225EA9943B15DFB9C5D48B00

Function 000000018002D2A0 Relevance: 10.5, APIs: 7, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(?,?,00001000,00000001800124E2), ref: 000000018002D2B7
OpenServiceW.ADVAPI32(?,?,00001000,00000001800124E2), ref: 000000018002D2E6
GetLastError.KERNEL32(?,?,00001000,00000001800124E2), ref: 000000018002D2F4
CloseServiceHandle.ADVAPI32(?,?,00001000,00000001800124E2), ref: 000000018002D2FF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: OpenService$CloseErrorHandleLastManager
String ID:
API String ID: 2659350385-0
Opcode ID: be0d97674b5d01ddbad740662ad065086e858ccad381bdd0b1a3b9729ee50c89
Instruction ID: f5b59a7219b1aa454e630b03aab21a206dfaa257efd4a395db7c560de30d249d
Opcode Fuzzy Hash: be0d97674b5d01ddbad740662ad065086e858ccad381bdd0b1a3b9729ee50c89
Instruction Fuzzy Hash: BE018035754B4982FBC68B66B9543A81392AF4CBD0F188534AE2A06711FE7CC68C9B00

Function 00000001800126B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00000001800126D2
GetSystemDirectoryW.KERNEL32 ref: 00000001800126E1
GetLastError.KERNEL32 ref: 00000001800126EB
lstrcatW.KERNEL32 ref: 00000001800126FD
VirtualFree.KERNEL32 ref: 0000000180012745

Strings

\svchost.exe -k netsvcs, xrefs: 00000001800126F1

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: DirectoryErrorFreeLastSystemVirtuallstrcatmemset
String ID: \svchost.exe -k netsvcs
API String ID: 1196864501-2993138014
Opcode ID: 4899bdc5faaa1a50a6070bd62f2c10f6be7ce4c39736347503a2d79e50c34c7c
Instruction ID: bf08d159dd9659f3a19140611c4c7124a30601a6af789706eab7547f6c6d8f60
Opcode Fuzzy Hash: 4899bdc5faaa1a50a6070bd62f2c10f6be7ce4c39736347503a2d79e50c34c7c
Instruction Fuzzy Hash: 13014031210A4981EBA1DF25E8687DA6361FB88B95F008315EAAD436E9EF3CC34DC740

Function 000000018001F2E0 Relevance: 10.1, APIs: 8, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001F308
VirtualAlloc.KERNEL32 ref: 000000018001F32B
InitializeCriticalSection.KERNEL32 ref: 000000018001F33D
VirtualAlloc.KERNEL32 ref: 000000018001F362
VirtualAlloc.KERNEL32 ref: 000000018001F3B5
InitializeCriticalSection.KERNEL32 ref: 000000018001F3C7
VirtualFree.KERNEL32 ref: 000000018001F50E
VirtualFree.KERNEL32 ref: 000000018001F538

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalFreeInitializeSection
String ID:
API String ID: 2852478515-0
Opcode ID: 2ca86a1fc827d6d4b782268000abc3b1b2f9c80ad164c5e90495c9a43af317c5
Instruction ID: dd16bfbde7feb7ae91535c2faddd39ebd3f018d23720757d002fea19e12ee229
Opcode Fuzzy Hash: 2ca86a1fc827d6d4b782268000abc3b1b2f9c80ad164c5e90495c9a43af317c5
Instruction Fuzzy Hash: FE61E835201F4895EB96CF25E8807D933A9FB0CB84F94853AEA9D07764EF38C669C350

Function 000000018004E160 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

Strings

%s: wsi not bound to vhost, xrefs: 000000018004E1CD
lws_return_http_status, xrefs: 000000018004E1C1
text/html, xrefs: 000000018004E2DF, 000000018004E306
<html><head><meta charset=utf-8 http-equiv="Content-Language" content="en"/><link rel="stylesheet" type="text/css" href="/error.css"/></head><body><h1>%u</h1>%s</body></html>, xrefs: 000000018004E32B
pending status body, xrefs: 000000018004E4AE

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: %s: wsi not bound to vhost$<html><head><meta charset=utf-8 http-equiv="Content-Language" content="en"/><link rel="stylesheet" type="text/css" href="/error.css"/></head><body><h1>%u</h1>%s</body></html>$lws_return_http_status$pending status body$text/html
API String ID: 0-3335276413
Opcode ID: e762419415749a66cd9e4173b8542a7493df9f9a23a6f186c0f9cf70f49c93aa
Instruction ID: fe26ec063cbc48624dde9099db830e2e49edf84b6a2075d819abc6d1f601589e
Opcode Fuzzy Hash: e762419415749a66cd9e4173b8542a7493df9f9a23a6f186c0f9cf70f49c93aa
Instruction Fuzzy Hash: D3A18132204BC885EBB68B21E4807EA67A4F7497C8F558125FF9947786DF38C789C708

Function 0000000180043210 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 192COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00000001800432AD

Strings

default, xrefs: 0000000180043277
lws_protocol_init_vhost, xrefs: 000000018004324F
protocol %s failed init, xrefs: 0000000180043261
lws_free, xrefs: 00000001800434E9
raw, xrefs: 000000018004326C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memset
String ID: default$lws_free$lws_protocol_init_vhost$protocol %s failed init$raw
API String ID: 2221118986-224536676
Opcode ID: 3ca2b0dda705691ad3dfa99d16c899407311fd09951ce103c95fd508c95c4fdf
Instruction ID: bb88fd17a4a82a0250628e9086b80fc0fd5949db7b3dec8f3339b0b26ad1c6ff
Opcode Fuzzy Hash: 3ca2b0dda705691ad3dfa99d16c899407311fd09951ce103c95fd508c95c4fdf
Instruction Fuzzy Hash: 94919C72200FC881EBAA8F11D4857E977A0F78ABC9F56901AEF9903744DF34D619C744

Function 0000000180057630 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 170COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,?,?,?,?,?,0000000180051570), ref: 0000000180057851

Strings

hpack dyn, xrefs: 0000000180057826
lws_dynamic_token_insert, xrefs: 000000018005766D
free, xrefs: 000000018005775C, 000000018005780A
Dropping header content before limit!, xrefs: 00000001800576CE
%s: unsized dyn table, xrefs: 0000000180057679

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID: %s: unsized dyn table$Dropping header content before limit!$free$hpack dyn$lws_dynamic_token_insert
API String ID: 3510742995-1106822923
Opcode ID: 38f18722d6c724cb663955093bc12d04a2b663f3068941b29b270f5aa37d76bc
Instruction ID: bb91e4a8d91757a7ccfd4bf5a3e3487ec1026b5a65b1bcbcf4cd1204f063ae3c
Opcode Fuzzy Hash: 38f18722d6c724cb663955093bc12d04a2b663f3068941b29b270f5aa37d76bc
Instruction Fuzzy Hash: 7A71AE36320A8881D795DF2AE4407BD73A6FB88FD8F018026BE4943759EF36C989D340

Function 00000001800419D0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 146COMMON

Download Yara Rule

Strings

(hexdump: NULL ptr), xrefs: 0000000180041A43
%04X: , xrefs: 0000000180041AB3
, xrefs: 0000000180041B20, 0000000180041B40
(hexdump: zero length), xrefs: 0000000180041A10
%02X , xrefs: 0000000180041AEC

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: $%02X $%04X: $(hexdump: NULL ptr)$(hexdump: zero length)
API String ID: 0-30795012
Opcode ID: 5294b12cb6ddfd132a68633f4a1d4391e7470ebcbf1e631c227f11d59742df34
Instruction ID: 43df9c9a12c68a9ee2a03ce89bcc6a566d398c83124265cf5cac2a872b56d33c
Opcode Fuzzy Hash: 5294b12cb6ddfd132a68633f4a1d4391e7470ebcbf1e631c227f11d59742df34
Instruction Fuzzy Hash: 52519136308FC885D7A19B10F8803EA77A5F78DBC8F158526EA8E43B45DF38C2598744

Function 0000000180012910 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 143stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 0000000180012AF8

Strings

U:I:, xrefs: 0000000180012A0A
_:B:, xrefs: 0000000180012A38
V:R:, xrefs: 0000000180012A00
^:V:, xrefs: 00000001800129F5
V:_:, xrefs: 0000000180012954

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID: U:I:$V:R:$V:_:$^:V:$_:B:
API String ID: 1586166983-194391922
Opcode ID: c37ba9e02582e707534a94e5af5016ab63ae1cbaf134c547084023abedeaea09
Instruction ID: 1ff7c6536d8abac613530718bfa32f49261bcc4d6c4cfbb660ea38e54c558f83
Opcode Fuzzy Hash: c37ba9e02582e707534a94e5af5016ab63ae1cbaf134c547084023abedeaea09
Instruction Fuzzy Hash: D2617A33B08BC4CEF3528FB5C4007DD3BB1E799788F159619EE8466A49EB789669C340

Function 000000018002F2B0 Relevance: 9.1, APIs: 6, Instructions: 86memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018002F316
VirtualAlloc.KERNEL32 ref: 000000018002F356
NetUserSetInfo.NETAPI32 ref: 000000018002F390
VirtualFree.KERNEL32 ref: 000000018002F3A3
lstrcmpiW.KERNEL32 ref: 000000018002F3B8
VirtualFree.KERNEL32 ref: 000000018002F3CD

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree$InfoUserlstrcmpi
String ID:
API String ID: 4244901044-0
Opcode ID: 4bb39a4d54623631dae1162540759efd2fad283e37046eba1ed0997ae9d8ff27
Instruction ID: 50fc7e5707614e6f3dac0ce4ac0a634bc86221c2fd229e1be9eb41f0f341c50a
Opcode Fuzzy Hash: 4bb39a4d54623631dae1162540759efd2fad283e37046eba1ed0997ae9d8ff27
Instruction Fuzzy Hash: 0A31747131074842EB66CF26E8447AAA7A1AB4DFD1F148038ED4A47798DF7CC64DCB00

Function 0000000180035670 Relevance: 9.1, APIs: 6, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00000001800356A9
memset.NTDLL ref: 00000001800356D3
WaitForSingleObject.KERNEL32 ref: 00000001800356DE
memcpy.NTDLL ref: 0000000180035703
memcpy.NTDLL ref: 0000000180035734
SetEvent.KERNEL32 ref: 0000000180035771

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ObjectSingleWaitmemcpy$Eventmemset
String ID:
API String ID: 2578485326-0
Opcode ID: 4b7ccff7cc8b725b09c582a996c9dbd6aeb28199792e257624d1a1754784ee10
Instruction ID: 56f86bbc58855b6075aee45e924c73265a62f824d3d0b1669c699fedc53ac016
Opcode Fuzzy Hash: 4b7ccff7cc8b725b09c582a996c9dbd6aeb28199792e257624d1a1754784ee10
Instruction Fuzzy Hash: B431E931304A0882E6A3D776F8807DB6360EB8C7D5F558411FFDA836A5EE78C6899300

Function 000000018002E790 Relevance: 9.1, APIs: 6, Instructions: 72memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,00000000,00000000,000000018002EBC5), ref: 000000018002E7CD
GetDC.USER32 ref: 000000018002E827
CreateCompatibleBitmap.GDI32 ref: 000000018002E839
GetDIBits.GDI32 ref: 000000018002E85D
ReleaseDC.USER32 ref: 000000018002E868
DeleteObject.GDI32 ref: 000000018002E871

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AllocBitmapBitsCompatibleCreateDeleteObjectReleaseVirtual
String ID:
API String ID: 1942853633-0
Opcode ID: d610f2210541b487ea599f3beb68992543fe9b84b09e2f87d6652d28e22b4989
Instruction ID: 154b444a9052197c30472ddb0950f5df774e67bb782f6541f27271536040a933
Opcode Fuzzy Hash: d610f2210541b487ea599f3beb68992543fe9b84b09e2f87d6652d28e22b4989
Instruction Fuzzy Hash: 7A21E0B221078487EB489F26B81435DBAE5FB89BD0F55812DEE8A57B60EF3CC1458B04

Function 0000000180010320 Relevance: 8.9, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000000018001037C
free.MSVCRT ref: 00000001800103CC
free.MSVCRT ref: 000000018001041C
free.MSVCRT ref: 000000018001046C
free.MSVCRT ref: 000000018001049B
free.MSVCRT ref: 00000001800104BD
free.MSVCRT ref: 00000001800104FB

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 086ef2399a2b39805725e1e66e9ffec4bc1c65bc9c079221ec383ecf087ce0d7
Instruction ID: 4532e7ad88e92783144c61f4f6d2900ac89e9450762ef15b38e3950c58b5259e
Opcode Fuzzy Hash: 086ef2399a2b39805725e1e66e9ffec4bc1c65bc9c079221ec383ecf087ce0d7
Instruction Fuzzy Hash: 6551D576202F4881EB828B59E5803987365F74CFD4F68D426EA9D03764DFB5C6AAC320

Function 000000018001D990 Relevance: 8.9, APIs: 7, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001D9B9
VirtualFree.KERNEL32 ref: 000000018001DA86
VirtualFree.KERNEL32 ref: 000000018001DAB0
CloseHandle.KERNEL32 ref: 000000018001DAC5
VirtualFree.KERNEL32 ref: 000000018001DAF8
VirtualFree.KERNEL32 ref: 000000018001DB22
VirtualFree.KERNEL32 ref: 000000018001DB37

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001442D
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 000000018001445F
Part of subcall function 0000000180014410: InitializeCriticalSection.KERNEL32 ref: 0000000180014474
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 0000000180014490
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 00000001800144A3
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 00000001800144BA
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 00000001800144E9
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 00000001800144FE
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 0000000180014511
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014528
Part of subcall function 0000000180014410: LeaveCriticalSection.KERNEL32 ref: 0000000180014557
Part of subcall function 0000000180014410: IsBadReadPtr.KERNEL32 ref: 000000018001456C
Part of subcall function 0000000180014410: EnterCriticalSection.KERNEL32 ref: 000000018001457F
Part of subcall function 0000000180014410: VirtualAlloc.KERNEL32 ref: 0000000180014596

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$Free$Leave$Initialize$CloseHandle
String ID:
API String ID: 1803526796-0
Opcode ID: 2389004f1622c871db37be869d3889ec8ed68640e4297f82caa4ce24a07498eb
Instruction ID: c17be55b43cc83db0705f22952b8438aac0476cc1b520d5412a9e584b97bd12d
Opcode Fuzzy Hash: 2389004f1622c871db37be869d3889ec8ed68640e4297f82caa4ce24a07498eb
Instruction Fuzzy Hash: C8510C36201F4486EBA6CF12F49439A73A9FF4CBD0F058225EA9A03B64DF38D658C341

Function 0000000180015973 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000180015973

Part of subcall function 000000018002CC60: CreateToolhelp32Snapshot.KERNEL32 ref: 000000018002CC76
Part of subcall function 000000018002CC60: malloc.MSVCRT ref: 000000018002CC84
Part of subcall function 000000018002CC60: Process32FirstW.KERNEL32 ref: 000000018002CCA2
Part of subcall function 000000018002CC60: free.MSVCRT ref: 000000018002CCB7
Part of subcall function 000000018002CC60: CloseHandle.KERNEL32(?,?,00000000,0000000180026D46), ref: 000000018002CCC5

Part of subcall function 000000018002D140: OpenSCManagerW.SECHOST(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D165
Part of subcall function 000000018002D140: EnumServicesStatusExW.ADVAPI32 ref: 000000018002D1B1
Part of subcall function 000000018002D140: malloc.MSVCRT ref: 000000018002D1C6
Part of subcall function 000000018002D140: memset.NTDLL ref: 000000018002D1DC
Part of subcall function 000000018002D140: EnumServicesStatusExW.ADVAPI32 ref: 000000018002D21B
Part of subcall function 000000018002D140: CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000000018001264E), ref: 000000018002D228
Part of subcall function 000000018002D140: free.MSVCRT ref: 000000018002D231

ExitProcess.KERNEL32 ref: 0000000180015998
VirtualFree.KERNEL32 ref: 0000000180015BA8
VirtualFree.KERNEL32 ref: 0000000180015BD2

Strings

Schedule, xrefs: 0000000180015980

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CloseEnumFreeHandleProcessServicesStatusVirtualfreemalloc$CreateCurrentExitFirstManagerOpenProcess32ServiceSnapshotToolhelp32memset
String ID: Schedule
API String ID: 2593299425-2739827629
Opcode ID: d2ede1c26b53fc35dc056e9d6b3441cc13192b8f0a26bde5ec17dc0c8f87d235
Instruction ID: 5fc08f357157a39be1610c2a0e98af4c5ea75a7c59211da2ad713407d599061b
Opcode Fuzzy Hash: d2ede1c26b53fc35dc056e9d6b3441cc13192b8f0a26bde5ec17dc0c8f87d235
Instruction Fuzzy Hash: 01016235301F0881FBE79F61E9903E95295AF8CBD2F14C026FADA46691EE7CC28D5705

Function 0000000180063400 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000180063428
GetProcAddress.KERNEL32 ref: 000000018006343E
FreeLibrary.KERNEL32 ref: 0000000180063457

Strings

CorExitProcess, xrefs: 0000000180063437
mscoree.dll, xrefs: 000000018006341F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e678b758875d27a0bf091b5624fc88a162c43534257f2b693664699c7e9877e8
Instruction ID: 8b8ca0ed71f779e7386428d5087bdfdb25684bd4f02d6e02136788054c443d58
Opcode Fuzzy Hash: e678b758875d27a0bf091b5624fc88a162c43534257f2b693664699c7e9877e8
Instruction Fuzzy Hash: D4F03031201B0881EB968B28A8453996362AB8DBE1F649715E57A456E4DF3DC28DD740

Function 0000000180010720 Relevance: 7.7, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00000001800107F2
memcpy.NTDLL ref: 0000000180010810
memcpy.NTDLL ref: 00000001800108F3

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b36940c9134db9debb5434aae0f74bffe43cbb9a5314d30aa24a6dee75e394a3
Instruction ID: 46dd7e174bbb0176d8158cd44d0f918e6d490295a3558a5e7a1ed015a6db4e3d
Opcode Fuzzy Hash: b36940c9134db9debb5434aae0f74bffe43cbb9a5314d30aa24a6dee75e394a3
Instruction Fuzzy Hash: DE619C32205B888AEBA2CF25E84479973A4FB4CBD4F69C425EE8D43794EF74C649C740

Function 00000001800242A0 Relevance: 7.6, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800242F3
VirtualFree.KERNEL32 ref: 000000018002431D
VirtualAlloc.KERNEL32 ref: 0000000180024334
InitializeCriticalSection.KERNEL32 ref: 00000001800243BE
VirtualFree.KERNEL32 ref: 0000000180024443
VirtualFree.KERNEL32 ref: 000000018002446D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$InitializeLeave
String ID:
API String ID: 2124124174-0
Opcode ID: ce30a7c37a809ab6b36126a6c5df061884de53dfa42c463ff1a9a8109802fa83
Instruction ID: 1a4552423636e67eab2c1520faff09b05bbcc1213573510507159075cfaa0eb2
Opcode Fuzzy Hash: ce30a7c37a809ab6b36126a6c5df061884de53dfa42c463ff1a9a8109802fa83
Instruction Fuzzy Hash: 5F513C32611F4486EBA5DF12F85879A73A9FB8CB84F558125EE8E43B14DF38D258C740

Function 0000000180064930 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180065C60: fegetenv.LIBCMT ref: 0000000180065CAD
Part of subcall function 0000000180065C60: strcpy_s.MSVCRT ref: 0000000180065D3A

memmove.MSVCRT ref: 00000001800649F3
memmove.MSVCRT ref: 0000000180064A24
memmove.MSVCRT ref: 0000000180064A86
memset.NTDLL ref: 0000000180064A96

Strings

-, xrefs: 00000001800649C6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memmove$fegetenvmemsetstrcpy_s
String ID: -
API String ID: 4000792587-2547889144
Opcode ID: 9e9281c9cf7e8c916e0e8b9d00e2d6f619eb730164d884b4f4418d54a07b2f2c
Instruction ID: 8d79f530962e9fe932928b95569a29ece8adb93464e72faaa2e1ae5f2cf6693e
Opcode Fuzzy Hash: 9e9281c9cf7e8c916e0e8b9d00e2d6f619eb730164d884b4f4418d54a07b2f2c
Instruction Fuzzy Hash: DD41E73375878C82E7929F21984039A7792F749FC4F64D211FAAA5BB89DF38D609C701

Function 0000000180056140 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 000000018005621D

Strings

http://, xrefs: 000000018005617A
http_proxy needs to be ads:port, xrefs: 000000018005623A
proxy auth too long, xrefs: 00000001800561F0
lws_set_proxy, xrefs: 000000018005624D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: strchr
String ID: http://$http_proxy needs to be ads:port$lws_set_proxy$proxy auth too long
API String ID: 2830005266-175238664
Opcode ID: d1ab9b85537000d759f710dae04c861439685c4e7ab67b200bb48c131c9f798f
Instruction ID: 252963013e37880a5f6833a7ab8bea35b96ab233e80dd34d852d668b7bae1ba6
Opcode Fuzzy Hash: d1ab9b85537000d759f710dae04c861439685c4e7ab67b200bb48c131c9f798f
Instruction Fuzzy Hash: 7331F631704B8885EBA6DB21E5403EA6351A74ABC4F54C121FE5D17B9BEF29C31EC345

Function 000000018001573B Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800157CB
VirtualFree.KERNEL32 ref: 00000001800157F5
VirtualFree.KERNEL32 ref: 0000000180015BA8
VirtualFree.KERNEL32 ref: 0000000180015BD2

Part of subcall function 000000018002BC20: memcpy.NTDLL ref: 000000018002BC45
Part of subcall function 000000018002BC20: memset.NTDLL ref: 000000018002BCDA
Part of subcall function 000000018002BC20: wsprintfW.USER32 ref: 000000018002BCF9
Part of subcall function 000000018002BC20: SetFileAttributesW.KERNEL32 ref: 000000018002BD09
Part of subcall function 000000018002BC20: DeleteFileW.KERNEL32 ref: 000000018002BD14
Part of subcall function 000000018002BC20: CreateFileW.KERNEL32 ref: 000000018002BD44
Part of subcall function 000000018002BC20: GetLastError.KERNEL32 ref: 000000018002BD53
Part of subcall function 000000018002BC20: SetFileAttributesW.KERNEL32 ref: 000000018002BDA0

Strings

18.166.193.8, xrefs: 00000001800157AF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$FileFree$EnterRead$AttributesLeave$CreateDeleteErrorInitializeLastmemcpymemsetwsprintf
String ID: 18.166.193.8
API String ID: 3047218378-2949878557
Opcode ID: 4748c9799fc4aab539902931fc7cd806f5684b6e31aa09dd6eb953e43b6e7f72
Instruction ID: d95adf5c098e6eb48693c859dd85d07415d347a82ec0fb1ec3a4f0ada00637cd
Opcode Fuzzy Hash: 4748c9799fc4aab539902931fc7cd806f5684b6e31aa09dd6eb953e43b6e7f72
Instruction Fuzzy Hash: BC318432715F4482EBA6DF22E8547AE63A5FF8DBC1F11C115EE8A07A54DF38C2898700

Function 0000000180015668 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180015706
VirtualFree.KERNEL32 ref: 0000000180015730
VirtualFree.KERNEL32 ref: 0000000180015BA8
VirtualFree.KERNEL32 ref: 0000000180015BD2

Strings

18.166.193.8, xrefs: 00000001800156C2

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leave$Initialize
String ID: 18.166.193.8
API String ID: 696443088-2949878557
Opcode ID: 7078d51f2a842d056aef008d8b9e0584b22a38109fb0f17c7c38043e1d6e8ae5
Instruction ID: 5cda13590cf398a7562659c65d185bc26be6142773128daa7fa494d5a847475a
Opcode Fuzzy Hash: 7078d51f2a842d056aef008d8b9e0584b22a38109fb0f17c7c38043e1d6e8ae5
Instruction Fuzzy Hash: 93316F36705B4082EBA5DF12E55875AA3A5FB89BC1F11C115EF8607BA4DF39C289DB00

Function 000000018001D880 Relevance: 7.6, APIs: 5, Instructions: 76memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

CreateThread.KERNEL32 ref: 000000018001D907
IsBadReadPtr.KERNEL32 ref: 000000018001D928
EnterCriticalSection.KERNEL32 ref: 000000018001D93B
VirtualAlloc.KERNEL32 ref: 000000018001D952
LeaveCriticalSection.KERNEL32 ref: 000000018001D976

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocVirtual$EnterRead$Leave$CreateInitializeThread
String ID:
API String ID: 986707815-0
Opcode ID: 13fe9d48963e991135e2c963f540b907288d56d1b03b0de4579185a6b58a6942
Instruction ID: d8726ccc53e9578ca535d2c4e20fec2d7434b428871098f507a6a2abd5c54b50
Opcode Fuzzy Hash: 13fe9d48963e991135e2c963f540b907288d56d1b03b0de4579185a6b58a6942
Instruction Fuzzy Hash: E7314F76310B4486EB559F22E814399B7A5FB8CFD4F488125EE8A47B54EF38C659CB00

Function 000000018004E5B0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,000000018004112F), ref: 000000018004E68E

Strings

%s: OOM, xrefs: 000000018004E61F
%s: buflist reached sanity limit, xrefs: 000000018004E65E
%s: corrupt list points to self, xrefs: 000000018004E63F
lws_buflist_append_segment, xrefs: 000000018004E602, 000000018004E618, 000000018004E633, 000000018004E652

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID: %s: OOM$%s: buflist reached sanity limit$%s: corrupt list points to self$lws_buflist_append_segment
API String ID: 3510742995-575834517
Opcode ID: 79284cf2320dce2018f6e97d572864547c67ef809e1d40b3a32f6d216f6ca7e6
Instruction ID: 4b9f86e74c2c964e6e36c752caefe5a3740dee5ce4422127799d0d10c5e21769
Opcode Fuzzy Hash: 79284cf2320dce2018f6e97d572864547c67ef809e1d40b3a32f6d216f6ca7e6
Instruction Fuzzy Hash: 2521A132204F8881FAA68B15E8803E977A1F74DBD8F568116FA5D077A6DF38C68DC344

Function 00000001800613E0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00000001800613F8

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 867c813408c47003856487d9d7ddf2f299c27c866921b7c00dbaf6564a6c8a9b
Instruction ID: 2552c33322c8c3ba54c5fd4790869664e60f7750ed47400c7edee610d249c408
Opcode Fuzzy Hash: 867c813408c47003856487d9d7ddf2f299c27c866921b7c00dbaf6564a6c8a9b
Instruction Fuzzy Hash: D211363260478480EAD1AB25B5403DE5392E3887D8F29A224FBBA0B7C5CF38C5C78704

Function 0000000180023810 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000180023832
CloseHandle.KERNEL32 ref: 0000000180023840
WaitForSingleObject.KERNEL32 ref: 000000018002384F
GetCurrentProcess.KERNEL32 ref: 0000000180023859
TerminateProcess.KERNEL32 ref: 0000000180023864

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleObjectSingleTerminateThreadWait
String ID:
API String ID: 603326088-0
Opcode ID: 7c3f9b570a8332205efd3d9421a3c14b2d654208f283a85a9c5ac44cbca20012
Instruction ID: 8f792a8b8adbeacd3d34b8155bdf4c4e009a9f7f6f238e385d1c4a564218f734
Opcode Fuzzy Hash: 7c3f9b570a8332205efd3d9421a3c14b2d654208f283a85a9c5ac44cbca20012
Instruction Fuzzy Hash: 70F05471711B0542EB958B72AC043952392AF8CB94F188625AD2A86350FE3CC1499704

Function 0000000180054310 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

_lws_plat_service_tsi, xrefs: 0000000180054573
%s: WSAPoll failed: count %d, err %d: %d, xrefs: 000000018005457E

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: %s: WSAPoll failed: count %d, err %d: %d$_lws_plat_service_tsi
API String ID: 0-2420814896
Opcode ID: 74adf9df8c06806404fa061e618759ccf63e20c0546f0dd375249f3605fd535d
Instruction ID: b55d5f2b5d4eff2fa94cd21e447625c3e30541992c22a958acd5a53cfe757ead
Opcode Fuzzy Hash: 74adf9df8c06806404fa061e618759ccf63e20c0546f0dd375249f3605fd535d
Instruction Fuzzy Hash: 6581F073200A8883EBA68B15A4403EE7295F74C7C8F55C125FF595B795EF39D646CB00

Function 00000001800427A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018004281C
_unlink.MSVCRT ref: 0000000180042A30
memset.NTDLL ref: 0000000180042A77

Strings

lws_free, xrefs: 0000000180042945, 0000000180042988, 000000018004299D, 00000001800429D0, 0000000180042A7C

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memset$_unlink
String ID: lws_free
API String ID: 1884818752-2419506585
Opcode ID: f671c1c9dc5f9f1ecd93fd6c90e8a55de8e0b5723c060ba0bceb813fd88c5dd0
Instruction ID: edff01616a4ec42ddeaebd2ea6e8f158b2aeec0c450080a6a2b70cf555a3a1c5
Opcode Fuzzy Hash: f671c1c9dc5f9f1ecd93fd6c90e8a55de8e0b5723c060ba0bceb813fd88c5dd0
Instruction Fuzzy Hash: 95811B32302F8985EB968F15D4943ED23A0FB88B88F998436EE4D1B395DF38C659C314

Function 0000000180046000 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0000000180046058
_time64.MSVCRT ref: 00000001800460AC

Strings

__lws_header_table_reset, xrefs: 00000001800460D9
%s: calling service, xrefs: 00000001800460E7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _time64memset
String ID: %s: calling service$__lws_header_table_reset
API String ID: 899224009-1639372703
Opcode ID: a9f15bdc1dc03cd649ae2c0efe04c1451751ae562199952308a362106ea05dd7
Instruction ID: 5e82bdfe920b9ab013f9826534e472695fa2a594b32c4a3153a1c9bd49f4ed2a
Opcode Fuzzy Hash: a9f15bdc1dc03cd649ae2c0efe04c1451751ae562199952308a362106ea05dd7
Instruction Fuzzy Hash: F631A132A04BC482E796CF21D5803ED6764F799F88F199236AF581B269EF30D3A5C314

Function 000000018004B8B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB54
Part of subcall function 000000018004BB10: Sleep.KERNEL32 ref: 000000018004BB6D
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB83
Part of subcall function 000000018004BB10: _close.MSVCRT ref: 000000018004BB8E
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BBA3
Part of subcall function 000000018004BB10: _unlink.MSVCRT ref: 000000018004BBB4

_close.MSVCRT ref: 000000018004B970
_unlink.MSVCRT ref: 000000018004B97A

Strings

lws_cache_nscookiejar_get, xrefs: 000000018004B8D3
%s.LCK, xrefs: 000000018004B956

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _open$_close_unlink$Sleep
String ID: %s.LCK$lws_cache_nscookiejar_get
API String ID: 356877787-304041560
Opcode ID: b1e3df4582b37e7dde39b4fa126397fa21afb4d055b57bb552a81beab581970c
Instruction ID: 0e1a78b773a8576f51197be4f1b4fe07d40e9a723c09fba01995f84b77e9cf2f
Opcode Fuzzy Hash: b1e3df4582b37e7dde39b4fa126397fa21afb4d055b57bb552a81beab581970c
Instruction Fuzzy Hash: 9E21AF32204F8882E7A18B11F4807CAB3A8F78C7C4F558126FB8883B59CF79CA19C740

Function 000000018004B740 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB54
Part of subcall function 000000018004BB10: Sleep.KERNEL32 ref: 000000018004BB6D
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BB83
Part of subcall function 000000018004BB10: _close.MSVCRT ref: 000000018004BB8E
Part of subcall function 000000018004BB10: _open.MSVCRT ref: 000000018004BBA3
Part of subcall function 000000018004BB10: _unlink.MSVCRT ref: 000000018004BBB4

_close.MSVCRT ref: 000000018004B7D9
_unlink.MSVCRT ref: 000000018004B7E3

Strings

%s.LCK, xrefs: 000000018004B7BF
lws_cache_nscookiejar_lookup, xrefs: 000000018004B75D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _open$_close_unlink$Sleep
String ID: %s.LCK$lws_cache_nscookiejar_lookup
API String ID: 356877787-2679908804
Opcode ID: 465c451c24f9ada9f804976cb20c197d3705dce7109b0904ed9b8404b6572737
Instruction ID: 07452c2cd75102b3e7bf713fc4565c5959315d14a178c7364d5e03bed58855c7
Opcode Fuzzy Hash: 465c451c24f9ada9f804976cb20c197d3705dce7109b0904ed9b8404b6572737
Instruction Fuzzy Hash: 00117536204F4881E7519B25B4803DA73A5F78C7E4F558322FAA9477D9CF38C649C740

Function 0000000180065850 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000018006585B
GetProcAddress.KERNEL32 ref: 0000000180065870

Strings

AddDllDirectory, xrefs: 0000000180065866
kernel32, xrefs: 0000000180065854

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AddDllDirectory$kernel32
API String ID: 1646373207-3758863895
Opcode ID: bef0785b2c8924bfbec88b289f6832a9af4e4c3d9dcee81fd5aeb069f45e08fe
Instruction ID: 6a439ee3dd2f551b152c436993547d8ce955f4df82582785ea2ae01e4f1208fa
Opcode Fuzzy Hash: bef0785b2c8924bfbec88b289f6832a9af4e4c3d9dcee81fd5aeb069f45e08fe
Instruction Fuzzy Hash: 10F01530A12B8885FAC6CB24AC503D123A1FB6D780FA8D615E84912360EFAD93D89300

Function 000000018005C3AF Relevance: 6.4, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 000000018005C3DF
memcpy.NTDLL ref: 000000018005C3F7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d42d265467519c93c7dd951c29be45eba968ee9a7fe8673b8b37004fd25c35d6
Instruction ID: d4dacb9b5bf7a5b83de5f42d58e9740fdd28e5af92b2877f69c7988f04a7870b
Opcode Fuzzy Hash: d42d265467519c93c7dd951c29be45eba968ee9a7fe8673b8b37004fd25c35d6
Instruction Fuzzy Hash: 2141C13261478886EB96CF218450BEA27A0FB5DBC8F44D112FE4967685EF39C749C302

Function 000000018001B460 Relevance: 6.3, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001B4AB
VirtualFree.KERNEL32 ref: 000000018001B4D5
memset.NTDLL ref: 000000018001B4F6
VirtualFree.KERNEL32 ref: 000000018001B546
VirtualFree.KERNEL32 ref: 000000018001B570

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leave$Initializememset
String ID:
API String ID: 3460648485-0
Opcode ID: 3c6ebeff4e04c1c6b57bce02760e90bbf3a7ae38a370be6e0e926dec6ce5aaa2
Instruction ID: 87dde599cd748b8c32ebc84dd2c552ad12c09ebbabe043a8493efcfea12d56ee
Opcode Fuzzy Hash: 3c6ebeff4e04c1c6b57bce02760e90bbf3a7ae38a370be6e0e926dec6ce5aaa2
Instruction Fuzzy Hash: 9E315E32311E9486EB65DF67E9543AAA361FB8DBC1F448024DF8A47F54DF38C2598B00

Function 0000000180043620 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 172stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 000000018004377E

Strings

can't find role '%s', xrefs: 0000000180043741
lws_role_call_adoption_bind, xrefs: 0000000180043754
raw-proxy, xrefs: 0000000180043770

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: strcmp
String ID: can't find role '%s'$lws_role_call_adoption_bind$raw-proxy
API String ID: 1004003707-2670016624
Opcode ID: ddc2dee7fed4307f6de14917132bf2b0f3b232720b966688f40a1457e8129b7c
Instruction ID: 856c33a7f91d113fa80138d5a6edae469c5f059fe421a065bee95859f9defa15
Opcode Fuzzy Hash: ddc2dee7fed4307f6de14917132bf2b0f3b232720b966688f40a1457e8129b7c
Instruction Fuzzy Hash: 06614671304B8D41EEA68B1698917E97BA1F749FC8F19D029FE8947395DE38C20AD344

Function 000000018003F4C0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 000000018003F610

Strings

http, xrefs: 000000018003F505
wss, xrefs: 000000018003F587
https, xrefs: 000000018003F564

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: atoi
String ID: http$https$wss
API String ID: 657269090-1519134247
Opcode ID: 701d953922a376634be604cd511beec6f9bc88c6d0ba1ed9f7566711d4f08381
Instruction ID: be4ecfb893a0eccff37447a91141d411b24d30939406da6c691932dec41fcb09
Opcode Fuzzy Hash: 701d953922a376634be604cd511beec6f9bc88c6d0ba1ed9f7566711d4f08381
Instruction Fuzzy Hash: FC519072508ACC44EBF34F2494113FA3BE1A31ABC8F5AC052E7D5463D6DE6A865E8311

Function 0000000180057330 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 0000000180057391
tolower.MSVCRT ref: 0000000180057423
memcpy.NTDLL ref: 0000000180057490

Strings

transfer-encoding, xrefs: 0000000180057387

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpystrncmptolower
String ID: transfer-encoding
API String ID: 1825611792-1470906230
Opcode ID: c539f7db85004bbdaa11fa9888ce0fed88215ddef03d4659c1c778ac67b775c8
Instruction ID: b97529d15c7033a20ce9e5b24556692f0e3a2daee8d10b7a8aa24fb646eaf914
Opcode Fuzzy Hash: c539f7db85004bbdaa11fa9888ce0fed88215ddef03d4659c1c778ac67b775c8
Instruction Fuzzy Hash: 6B41A072304A8885EB568E26E4503A93BA1E359BD4F14C111FF4E5738ADF3EC259A701

Function 000000018006163E Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

__pctype_func.MSVCRT ref: 000000018006165C
_errno.MSVCRT ref: 00000001800616AC
_errno.MSVCRT ref: 00000001800616BC
free.MSVCRT ref: 0000000180061964

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno$__pctype_funcfree
String ID:
API String ID: 2006978261-0
Opcode ID: 33940d6e5fc8a6375603b3a7ba23e2abfb58298483cfd1f6bf6a832e02cc6377
Instruction ID: b4b0e41c05156b32ca972ba8fb8b71cd992a7ca077e43592f321546519cbf2a4
Opcode Fuzzy Hash: 33940d6e5fc8a6375603b3a7ba23e2abfb58298483cfd1f6bf6a832e02cc6377
Instruction Fuzzy Hash: 93412F761087D48DE6A3CB54D8903EE77A6E7497C6F388005FBA607795CE38C649DB10

Function 0000000180060FF8 Relevance: 6.1, APIs: 4, Instructions: 106stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180061005
strtol.MSVCRT ref: 0000000180061034
_errno.MSVCRT ref: 0000000180061044
free.MSVCRT ref: 0000000180061149

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno$freestrtol
String ID:
API String ID: 3444388478-0
Opcode ID: 7403869242572383e56bd683cb69b1769a801e6b061c76f3d918504b1cdbba2f
Instruction ID: 8f4a69c81363a754ddd304638c94179cbfff9b1927f4a6e99413924a4c35ebc5
Opcode Fuzzy Hash: 7403869242572383e56bd683cb69b1769a801e6b061c76f3d918504b1cdbba2f
Instruction Fuzzy Hash: 2B4172322047888AFBA28F55E8413DE77E2F7997C4F248015FA5947B95CF78D689CB40

Function 0000000180061767 Relevance: 6.1, APIs: 4, Instructions: 101stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180061777
strtol.MSVCRT ref: 00000001800617A3
_errno.MSVCRT ref: 00000001800617B3
free.MSVCRT ref: 0000000180061964

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno$freestrtol
String ID:
API String ID: 3444388478-0
Opcode ID: a06b1ada0f63e894549ed10f8a9d1f824d61a194adaed997a72c8b2d82c9a995
Instruction ID: 2819dd1aeb03ba59555edd1c06ea1e1e03ba90f198c7d6ece65a8170e5ad630e
Opcode Fuzzy Hash: a06b1ada0f63e894549ed10f8a9d1f824d61a194adaed997a72c8b2d82c9a995
Instruction Fuzzy Hash: 5A4174321087888ED7A28F55E8113DA77F6F78A795F248005FBA947B59CF39CA45CB01

Function 0000000180056480 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,Unable to connect,0000000180059EE8), ref: 0000000180056573
memcpy.NTDLL(?,?,Unable to connect,0000000180059EE8), ref: 0000000180056591

Strings

lws_conmon_append_copy_new_dns_results, xrefs: 0000000180056539
Unable to connect, xrefs: 000000018005648F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: memcpy
String ID: Unable to connect$lws_conmon_append_copy_new_dns_results
API String ID: 3510742995-4193639203
Opcode ID: cba5df87d3bc34571f15c18130ba281561c34a16ecc347fc48b3718e4e5733a0
Instruction ID: 62ed0a04fc34075671b1a35ecb37c3fee2d7bdfcd5a5fba08d5d5aed4e27db10
Opcode Fuzzy Hash: cba5df87d3bc34571f15c18130ba281561c34a16ecc347fc48b3718e4e5733a0
Instruction Fuzzy Hash: 8A41BF32A01B8482EBA68F15D14039977A1F788BD8F19C225FF5D177A9EF35CA94C740

Function 0000000180061853 Relevance: 6.1, APIs: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000000018006185F
strtol.MSVCRT ref: 000000018006188B
_errno.MSVCRT ref: 000000018006189B
free.MSVCRT ref: 0000000180061964

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno$freestrtol
String ID:
API String ID: 3444388478-0
Opcode ID: 2fab18c1fb587b9acd116ee4d26edb839a0c2fe629e5373b20a55bce3426e234
Instruction ID: 03f7d72303650e760b238060e1d29e39a08159ff3c43742a9185a1a9f6e10b22
Opcode Fuzzy Hash: 2fab18c1fb587b9acd116ee4d26edb839a0c2fe629e5373b20a55bce3426e234
Instruction Fuzzy Hash: 83318432208B888ED7A28F55E8403DA77F6F78A7D5F248005FB9947A59CF39CA45CB00

Function 000000018002F080 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000018002F0A4
ProcessIdToSessionId.KERNEL32 ref: 000000018002F0B1

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002F164
VirtualFree.KERNEL32 ref: 000000018002F18E

Part of subcall function 0000000180016F60: GetCurrentProcessId.KERNEL32 ref: 0000000180016FDB
Part of subcall function 0000000180016F60: ProcessIdToSessionId.KERNEL32 ref: 0000000180016FEB
Part of subcall function 0000000180016F60: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000180017014
Part of subcall function 0000000180016F60: GetProcessHeap.KERNEL32 ref: 0000000180017023
Part of subcall function 0000000180016F60: HeapAlloc.KERNEL32 ref: 0000000180017036
Part of subcall function 0000000180016F60: CloseHandle.KERNEL32 ref: 0000000180017047
Part of subcall function 0000000180016F60: WTSGetActiveConsoleSessionId.KERNEL32 ref: 0000000180017056
Part of subcall function 0000000180016F60: VirtualFree.KERNEL32 ref: 00000001800171B6
Part of subcall function 0000000180016F60: VirtualFree.KERNEL32 ref: 00000001800171E0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Process$Free$EnterReadSession$CurrentHeapLeave$ActiveCloseConsoleCreateHandleInitializeSnapshotToolhelp32
String ID:
API String ID: 1320018004-0
Opcode ID: 219dca6d74f5f01e876d51951d5a85646c7e832a6bf75ab04d447e85a6392336
Instruction ID: ba0eed75bc608429606151e3293df9a5b704ab4f115ec94558a233db70ef6dfe
Opcode Fuzzy Hash: 219dca6d74f5f01e876d51951d5a85646c7e832a6bf75ab04d447e85a6392336
Instruction Fuzzy Hash: 11315071220B5482EBA6DF11E9543AD73A1FB8DFC4F549125FA4A43B58DF38C658CB40

Function 0000000180034470 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00000001800344CF
SetEvent.KERNEL32 ref: 0000000180034510
VirtualFree.KERNEL32 ref: 0000000180034559
VirtualFree.KERNEL32 ref: 0000000180034584

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$AllocEvent
String ID:
API String ID: 2763048252-0
Opcode ID: 408b677a78ec5f951b203cb1d68421295c5c1a06c57e89676511e7fcc40283bb
Instruction ID: ca46a6e6144f43be1c06cafe765a2f507bfaca408efeb33c880b441cc711b9cf
Opcode Fuzzy Hash: 408b677a78ec5f951b203cb1d68421295c5c1a06c57e89676511e7fcc40283bb
Instruction Fuzzy Hash: 03319332700E4442EBE68F26A9043AE5791EB8EFD0F19C120FE5A8FB96DE34D5498700

Function 000000018002DA00 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

SetEvent.KERNEL32 ref: 000000018002DB49
CloseHandle.KERNEL32 ref: 000000018002DB58
ResetEvent.KERNEL32 ref: 000000018002DB66
VirtualFree.KERNEL32 ref: 000000018002DB85

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$EventLeave$CloseFreeHandleInitializeReset
String ID:
API String ID: 4208512464-0
Opcode ID: ca07846258ba37867d244566e482efccc0d3ec0fcc94a16ac108a6f4784184ef
Instruction ID: 7119ede1bc8f247312d9066bb2ce911e20643d41b723819dda8a12293ed4a632
Opcode Fuzzy Hash: ca07846258ba37867d244566e482efccc0d3ec0fcc94a16ac108a6f4784184ef
Instruction Fuzzy Hash: 18315C36211B4482EB96CF62E9A836963A5FB8CBC0F1A8125EF4A43B54DF38D559C700

Function 00000001800235C0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00000001800235DD
ProcessIdToSessionId.KERNEL32 ref: 00000001800235EA

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002367E
VirtualFree.KERNEL32 ref: 00000001800236A8

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeaveProcess$CurrentInitializeSession
String ID:
API String ID: 3327369976-0
Opcode ID: f98e4ae98b7e11fca3d4a9eee25e402cb3ff29b46a0d4ad6d7052e7fc59a9eec
Instruction ID: fd99c6a66cd7ea800b156c20b4fee5fc952d6e6d35935e791b67945c2d11420b
Opcode Fuzzy Hash: f98e4ae98b7e11fca3d4a9eee25e402cb3ff29b46a0d4ad6d7052e7fc59a9eec
Instruction Fuzzy Hash: 42313C32614B4487DB65DF26E44835EB3A5FB88B80F548225EB8A43B18DF3DD649CB40

Function 000000018002A710 Relevance: 6.1, APIs: 4, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

CreateThread.KERNEL32 ref: 000000018002A782
CloseHandle.KERNEL32 ref: 000000018002A790
VirtualFree.KERNEL32 ref: 000000018002A7AC
VirtualFree.KERNEL32 ref: 000000018002A7D6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeave$CloseCreateHandleInitializeThread
String ID:
API String ID: 4031785131-0
Opcode ID: 46f8680c48a87c550885bc35dd8c9f8526c11e3e393dc63d790dd5bf2b061a43
Instruction ID: 09a8c634ee0a77ba13094bb06eb91f4e081066f499e8da2bd266085e45850a2b
Opcode Fuzzy Hash: 46f8680c48a87c550885bc35dd8c9f8526c11e3e393dc63d790dd5bf2b061a43
Instruction Fuzzy Hash: DF213C35708B5082EB65DF53E95435AA3A1FB8DFD0F548129EF8A43B14DF38C2598B44

Function 0000000180026140 Relevance: 6.1, APIs: 4, Instructions: 52threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180026188
VirtualFree.KERNEL32 ref: 00000001800261B2
CreateThread.KERNEL32 ref: 00000001800261CF
CloseHandle.KERNEL32 ref: 00000001800261DD

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeave$CloseCreateHandleInitializeThread
String ID:
API String ID: 4031785131-0
Opcode ID: 9906d6a9ce0f7f254b3389b28713ac5881b4f0dc512eb4610b511277353699d5
Instruction ID: fee17a65687eca907a640ac3992546147f88c45a078b2ee3effaee71f90555ba
Opcode Fuzzy Hash: 9906d6a9ce0f7f254b3389b28713ac5881b4f0dc512eb4610b511277353699d5
Instruction Fuzzy Hash: 97116031705B4082EB95CF63E95435AA3A2BF8CBC1F18C125AB4A43B54DF38D2698700

Function 0000000180035340 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 0000000180035368
WaitForSingleObject.KERNEL32 ref: 0000000180035389
SetEvent.KERNEL32 ref: 00000001800353A9
SetEvent.KERNEL32 ref: 00000001800353C0

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Event$ObjectSingleWait
String ID:
API String ID: 2127046782-0
Opcode ID: de6cca13531ef7be6a56a105a458a4c89b63c3fe75a489721cd85d5858837fa3
Instruction ID: 2c01373562b33313cd830499f931160716592ca7e4d13661f1fd562ed2423c3d
Opcode Fuzzy Hash: de6cca13531ef7be6a56a105a458a4c89b63c3fe75a489721cd85d5858837fa3
Instruction Fuzzy Hash: F601613271464882DBE38B26E98475E63A1EB8CFD1F598115EA5A47768DE38CA888700

Function 00000001800657C0 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__doserrno.MSVCRT ref: 00000001800657C8
_errno.MSVCRT ref: 00000001800657FC
_errno.MSVCRT ref: 000000018006581F
_errno.MSVCRT ref: 0000000180065830

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: 20d2c32074349d48a8cbea65d446fceb55f8d0b1952b234c74b6baaf4ab55aad
Instruction ID: 405686cd66764e33d468f82bc5af396d13ed71ab515ca335fd6e198ab223c558
Opcode Fuzzy Hash: 20d2c32074349d48a8cbea65d446fceb55f8d0b1952b234c74b6baaf4ab55aad
Instruction Fuzzy Hash: 3001317260030887F7569F6198C13EC7652F78C791FA4C465EA9687382CB3CDE9A9B31

Function 0000000180035890 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000000018003589E
CancelIo.KERNEL32 ref: 00000001800358B0
closesocket.WS2_32 ref: 00000001800358B9
SetEvent.KERNEL32 ref: 00000001800358CF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CancelEventReadclosesocket
String ID:
API String ID: 2025173275-0
Opcode ID: 4ad045dac1ffec8b3e3923f420bc84c49a6e4073b63f8c3011d5d04808e9b135
Instruction ID: 8d8f0d6516a369597c4c9c5b95e094f64713f714c325bb1ecda08875fb2905f0
Opcode Fuzzy Hash: 4ad045dac1ffec8b3e3923f420bc84c49a6e4073b63f8c3011d5d04808e9b135
Instruction Fuzzy Hash: 0FE06D30302B0981EB975FB1DC503A923E1AF8CFB5F28871099765A2E0EE38C68C8311

Function 00000001800623DD Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

0, xrefs: 00000001800626B7
(null), xrefs: 000000018006246D

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: (null)$0
API String ID: 0-38302674
Opcode ID: abca63399dbdd7ca1ead2dfee145f9cfa62680915ab84428c804b8a6cddf5cc6
Instruction ID: 4d5c2c8232b3af33984ae3620493541ef960866ed1991a6be4f82b168020b8be
Opcode Fuzzy Hash: abca63399dbdd7ca1ead2dfee145f9cfa62680915ab84428c804b8a6cddf5cc6
Instruction Fuzzy Hash: 2CA1D772108B8886E7A6CF28C8507EC37A2F359BD8F349115EEA947784DF35CA89C750

Function 00000001800625A3 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0000000180062609

Strings

0, xrefs: 00000001800626B7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _errno
String ID: 0
API String ID: 2918714741-4108050209
Opcode ID: 9cb55340de0e0c956073168701fea7522db158bb8432f989bb6f7b05cee61b81
Instruction ID: f891781a2b9557852fdfb9fbd1eda0dcc53d157cf0ab2b3fbb965be7ad7fb1cd
Opcode Fuzzy Hash: 9cb55340de0e0c956073168701fea7522db158bb8432f989bb6f7b05cee61b81
Instruction Fuzzy Hash: 6B91D472218F4886EBA68F24C8407DD77A2F349BD8F749105EEA947784DF31CA8AC750

Function 000000018004C240 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

_write.MSVCRT ref: 000000018004C3D5
_write.MSVCRT ref: 000000018004C3F8

Part of subcall function 000000018004BDB0: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,000000018004B84A), ref: 000000018004BE86

Strings

|, xrefs: 000000018004C330

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: _write$memcpy
String ID: |
API String ID: 2496997324-2343686810
Opcode ID: cf61cce58ca886a15639403763adbc2e92bf79bdf61202eea4e7dfec986bcaf2
Instruction ID: f5d95356925bf96b949fbac8440fedc852c231d531356daa4554cdaebf1fd592
Opcode Fuzzy Hash: cf61cce58ca886a15639403763adbc2e92bf79bdf61202eea4e7dfec986bcaf2
Instruction Fuzzy Hash: 8E41F032305A9845EBE2CE25E584FD96394A70CBE8F4AC220AE6D077C1EF78C6498305

Function 00000001800654C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__pctype_func.MSVCRT ref: 00000001800655DA

Strings

fputc, xrefs: 0000000180065633
fwrite, xrefs: 0000000180065568

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: __pctype_func
String ID: fputc$fwrite
API String ID: 3630429742-4291123875
Opcode ID: e9c822b156731075839b8dd13e10875af72a52f84741304959ba05d5b208b560
Instruction ID: 44149378926c2d2e8bc3668b927d6e186dfb69a0892a42676b92b45da591eb46
Opcode Fuzzy Hash: e9c822b156731075839b8dd13e10875af72a52f84741304959ba05d5b208b560
Instruction Fuzzy Hash: BA41A47230474885EA839B15EC503D96792AB8C7D5FA88421FAAD473D1EF7EC789C350

Function 0000000180065990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00008000,0000000180065646), ref: 0000000180065A24

Strings

msvcrt.dll, xrefs: 00000001800659FB

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: AddressProc
String ID: msvcrt.dll
API String ID: 190572456-370904613
Opcode ID: 35b34b007912df18696ede91bd601e8c24f75c165dbc50d2eff092ee0ae85306
Instruction ID: 83da91c7f337b7bd77e87f6f6c15018bd6bf63ffd80dd08b0972f13de6a05fcd
Opcode Fuzzy Hash: 35b34b007912df18696ede91bd601e8c24f75c165dbc50d2eff092ee0ae85306
Instruction Fuzzy Hash: BA115E32316B4486EED59B16BD543A962A1AB4C7F0F1C9325AEBE477D4DE3CC6854300

Function 000000018001A9A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetRawInputData.USER32 ref: 000000018001A9EC

Part of subcall function 0000000180019EC0: __chkstk.NTDLL ref: 0000000180019ED2
Part of subcall function 0000000180019EC0: lstrlenW.KERNEL32 ref: 0000000180019EEB
Part of subcall function 0000000180019EC0: memset.NTDLL ref: 0000000180019F13
Part of subcall function 0000000180019EC0: memset.NTDLL ref: 0000000180019F33
Part of subcall function 0000000180019EC0: GetForegroundWindow.USER32 ref: 0000000180019F38
Part of subcall function 0000000180019EC0: GetWindowTextW.USER32 ref: 0000000180019F53
Part of subcall function 0000000180019EC0: GetWindowThreadProcessId.USER32 ref: 0000000180019F67
Part of subcall function 0000000180019EC0: ProcessIdToSessionId.KERNEL32 ref: 0000000180019F90
Part of subcall function 0000000180019EC0: memset.NTDLL ref: 0000000180019FA5
Part of subcall function 0000000180019EC0: lstrlenW.KERNEL32 ref: 0000000180019FC3
Part of subcall function 0000000180019EC0: GetLocalTime.KERNEL32 ref: 0000000180019FD6
Part of subcall function 0000000180019EC0: wsprintfW.USER32 ref: 000000018001A03E
Part of subcall function 0000000180019EC0: lstrlenW.KERNEL32 ref: 000000018001A04B
Part of subcall function 0000000180019EC0: lstrlenA.KERNEL32 ref: 000000018001A091
Part of subcall function 0000000180019EC0: MultiByteToWideChar.KERNEL32 ref: 000000018001A0AA

DefWindowProcW.USER32 ref: 000000018001AA2A

Strings

0, xrefs: 000000018001A9CF

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Windowlstrlen$memset$Process$ByteCharDataForegroundInputLocalMultiProcSessionTextThreadTimeWide__chkstkwsprintf
String ID: 0
API String ID: 780575994-4108050209
Opcode ID: 8004b3049ace1bb0400474f1a69768e4362440f1312b9a8d3f505a6f2555652d
Instruction ID: 2d4eacf1f5af29a440ccc26e887150bb4de9b194b90760097f7252ead43421a7
Opcode Fuzzy Hash: 8004b3049ace1bb0400474f1a69768e4362440f1312b9a8d3f505a6f2555652d
Instruction Fuzzy Hash: 70019631618A8982F7918B21E9003EA7294FB99BD0F648221FA9043BD9CF3CC648CB41

Function 00000001800565E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 000000018005660E
WSAGetLastError.WS2_32 ref: 0000000180056618

Strings

getpeername: %s, xrefs: 0000000180056628

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastgetpeername
String ID: getpeername: %s
API String ID: 2962421750-464625284
Opcode ID: a69c3c67f136694d744e90525e7a2b9d8621fa00472cafbfdea3fe4c2253d187
Instruction ID: 8e5b22f6c71745472d771a736240a2f8b38a5d5d456bd51779f5d5866a1b17d5
Opcode Fuzzy Hash: a69c3c67f136694d744e90525e7a2b9d8621fa00472cafbfdea3fe4c2253d187
Instruction Fuzzy Hash: 1DF06D3570474882EA829B15F9453EAA361BB8DBC8F588121FE594775ADF39C2488B40

Function 0000000180040900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0000000180040918
WSAGetLastError.WS2_32 ref: 0000000180040929

Strings

ioctlsocket FIONBIO 1 failed with error %d, xrefs: 000000018004092F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ioctlsocket FIONBIO 1 failed with error %d
API String ID: 1021210092-1910823214
Opcode ID: 5437741f9e197df0456073593f822ef657802a2ced6ff6b5c6ff5a60d5650b15
Instruction ID: 75109152500bcb920f4cd58b11379dbfff7cd0b414408c246ebc3ca18becf466
Opcode Fuzzy Hash: 5437741f9e197df0456073593f822ef657802a2ced6ff6b5c6ff5a60d5650b15
Instruction Fuzzy Hash: 3DE02670760B0B82F7810BF09C843D516519B0C3E9F549024BC02462A0EE3CDACD8721

Function 000000018001C6E0 Relevance: 5.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134EB
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800134FD
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013510
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013527
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013556
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013568
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001357B
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013592
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135C1
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800135D3
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135E6
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135FD
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001362C
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 000000018001363E
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013654

VirtualFree.KERNEL32 ref: 000000018001C7B5
VirtualFree.KERNEL32 ref: 000000018001C7DF
VirtualFree.KERNEL32 ref: 000000018001C7F5
VirtualFree.KERNEL32 ref: 000000018001C81F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterRead$Leave$Free$Initialize
String ID:
API String ID: 3420869360-0
Opcode ID: 617031c2d221066431aaff11be6c94ed0690b72a67014eff584da1fe74eb40db
Instruction ID: 4b1bcc27734f02408279893b6751d45a886e410d29ecad7f0b8f3cb754ffc34a
Opcode Fuzzy Hash: 617031c2d221066431aaff11be6c94ed0690b72a67014eff584da1fe74eb40db
Instruction Fuzzy Hash: B6416A32715B4086EBA5CF62E45875AB7A5FB8CFC0F148528EF8A03B18DF39C5498B04

Function 00000001800284D0 Relevance: 5.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134EB
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800134FD
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013510
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013527
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013556
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013568
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001357B
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013592
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135C1
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800135D3
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135E6
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800135FD
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001362C
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 000000018001363E
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013654

VirtualFree.KERNEL32 ref: 000000018002859B
VirtualFree.KERNEL32 ref: 00000001800285C5
VirtualFree.KERNEL32 ref: 00000001800285DB
VirtualFree.KERNEL32 ref: 0000000180028605

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterRead$Leave$Free$Initialize
String ID:
API String ID: 3420869360-0
Opcode ID: 23f78063f8314758092a3b7e396099cf00d438552d882076b8ccf9c8bf355a0d
Instruction ID: 4e4304c5467bf88644f6851a9460645099648ae5db845c2dc60d587a2a73c880
Opcode Fuzzy Hash: 23f78063f8314758092a3b7e396099cf00d438552d882076b8ccf9c8bf355a0d
Instruction Fuzzy Hash: 77417936711B5486EBA5DF22E44875AB3A5FB8CFC0F598124EF8A43B18DF39D2458B00

Function 00000001800281A0 Relevance: 5.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180028213

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 0000000180028258
VirtualFree.KERNEL32 ref: 000000018002828E
VirtualFree.KERNEL32 ref: 000000018002829F

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 1d1b306bf3c46ccf6e7229351797aac4dc12f87dd746d871babab7f5bc255a71
Instruction ID: 77ad1e5231ed8a476fbfc46c42ae85b2aca4ea425d337ae87cc9ce4e505ece4b
Opcode Fuzzy Hash: 1d1b306bf3c46ccf6e7229351797aac4dc12f87dd746d871babab7f5bc255a71
Instruction Fuzzy Hash: E6316D35712E4481FBD68F62E9543A963A1FF8CFD4F18C124EE1A47B84EF28C6599700

Function 0000000180021210 Relevance: 5.1, APIs: 4, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180021274

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800212B9
VirtualFree.KERNEL32 ref: 00000001800212EF
VirtualFree.KERNEL32 ref: 0000000180021300

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 5944f9928c617558d6447f66ff93bef18e990b1e2edeae30f48a59bf0b4b3e49
Instruction ID: 6a34f556e1eb952260192988d07e5359ed630ace43cde530af1f5a91e9e1e4a4
Opcode Fuzzy Hash: 5944f9928c617558d6447f66ff93bef18e990b1e2edeae30f48a59bf0b4b3e49
Instruction Fuzzy Hash: E7318E31310A4485EB96DF27E9543A923A1BB8CFD5F088124EE1A87B48EF28C6598740

Function 0000000180033030 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000000180033094

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800330D9
VirtualFree.KERNEL32 ref: 000000018003310F
VirtualFree.KERNEL32 ref: 0000000180033120

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: b8f4db6db1d0367102d5a07de2158188bc80ba2991919440e33211faedfcd802
Instruction ID: e4aa63813d0d37e329d180b1982be950b0dfcde14e28e818de6d8c70130e72de
Opcode Fuzzy Hash: b8f4db6db1d0367102d5a07de2158188bc80ba2991919440e33211faedfcd802
Instruction Fuzzy Hash: 23316231310A4481EBD68F27E99539A63A1FF4CFD4F09C124EE5A47B98DF39C6598700

Function 000000018001C150 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001C1B4

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001C1F9
VirtualFree.KERNEL32 ref: 000000018001C22F
VirtualFree.KERNEL32 ref: 000000018001C240

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 62c558665775160bff6bd4cbced2f3b4a28216fdecb6bb590b6097234b34c5f5
Instruction ID: 0111d3a934c151165b550e2593a99b7e0e9a14f01953bedcd4608c31b277a33a
Opcode Fuzzy Hash: 62c558665775160bff6bd4cbced2f3b4a28216fdecb6bb590b6097234b34c5f5
Instruction Fuzzy Hash: BC319E31310E4482EB968F67E9547A963A1FF8CFD4F08C124EE1A47B88EF38C6598745

Function 000000018001B170 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001B1D4

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018001B219
VirtualFree.KERNEL32 ref: 000000018001B24F
VirtualFree.KERNEL32 ref: 000000018001B260

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 6a0dbe3a0a406c02cb2e4d729dffdfe30f5f50d64f32219fd7338cec30936ee1
Instruction ID: 4b2e6c66f327050a27fcd0c51096eb3f8ae716981fc83d70c768d5fe3c7de98f
Opcode Fuzzy Hash: 6a0dbe3a0a406c02cb2e4d729dffdfe30f5f50d64f32219fd7338cec30936ee1
Instruction Fuzzy Hash: A2316D31310A4481EB969F67E9547AD63A5FB8CFD4F088124EE1A87B98EF38C6598700

Function 000000018002A420 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018002A484

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002A4C9
VirtualFree.KERNEL32 ref: 000000018002A4FF
VirtualFree.KERNEL32 ref: 000000018002A510

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 626f2b7068f63ec094e6a9f92076cad6c8906216c14cb64ffb88a0ffa73d076f
Instruction ID: efda1176230fd9837f10b735971e29991b7c7a4935e118cfebe42542b14e463d
Opcode Fuzzy Hash: 626f2b7068f63ec094e6a9f92076cad6c8906216c14cb64ffb88a0ffa73d076f
Instruction Fuzzy Hash: 6A317131314A4486FB969F27E9543AA63A1FF8DFD4F08C124EE1A47B58EF29C6598700

Function 00000001800304F0 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018003055B

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 00000001800305A0
VirtualFree.KERNEL32 ref: 00000001800305D6
VirtualFree.KERNEL32 ref: 00000001800305E7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: f5394e92998ff4ba06ab85d94ac86c9fd9ddc821b539b28ef3b02b42b4153c03
Instruction ID: cea3756b3c5a100aeeaf40825adb8834645a0e8f2fd0e7eedf42260691285d7d
Opcode Fuzzy Hash: f5394e92998ff4ba06ab85d94ac86c9fd9ddc821b539b28ef3b02b42b4153c03
Instruction Fuzzy Hash: 98319131315A4481FBD68F63E96439A63A1FF8CFD4F19C124EE1A47B48EF28C6598700

Function 000000018002D8D0 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018002D93A

Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013347
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 000000018001338F
Part of subcall function 0000000180013330: InitializeCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133A3
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 00000001800133BC
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133CF
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800133E6
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013415
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013427
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 000000018001343A
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013451
Part of subcall function 0000000180013330: LeaveCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 0000000180013480
Part of subcall function 0000000180013330: IsBadReadPtr.KERNEL32 ref: 0000000180013492
Part of subcall function 0000000180013330: EnterCriticalSection.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134A5
Part of subcall function 0000000180013330: VirtualAlloc.KERNEL32(?,?,?,0000000180012014), ref: 00000001800134BC

VirtualFree.KERNEL32 ref: 000000018002D97F
VirtualFree.KERNEL32 ref: 000000018002D9B5
VirtualFree.KERNEL32 ref: 000000018002D9C6

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: ec5b1167f005ac1d8a69da9b77871cfdf6301f2a7abf43893b2e18070580acd4
Instruction ID: 02f4f0b180749e235a0dc1c370b86b5da43c00d82dbe72d6a566ac768cb93689
Opcode Fuzzy Hash: ec5b1167f005ac1d8a69da9b77871cfdf6301f2a7abf43893b2e18070580acd4
Instruction Fuzzy Hash: 45315031310A4841EB96DF27E9547A963A1BB4DFD4F08C126EE5A47B94DF28CA998700

Function 000000018001C42B Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000000018001C44F
VirtualFree.KERNEL32 ref: 000000018001C482
VirtualFree.KERNEL32 ref: 000000018001C49A
VirtualFree.KERNEL32 ref: 000000018001C4C4

Part of subcall function 0000000180020E40: lstrlenW.KERNEL32 ref: 0000000180020E50
Part of subcall function 0000000180020E40: WideCharToMultiByte.KERNEL32 ref: 0000000180020E7A
Part of subcall function 0000000180020E40: VirtualAlloc.KERNEL32 ref: 0000000180020E95
Part of subcall function 0000000180020E40: lstrlenW.KERNEL32 ref: 0000000180020EA6
Part of subcall function 0000000180020E40: memset.NTDLL ref: 0000000180020ECB
Part of subcall function 0000000180020E40: lstrlenA.KERNEL32 ref: 0000000180020ED3
Part of subcall function 0000000180020E40: VirtualFree.KERNEL32 ref: 0000000180020EE9

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: Virtual$Free$lstrlen$Alloc$ByteCharMultiWidememset
String ID:
API String ID: 2589853381-0
Opcode ID: 9e973a8c3555f4eb24f0b8ebfcc6161375dadd9c45ee45004ec477c379de15ec
Instruction ID: 8b0ca1c1598baae50a5236b37b16b711799dbf7ffdf11fe73bb17caf9d3a0f63
Opcode Fuzzy Hash: 9e973a8c3555f4eb24f0b8ebfcc6161375dadd9c45ee45004ec477c379de15ec
Instruction Fuzzy Hash: DD11C231300B0442EB998F72E9547A963A2FF8CFC4F18C024EE0A07B58DE39C5498701

Function 0000000180034840 Relevance: 5.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000180034878
LeaveCriticalSection.KERNEL32 ref: 000000018003488F
EnterCriticalSection.KERNEL32 ref: 00000001800348AA
LeaveCriticalSection.KERNEL32 ref: 00000001800348C7

Memory Dump Source

Source File: 00000003.00000002.2975242920.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.2975202666.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975398356.0000000180068000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975471007.000000018007C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2975529637.0000000180082000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7d424a39128fc79d423e685d07f3b0557c8311698411645ac54d4061eb6ffd6c
Instruction ID: 6009e2f0abf34f140cedfbc7206dbcc2494b56a364391128098d205548f6baf9
Opcode Fuzzy Hash: 7d424a39128fc79d423e685d07f3b0557c8311698411645ac54d4061eb6ffd6c
Instruction Fuzzy Hash: 0611AC32700B8486DB959F22AD5439E6321FB4DFC4F588121FE561BBA8CF38C5598300

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hvix64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Mail\ParphaCrashReport64.exe

C:\Program Files\Windows Mail\arphaDump64.dll

C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
hvix64.exe

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211
servicestringCOMMON

Function 00000001800080F2 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
memorynativeinjectionCOMMON

Function 0000000180009BC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109
memoryCOMMON

Function 0000000180005824 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Function 00000001800054D5 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
COMMON

Function 000000018000AD3E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
memoryCOMMON

Function 000000018000A9BE Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 0000000180008E30 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Function 0000000180005A0D Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Function 000000018000AF22 Relevance: 1.5, APIs: 1, Instructions: 31
injectionCOMMON

Function 000000018000A8B2 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Function 000000018000B100 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filesleepmemoryCOMMON

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre