Edit tour

Windows Analysis Report
R2-Signed.exe

Overview

General Information

Sample name:	R2-Signed.exe
Analysis ID:	1579841
MD5:	a7471e097d4d4e84fa44a025603499e1
SHA1:	231bbd89584d137fb2a418776549aa3774638d42
SHA256:	deede7611a657fab998d2e354f0168adf7a9ab89f34ab1fd7ccab8c9736597e9
Tags:	exeSilverFoxwinosuser-kafan_shengui
Infos:

Detection

ValleyRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected ValleyRAT

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Deletes itself after installation

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain checking for user administrative privileges

Modifies the context of a thread in another process (thread injection)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to create new users

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Tries to disable installed Antivirus / HIPS / PFW

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

R2-Signed.exe (PID: 2084 cmdline: "C:\Users\user\Desktop\R2-Signed.exe" MD5: A7471E097D4D4E84FA44A025603499E1)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3128 cmdline: C:\Windows\system32\svchost.exe -k netsvcs MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 7216 cmdline: C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

ParphaCrashReport64.exe (PID: 7256 cmdline: "C:\Program Files\Windows Mail\ParphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

svchost.exe (PID: 7296 cmdline: C:\Windows\system32\svchost.exe -k netsvcs MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 7336 cmdline: C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: svchost.exe PID: 1044	JoeSecurity_ValleyRAT	Yara detected ValleyRAT	Joe Security

Sigma Signatures

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\R2-Signed.exe", ParentImage: C:\Users\user\Desktop\R2-Signed.exe, ParentProcessId: 2084, ParentProcessName: R2-Signed.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, ProcessId: 1044, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\R2-Signed.exe", ParentImage: C:\Users\user\Desktop\R2-Signed.exe, ParentProcessId: 2084, ParentProcessName: R2-Signed.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule, ProcessId: 1044, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Windows Mail\arphaDump64.dll

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: R2-Signed.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.1% probability

Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.bin	Jump to behavior

Source: R2-Signed.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Build\PX\A\PoisonX\nvsphelperplugin64\x64\Release\arphaDump64.pdb source: R2-Signed.exe, R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1710463566.00007FFE11ED9000.00000002.00000001.01000000.00000009.sdmp, arphaDump64.dll.2.dr
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: R2-Signed.exe, R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1710266927.00007FF767A12000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe, 00000005.00000000.1696950381.00007FF767A12000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe.2.dr

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F6810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,	2_2_000001845C4F6810
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,	3_2_0000000180026810
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180026810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,	4_2_0000000180026810
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180026810 NetUserEnum,lstrlenW,NetApiBufferFree,malloc,VirtualFree,VirtualFree,free,VirtualFree,VirtualFree,	5_2_0000000180026810

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EDDD0 malloc,memset,FindFirstFileW,free,	2_2_000001845C4EDDD0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EC850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4EC850
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EE210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	2_2_000001845C4EE210
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4ECCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4ECCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	3_2_000000018001E210
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	3_2_000000018001DDD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	4_2_000000018001E210
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001C850
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001CCF0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	4_2_000000018001DDD0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF767A08F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF767A08F78
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FFE11ED05EC FindFirstFileExW,	5_2_00007FFE11ED05EC
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	5_2_000000018001E210
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_000000018001C850
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_000000018001CCF0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	5_2_000000018001DDD0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FCD30 GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,lstrcpyW,lstrcatW,

2_2_000001845C4FCD30

Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40
Source: unknown	TCP traffic detected without corresponding DNS query: 18.139.89.40

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C503E20 memset,CreateEventW,WSARecv,WSAGetLastError,WaitForMultipleObjects,WSAGetOverlappedResult,WSAGetLastError,CloseHandle,

2_2_000001845C503E20

Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ejemplo.com
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=afCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en-GBCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419&category=theme81https://myactivity.google.com/myactivit
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419Ctrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=esCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=etCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fiCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=filCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=frCtrl$1
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ejemplo.com.Se
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.com
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comContrase
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comGestoorde
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comMga
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comMots
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSaved
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSe
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comSelle
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://passwords.google.comT
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://policies.google.com/
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/a/?p=browser_profile_details
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/96817
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&AideG
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlA&yudaAdministrado
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlBestuur
Source: R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlO&hjeOrganisaatiosi
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4E97D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_000001845C4E97D0

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E97D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	2_2_000001845C4E97D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E99F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	2_2_000001845C4E99F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F6200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	2_2_000001845C4F6200
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FF1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	2_2_000001845C4FF1B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	3_2_000000018002F1B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	3_2_0000000180026200
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800197D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	3_2_00000001800197D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800199F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	3_2_00000001800199F0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	4_2_000000018002F1B0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180026200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	4_2_0000000180026200
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800197D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	4_2_00000001800197D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800199F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	4_2_00000001800199F0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018002F1B0 OpenClipboard,Sleep,GetLastError,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	5_2_000000018002F1B0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180026200 VirtualFree,VirtualFree,OpenClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	5_2_0000000180026200
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00000001800197D0 EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,lstrlenW,memcmp,lstrlenW,lstrlenW,lstrlenW,memcpy,OpenClipboard,CloseClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	5_2_00000001800197D0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00000001800199F0 lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,lstrlenW,WideCharToMultiByte,VirtualAlloc,lstrlenW,WideCharToMultiByte,WideCharToMultiByte,lstrlenA,memcpy,OpenClipboard,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrlenA,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,VirtualFree,VirtualFree,	5_2_00000001800199F0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EAC60 DefWindowProcW,SendMessageW,OpenClipboard,GetClipboardData,GlobalLock,lstrlenW,lstrlenW,lstrlenW,GlobalUnlock,CloseClipboard,VirtualFree,VirtualFree,CloseClipboard,SendMessageW,PostQuitMessage,

2_2_000001845C4EAC60

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EA410 GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,

2_2_000001845C4EA410

Source: R2-Signed.exe, 00000000.00000002.1690413969.000001273A024000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_0d366a68-4

Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180005824 realloc,NtQuerySystemInformation,	0_2_0000000180005824
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800080F2 VirtualAllocEx,WriteProcessMemory,memset,memcpy,NtAlpcConnectPort,	0_2_00000001800080F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E2830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	2_2_000001845C4E2830
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E1AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	2_2_000001845C4E1AE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E1C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	2_2_000001845C4E1C70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	3_2_0000000180011AE0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	3_2_0000000180011C70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	3_2_0000000180012830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180012830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	4_2_0000000180012830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180011AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	4_2_0000000180011AE0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180011C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	4_2_0000000180011C70
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018000B822 VirtualAllocEx,WriteProcessMemory,memset,memcpy,NtAlpcConnectPort,	5_2_000000018000B822
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180008F54 realloc,NtQuerySystemInformation,	5_2_0000000180008F54
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180012830 NtQuerySystemInformation,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,VirtualProtect,VirtualProtect,	5_2_0000000180012830
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180011AE0 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	5_2_0000000180011AE0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180011C70 CreateEventW,VirtualAlloc,WaitForSingleObject,NtQuerySystemInformation,VirtualFree,VirtualAlloc,memset,NtQuerySystemInformation,lstrcmpiW,WaitForSingleObject,CloseHandle,	5_2_0000000180011C70

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F05A0: CreateFileW,memset,lstrlenA,DeviceIoControl,CloseHandle,

2_2_000001845C4F05A0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4E5FB0 GetCurrentProcessId,TerminateThread,TerminateProcess,lstrcmpiW,Sleep,ExitThread,memset,lstrcatW,lstrcatW,memset,GetSystemDirectoryW,GetLastError,lstrcatW,lstrcatW,lstrcatW,OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,memset,wsprintfW,memset,wsprintfW,memset,wsprintfW,memset,wsprintfW,memset,wsprintfW,SetFileAttributesW,DeleteFileW,SetFileAttributesW,DeleteFileW,SetFileAttributesW,DeleteFileW,SetFileAttributesW,DeleteFileW,SetFileAttributesW,DeleteFileW,SysAllocString,Sleep,GetCurrentProcess,TerminateProcess,

2_2_000001845C4E5FB0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EFF40 WTSQueryUserToken,GetLastError,DuplicateTokenEx,ConvertStringSidToSidW,GetLengthSid,SetTokenInformation,CreateEnvironmentBlock,CreateProcessAsUserW,CreateProcessAsUserW,GetLastError,CloseHandle,CloseHandle,DestroyEnvironmentBlock,CloseHandle,CloseHandle,

2_2_000001845C4EFF40

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Jump to behavior

Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800080F2	0_2_00000001800080F2
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180009BC0	0_2_0000000180009BC0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800054D5	0_2_00000001800054D5
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800015B0	0_2_00000001800015B0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180001010	0_2_0000000180001010
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003833	0_2_0000000180003833
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180028038	0_2_0000000180028038
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180014848	0_2_0000000180014848
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000284D	0_2_000000018000284D
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018002C080	0_2_000000018002C080
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003880	0_2_0000000180003880
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800180EE	0_2_00000001800180EE
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000290C	0_2_000000018000290C
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180004153	0_2_0000000180004153
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002170	0_2_0000000180002170
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000B1AC	0_2_000000018000B1AC
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800069E0	0_2_00000001800069E0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800151E8	0_2_00000001800151E8
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002A06	0_2_0000000180002A06
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180001A10	0_2_0000000180001A10
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002A19	0_2_0000000180002A19
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003220	0_2_0000000180003220
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000225E	0_2_000000018000225E
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018001AA6C	0_2_000000018001AA6C
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000B280	0_2_000000018000B280
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180006AB0	0_2_0000000180006AB0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000C2D0	0_2_000000018000C2D0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003AE0	0_2_0000000180003AE0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003220	0_2_0000000180003220
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000435B	0_2_000000018000435B
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000C370	0_2_000000018000C370
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180023B98	0_2_0000000180023B98
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800033B8	0_2_00000001800033B8
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018001FC0C	0_2_000000018001FC0C
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180028464	0_2_0000000180028464
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003464	0_2_0000000180003464
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000947B	0_2_000000018000947B
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002C8A	0_2_0000000180002C8A
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180004CB0	0_2_0000000180004CB0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800044C1	0_2_00000001800044C1
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003CF2	0_2_0000000180003CF2
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002526	0_2_0000000180002526
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003530	0_2_0000000180003530
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180007550	0_2_0000000180007550
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180001D60	0_2_0000000180001D60
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180016D88	0_2_0000000180016D88
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800045A9	0_2_00000001800045A9
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003DBC	0_2_0000000180003DBC
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000360B	0_2_000000018000360B
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000B620	0_2_000000018000B620
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002E24	0_2_0000000180002E24
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180005E58	0_2_0000000180005E58
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002666	0_2_0000000180002666
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180029E8C	0_2_0000000180029E8C
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000469C	0_2_000000018000469C
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180024EB0	0_2_0000000180024EB0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000BEB0	0_2_000000018000BEB0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000B6C0	0_2_000000018000B6C0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180008EC0	0_2_0000000180008EC0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018001FED8	0_2_000000018001FED8
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_00000001800096E0	0_2_00000001800096E0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000DEE8	0_2_000000018000DEE8
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_000000018000C6F0	0_2_000000018000C6F0
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180003717	0_2_0000000180003717
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180010F18	0_2_0000000180010F18
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180021F44	0_2_0000000180021F44
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180006F70	0_2_0000000180006F70
Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: 0_2_0000000180002777	0_2_0000000180002777
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001010	2_2_0000000180001010
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001A10	2_2_0000000180001A10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180001D60	2_2_0000000180001D60
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003833	2_2_0000000180003833
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180028038	2_2_0000000180028038
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180014848	2_2_0000000180014848
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000284D	2_2_000000018000284D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018002C080	2_2_000000018002C080
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003880	2_2_0000000180003880
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800180EE	2_2_00000001800180EE
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800080F2	2_2_00000001800080F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000290C	2_2_000000018000290C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180004153	2_2_0000000180004153
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002170	2_2_0000000180002170
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B1AC	2_2_000000018000B1AC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800069E0	2_2_00000001800069E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800151E8	2_2_00000001800151E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002A06	2_2_0000000180002A06
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002A19	2_2_0000000180002A19
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003220	2_2_0000000180003220
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000225E	2_2_000000018000225E
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001AA6C	2_2_000000018001AA6C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B280	2_2_000000018000B280
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180006AB0	2_2_0000000180006AB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C2D0	2_2_000000018000C2D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003AE0	2_2_0000000180003AE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003220	2_2_0000000180003220
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000435B	2_2_000000018000435B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C370	2_2_000000018000C370
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180023B98	2_2_0000000180023B98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800033B8	2_2_00000001800033B8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180009BC0	2_2_0000000180009BC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001FC0C	2_2_000000018001FC0C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180028464	2_2_0000000180028464
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003464	2_2_0000000180003464
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000947B	2_2_000000018000947B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002C8A	2_2_0000000180002C8A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180004CB0	2_2_0000000180004CB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800044C1	2_2_00000001800044C1
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800054D5	2_2_00000001800054D5
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003CF2	2_2_0000000180003CF2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002526	2_2_0000000180002526
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003530	2_2_0000000180003530
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180007550	2_2_0000000180007550
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180016D88	2_2_0000000180016D88
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800045A9	2_2_00000001800045A9
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800015B0	2_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003DBC	2_2_0000000180003DBC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000360B	2_2_000000018000360B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B620	2_2_000000018000B620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002E24	2_2_0000000180002E24
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180005E58	2_2_0000000180005E58
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002666	2_2_0000000180002666
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180029E8C	2_2_0000000180029E8C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000469C	2_2_000000018000469C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180024EB0	2_2_0000000180024EB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000BEB0	2_2_000000018000BEB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000B6C0	2_2_000000018000B6C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180008EC0	2_2_0000000180008EC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018001FED8	2_2_000000018001FED8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001800096E0	2_2_00000001800096E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000DEE8	2_2_000000018000DEE8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000000018000C6F0	2_2_000000018000C6F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180003717	2_2_0000000180003717
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180010F18	2_2_0000000180010F18
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180021F44	2_2_0000000180021F44
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180006F70	2_2_0000000180006F70
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_0000000180002777	2_2_0000000180002777
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF374F2	2_2_000001845BF374F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF474EE	2_2_000001845BF474EE
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF5B480	2_2_000001845BF5B480
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32C80	2_2_000001845BF32C80
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF43C48	2_2_000001845BF43C48
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31C4D	2_2_000001845BF31C4D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF57438	2_2_000001845BF57438
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32C33	2_2_000001845BF32C33
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF30410	2_2_000001845BF30410
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31B77	2_2_000001845BF31B77
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF36370	2_2_000001845BF36370
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF51344	2_2_000001845BF51344
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32B17	2_2_000001845BF32B17
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF40318	2_2_000001845BF40318
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3D2E8	2_2_000001845BF3D2E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3BAF0	2_2_000001845BF3BAF0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF4F2D8	2_2_000001845BF4F2D8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF38AE0	2_2_000001845BF38AE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF382C0	2_2_000001845BF382C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3AAC0	2_2_000001845BF3AAC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF542B0	2_2_000001845BF542B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B2B0	2_2_000001845BF3B2B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF33A9C	2_2_000001845BF33A9C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF5928C	2_2_000001845BF5928C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31A66	2_2_000001845BF31A66
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35258	2_2_000001845BF35258
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32224	2_2_000001845BF32224
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3AA20	2_2_000001845BF3AA20
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32A0B	2_2_000001845BF32A0B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF331BC	2_2_000001845BF331BC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF339A9	2_2_000001845BF339A9
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF309B0	2_2_000001845BF309B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF46188	2_2_000001845BF46188
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31160	2_2_000001845BF31160
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF36950	2_2_000001845BF36950
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31926	2_2_000001845BF31926
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32930	2_2_000001845BF32930
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF330F2	2_2_000001845BF330F2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF348D5	2_2_000001845BF348D5
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF338C1	2_2_000001845BF338C1
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF340B0	2_2_000001845BF340B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3208A	2_2_000001845BF3208A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3887B	2_2_000001845BF3887B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32864	2_2_000001845BF32864
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF57864	2_2_000001845BF57864
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF4F00C	2_2_000001845BF4F00C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF327B8	2_2_000001845BF327B8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF38FC0	2_2_000001845BF38FC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF52F98	2_2_000001845BF52F98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B770	2_2_000001845BF3B770
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3375B	2_2_000001845BF3375B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32620	2_2_000001845BF32620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32EE0	2_2_000001845BF32EE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3B6D0	2_2_000001845BF3B6D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35EB0	2_2_000001845BF35EB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3A680	2_2_000001845BF3A680
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF49E6C	2_2_000001845BF49E6C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3165E	2_2_000001845BF3165E
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31E19	2_2_000001845BF31E19
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF32620	2_2_000001845BF32620
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31E06	2_2_000001845BF31E06
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF30E10	2_2_000001845BF30E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF445E8	2_2_000001845BF445E8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF35DE0	2_2_000001845BF35DE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF3A5AC	2_2_000001845BF3A5AC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31570	2_2_000001845BF31570
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF33553	2_2_000001845BF33553
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845BF31D0C	2_2_000001845BF31D0C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F0680	2_2_000001845C4F0680
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E2140	2_2_000001845C4E2140
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EF9E0	2_2_000001845C4EF9E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DED50	2_2_000001845C4DED50
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EE550	2_2_000001845C4EE550
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6D44	2_2_000001845C4D6D44
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D656A	2_2_000001845C4D656A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D1D80	2_2_000001845C4D1D80
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F6530	2_2_000001845C4F6530
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FAD30	2_2_000001845C4FAD30
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C508D24	2_2_000001845C508D24
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D75D2	2_2_000001845C4D75D2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DF5E0	2_2_000001845C4DF5E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DC5F0	2_2_000001845C4DC5F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DEDF0	2_2_000001845C4DEDF0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F4D90	2_2_000001845C4F4D90
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F5590	2_2_000001845C4F5590
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D9588	2_2_000001845C4D9588
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D2D8A	2_2_000001845C4D2D8A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7DA1	2_2_000001845C4D7DA1
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E8DA0	2_2_000001845C4E8DA0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EB5A0	2_2_000001845C4EB5A0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FBDC0	2_2_000001845C4FBDC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C502660	2_2_000001845C502660
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C526670	2_2_000001845C526670
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6E10	2_2_000001845C4D6E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DCE10	2_2_000001845C4DCE10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E3E10	2_2_000001845C4E3E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F9E10	2_2_000001845C4F9E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D5E06	2_2_000001845C4D5E06
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DFE20	2_2_000001845C4DFE20
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D1630	2_2_000001845C4D1630
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E6630	2_2_000001845C4E6630
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EAE40	2_2_000001845C4EAE40
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D3EC7	2_2_000001845C4D3EC7
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E76E0	2_2_000001845C4E76E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6EEB	2_2_000001845C4D6EEB
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F4700	2_2_000001845C4F4700
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7E89	2_2_000001845C4D7E89
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DA6A0	2_2_000001845C4DA6A0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D769C	2_2_000001845C4D769C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C529E90	2_2_000001845C529E90
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E9EC0	2_2_000001845C4E9EC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C503760	2_2_000001845C503760
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D5F46	2_2_000001845C4D5F46
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E6F60	2_2_000001845C4E6F60
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D176F	2_2_000001845C4D176F
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E8780	2_2_000001845C4E8780
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F1F80	2_2_000001845C4F1F80
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7F7C	2_2_000001845C4D7F7C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EF710	2_2_000001845C4EF710
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6704	2_2_000001845C4D6704
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D271A	2_2_000001845C4D271A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FA7F0	2_2_000001845C4FA7F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6FF7	2_2_000001845C4D6FF7
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D1F88	2_2_000001845C4D1F88
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C504FA0	2_2_000001845C504FA0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E7FA0	2_2_000001845C4E7FA0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E5FB0	2_2_000001845C4E5FB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EEFC0	2_2_000001845C4EEFC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F4FC0	2_2_000001845C4F4FC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F57C0	2_2_000001845C4F57C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D4FB5	2_2_000001845C4D4FB5
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EC850	2_2_000001845C4EC850
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6057	2_2_000001845C4D6057
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D1070	2_2_000001845C4D1070
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F7870	2_2_000001845C4F7870
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F8880	2_2_000001845C4F8880
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DB822	2_2_000001845C4DB822
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FE010	2_2_000001845C4FE010
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C500810	2_2_000001845C500810
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E38D0	2_2_000001845C4E38D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D20C7	2_2_000001845C4D20C7
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DE8DC	2_2_000001845C4DE8DC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FF890	2_2_000001845C4FF890
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C50A8BC	2_2_000001845C50A8BC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E5150	2_2_000001845C4E5150
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7160	2_2_000001845C4D7160
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D2971	2_2_000001845C4D2971
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E1180	2_2_000001845C4E1180
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D517C	2_2_000001845C4D517C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D517A	2_2_000001845C4D517A
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DA110	2_2_000001845C4DA110
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7113	2_2_000001845C4D7113
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F4930	2_2_000001845C4F4930
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D612D	2_2_000001845C4D612D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C514140	2_2_000001845C514140
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DA1E0	2_2_000001845C4DA1E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E99F0	2_2_000001845C4E99F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D61EC	2_2_000001845C4D61EC
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DFA00	2_2_000001845C4DFA00
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E9190	2_2_000001845C4E9190
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EA190	2_2_000001845C4EA190
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D219F	2_2_000001845C4D219F
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DE9B0	2_2_000001845C4DE9B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D5A50	2_2_000001845C4D5A50
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D1264	2_2_000001845C4D1264
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D227C	2_2_000001845C4D227C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C501270	2_2_000001845C501270
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F1A10	2_2_000001845C4F1A10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F5A10	2_2_000001845C4F5A10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7A33	2_2_000001845C4D7A33
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E8230	2_2_000001845C4E8230
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D3A32	2_2_000001845C4D3A32
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FAA30	2_2_000001845C4FAA30
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EEA40	2_2_000001845C4EEA40
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EAAD0	2_2_000001845C4EAAD0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FB2D0	2_2_000001845C4FB2D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DD2F0	2_2_000001845C4DD2F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D62E6	2_2_000001845C4D62E6
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D3300	2_2_000001845C4D3300
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6B00	2_2_000001845C4D6B00
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F9300	2_2_000001845C4F9300
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D62F9	2_2_000001845C4D62F9
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F7290	2_2_000001845C4F7290
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DFAA0	2_2_000001845C4DFAA0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D4A98	2_2_000001845C4D4A98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E2B50	2_2_000001845C4E2B50
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F4B60	2_2_000001845C4F4B60
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F5340	2_2_000001845C4F5340
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D5B3E	2_2_000001845C4D5B3E
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E73D0	2_2_000001845C4E73D0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D83E0	2_2_000001845C4D83E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D2BD6	2_2_000001845C4D2BD6
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D13F7	2_2_000001845C4D13F7
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DCBAB	2_2_000001845C4DCBAB
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D73C0	2_2_000001845C4D73C0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F3BC0	2_2_000001845C4F3BC0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC54	2_2_000001845C4FFC54
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC5D	2_2_000001845C4FFC5D
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC4B	2_2_000001845C4FFC4B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D3470	2_2_000001845C4D3470
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F3464	2_2_000001845C4F3464
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4DAC80	2_2_000001845C4DAC80
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E4410	2_2_000001845C4E4410
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D8C05	2_2_000001845C4D8C05
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C500C20	2_2_000001845C500C20
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6B00	2_2_000001845C4D6B00
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4ED420	2_2_000001845C4ED420
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC39	2_2_000001845C4FFC39
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC42	2_2_000001845C4FFC42
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC27	2_2_000001845C4FFC27
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D7C3B	2_2_000001845C4D7C3B
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FFC30	2_2_000001845C4FFC30
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D2CD2	2_2_000001845C4D2CD2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D54E0	2_2_000001845C4D54E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F24E0	2_2_000001845C4F24E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4ECCF0	2_2_000001845C4ECCF0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C5034F0	2_2_000001845C5034F0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F5C90	2_2_000001845C4F5C90
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D6C98	2_2_000001845C4D6C98
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4E9CB0	2_2_000001845C4E9CB0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F44B0	2_2_000001845C4F44B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4D3CA6	2_2_000001845C4D3CA6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012140	3_2_0000000180012140
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180015150	3_2_0000000180015150
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800224E0	3_2_00000001800224E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020680	3_2_0000000180020680
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800176E0	3_2_00000001800176E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F9E0	3_2_000000018001F9E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001AAD0	3_2_000000018001AAD0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180013E10	3_2_0000000180013E10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006FF7	3_2_0000000180006FF7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002E010	3_2_000000018002E010
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006057	3_2_0000000180006057
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001070	3_2_0000000180001070
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800020C7	3_2_00000001800020C7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A110	3_2_000000018000A110
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007113	3_2_0000000180007113
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000612D	3_2_000000018000612D
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180044140	3_2_0000000180044140
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007160	3_2_0000000180007160
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000517A	3_2_000000018000517A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000517C	3_2_000000018000517C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180011180	3_2_0000000180011180
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001A190	3_2_000000018001A190
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180019190	3_2_0000000180019190
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000219F	3_2_000000018000219F
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A1E0	3_2_000000018000A1E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800061EC	3_2_00000001800061EC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180018230	3_2_0000000180018230
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001264	3_2_0000000180001264
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180031270	3_2_0000000180031270
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000227C	3_2_000000018000227C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027290	3_2_0000000180027290
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002B2D0	3_2_000000018002B2D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800642E0	3_2_00000001800642E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800062E6	3_2_00000001800062E6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000D2F0	3_2_000000018000D2F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800062F9	3_2_00000001800062F9
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029300	3_2_0000000180029300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003300	3_2_0000000180003300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180062327	3_2_0000000180062327
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025340	3_2_0000000180025340
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018005B380	3_2_000000018005B380
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800073C0	3_2_00000001800073C0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800173D0	3_2_00000001800173D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800083E0	3_2_00000001800083E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800013F7	3_2_00000001800013F7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018004C410	3_2_000000018004C410
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180014410	3_2_0000000180014410
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001D420	3_2_000000018001D420
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180023464	3_2_0000000180023464
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003470	3_2_0000000180003470
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800244B0	3_2_00000001800244B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800054E0	3_2_00000001800054E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800334F0	3_2_00000001800334F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180026530	3_2_0000000180026530
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E550	3_2_000000018001E550
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000656A	3_2_000000018000656A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180009588	3_2_0000000180009588
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025590	3_2_0000000180025590
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001B5A0	3_2_000000018001B5A0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800075D2	3_2_00000001800075D2
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000F5E0	3_2_000000018000F5E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000C5F0	3_2_000000018000C5F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180016630	3_2_0000000180016630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001630	3_2_0000000180001630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018003664B	3_2_000000018003664B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180032660	3_2_0000000180032660
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180056670	3_2_0000000180056670
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000769C	3_2_000000018000769C
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000A6A0	3_2_000000018000A6A0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800486E0	3_2_00000001800486E0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024700	3_2_0000000180024700
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006704	3_2_0000000180006704
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F710	3_2_000000018001F710
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000271A	3_2_000000018000271A
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180033760	3_2_0000000180033760
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180063770	3_2_0000000180063770
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000176F	3_2_000000018000176F
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180018780	3_2_0000000180018780
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180052790	3_2_0000000180052790
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800367B8	3_2_00000001800367B8
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800257C0	3_2_00000001800257C0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002A7F0	3_2_000000018002A7F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180030810	3_2_0000000180030810
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000B822	3_2_000000018000B822
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027870	3_2_0000000180027870
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180028880	3_2_0000000180028880
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002F890	3_2_000000018002F890
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018003A8BC	3_2_000000018003A8BC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800138D0	3_2_00000001800138D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000E8DC	3_2_000000018000E8DC
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024930	3_2_0000000180024930
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002971	3_2_0000000180002971
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000E9B0	3_2_000000018000E9B0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800199F0	3_2_00000001800199F0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180053A00	3_2_0000000180053A00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000FA00	3_2_000000018000FA00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180021A10	3_2_0000000180021A10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025A10	3_2_0000000180025A10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002AA30	3_2_000000018002AA30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003A32	3_2_0000000180003A32
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007A33	3_2_0000000180007A33
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001EA40	3_2_000000018001EA40
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005A50	3_2_0000000180005A50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180004A98	3_2_0000000180004A98
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000FAA0	3_2_000000018000FAA0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180035AD0	3_2_0000000180035AD0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006B00	3_2_0000000180006B00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180005B3E	3_2_0000000180005B3E
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180012B50	3_2_0000000180012B50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180024B60	3_2_0000000180024B60
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000CBAB	3_2_000000018000CBAB
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180023BC0	3_2_0000000180023BC0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002BD6	3_2_0000000180002BD6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180008C05	3_2_0000000180008C05
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180030C20	3_2_0000000180030C20
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006B00	3_2_0000000180006B00
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC27	3_2_000000018002FC27
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC30	3_2_000000018002FC30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC39	3_2_000000018002FC39
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180007C3B	3_2_0000000180007C3B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC42	3_2_000000018002FC42
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC4B	3_2_000000018002FC4B
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC54	3_2_000000018002FC54
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180065C60	3_2_0000000180065C60
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002FC5D	3_2_000000018002FC5D
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000AC80	3_2_000000018000AC80
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180035C90	3_2_0000000180035C90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180025C90	3_2_0000000180025C90
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006C98	3_2_0000000180006C98
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180036C9E	3_2_0000000180036C9E
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180061CA7	3_2_0000000180061CA7
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180003CA6	3_2_0000000180003CA6
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180019CB0	3_2_0000000180019CB0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180002CD2	3_2_0000000180002CD2
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180038D24	3_2_0000000180038D24
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002AD30	3_2_000000018002AD30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180006D44	3_2_0000000180006D44
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018000ED50	3_2_000000018000ED50
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180062D70	3_2_0000000180062D70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180001D80	3_2_0000000180001D80

Source: Joe Sandbox View	Dropped File: C:\Program Files\Windows Mail\ParphaCrashReport64.exe E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
Source: Joe Sandbox View	Dropped File: C:\Program Files\Windows Mail\arphaDump64.dll ACC214BCA1EE6212144EC1F45F247389FD81C462C8D4C4D85B323198F911759A

Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000000180044F40 appears 61 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000000180041800 appears 91 times
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: String function: 0000000180044F40 appears 61 times
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: String function: 0000000180041800 appears 91 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 0000000180044F40 appears 61 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 0000000180041800 appears 91 times

Source: R2-Signed.exe

Static PE information: invalid certificate

Source: R2-Signed.exe	Binary or memory string: OriginalFilename vs R2-Signed.exe
Source: R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearphaCrashReport.exe2 vs R2-Signed.exe
Source: R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearphaCrashReport.exe2 vs R2-Signed.exe

Source: R2-Signed.exe

Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317

Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AEF4C000.00000008.00000001.01000000.00000003.sdmp

Binary or memory string: ndre-land.nonet.slnet.soin-brb.de123website.lutrentino-stirol.it

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/4@0/1

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F0680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	2_2_000001845C4F0680
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EFD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	2_2_000001845C4EFD10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FCE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	2_2_000001845C4FCE70
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F7870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4F7870
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F9A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	2_2_000001845C4F9A70
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F9300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4F9300
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F7290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4F7290
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F0480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	2_2_000001845C4F0480
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	3_2_0000000180020680
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180027290
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180029300
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180020480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	3_2_0000000180020480
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180027870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_0000000180027870
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	3_2_0000000180029A70
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001FD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	3_2_000000018001FD10
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002CE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	3_2_000000018002CE70
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180027290
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180029300
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180020480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	4_2_0000000180020480
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180020680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	4_2_0000000180020680
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180027870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_0000000180027870
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	4_2_0000000180029A70
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001FD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	4_2_000000018001FD10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002CE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	4_2_000000018002CE70
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180020480 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,GetLastError,memcpy,	5_2_0000000180020480
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180020680 VirtualAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualAlloc,InitializeCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,	5_2_0000000180020680
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180027290 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedTcpTable,VirtualAlloc,GetExtendedTcpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_0000000180027290
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180029300 __chkstk,memset,memset,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,memset,lstrcpyW,GetPriorityClass,memset,memset,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidW,LookupAccountSidW,lstrcpyW,GlobalFree,CloseHandle,ProcessIdToSessionId,K32GetProcessMemoryInfo,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,CreateFileW,GetFileSize,CloseHandle,lstrcpyW,lstrcatW,CloseHandle,Process32NextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_0000000180029300
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180027870 memset,lstrlenW,lstrlenW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetExtendedUdpTable,VirtualAlloc,GetExtendedUdpTable,VirtualFree,memset,lstrlenW,memset,inet_ntoa,lstrcpyA,lstrlenA,htons,lstrlenA,memset,lstrlenW,VirtualFree,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_0000000180027870
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180029A70 memset,memset,VirtualFree,VirtualFree,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,TerminateProcess,Sleep,DeleteFileW,lstrcpyW,lstrcatW,TerminateProcess,CloseHandle,Sleep,	5_2_0000000180029A70
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001FD10 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,OpenProcess,GetLastError,	5_2_000000018001FD10
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018002CE70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,memset,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameW,lstrcpyW,CloseHandle,	5_2_000000018002CE70

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EC4E0 memset,memset,memset,QueryDosDeviceW,GetDriveTypeW,lstrlenW,GetVolumeInformationW,lstrlenW,GetDiskFreeSpaceExW,

2_2_000001845C4EC4E0

Source: C:\Windows\System32\svchost.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,	2_2_000001845C4F63C0
Source: C:\Windows\System32\svchost.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,	3_2_00000001800263C0
Source: C:\Windows\System32\dllhost.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,	4_2_00000001800263C0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: memset,lstrcatW,memset,GetWindowsDirectoryW,GetLastError,lstrcatW,OpenSCManagerW,GetLastError,CreateServiceW,GetLastError,CloseServiceHandle,GetLastError,StartServiceW,CloseServiceHandle,CloseServiceHandle,	5_2_00000001800263C0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FC950 memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_000001845C4FC950

Source: C:\Users\user\Desktop\R2-Signed.exe

Code function: 0_2_0000000180001A10 CoInitialize,CLSIDFromString,IIDFromString,CoCreateInstance,

0_2_0000000180001A10

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Code function: 5_2_00007FF7679F4000 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00007FF7679F4000

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4E2140 WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess,

2_2_000001845C4E2140

Source: C:\Windows\System32\svchost.exe

File created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Jump to behavior

Source: R2-Signed.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\R2-Signed.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\R2-Signed.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R2-Signed.exe

ReversingLabs: Detection: 15%

Source: svchost.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}
Source: svchost.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: svchost.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: svchost.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}
Source: dllhost.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: dllhost.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}
Source: ParphaCrashReport64.exe	String found in binary or memory: /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: ParphaCrashReport64.exe	String found in binary or memory: \\.\{F8284233-48F4-4680-ADDD-F8284233}

Source: unknown	Process created: C:\Users\user\Desktop\R2-Signed.exe "C:\Users\user\Desktop\R2-Signed.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior

Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Directory created: C:\Program Files\Windows Mail\arphaDump64.bin	Jump to behavior

Source: R2-Signed.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: R2-Signed.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: R2-Signed.exe

Static file information: File size 23289008 > 1048576

Source: R2-Signed.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x9bec00
Source: R2-Signed.exe	Static PE information: Raw size of .vmp2 is bigger than: 0x100000 < 0xbf0400

Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: R2-Signed.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: R2-Signed.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: R2-Signed.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Build\PX\A\PoisonX\nvsphelperplugin64\x64\Release\arphaDump64.pdb source: R2-Signed.exe, R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1710463566.00007FFE11ED9000.00000002.00000001.01000000.00000009.sdmp, arphaDump64.dll.2.dr
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: R2-Signed.exe, R2-Signed.exe, 00000000.00000002.1690216804.0000012739F00000.00000004.00001000.00020000.00000000.sdmp, R2-Signed.exe, 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000002.1710266927.00007FF767A12000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe, 00000005.00000000.1696950381.00007FF767A12000.00000002.00000001.01000000.00000008.sdmp, ParphaCrashReport64.exe.2.dr

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F4080 VirtualAlloc,LoadLibraryW,GetProcAddress,FreeLibrary,

2_2_000001845C4F4080

Source: R2-Signed.exe	Static PE information: section name: .vmp2
Source: R2-Signed.exe	Static PE information: section name: .qtmetad
Source: R2-Signed.exe	Static PE information: section name: .qtmimed
Source: R2-Signed.exe	Static PE information: section name: _RDATA

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EC3E0 push rcx; ret	2_2_000001845C4EC3E1
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C3E0 push rcx; ret	3_2_000000018001C3E1
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_00000001800619F7 push FF491775h; ret	3_2_00000001800619FC
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C3E0 push rcx; ret	4_2_000000018001C3E1
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_00000001800619F7 push FF491775h; ret	4_2_00000001800619FC
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001C3E0 push rcx; ret	5_2_000000018001C3E1
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00000001800619F7 push FF491775h; ret	5_2_00000001800619FC

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F30FE VirtualFree,VirtualFree,malloc,malloc,VirtualFree,VirtualFree,NetUserAdd,Sleep,NetLocalGroupAddMembers,free,free,

2_2_000001845C4F30FE

Source: C:\Windows\System32\svchost.exe	File created: C:\Program Files\Windows Mail\arphaDump64.dll			Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe			Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FD060 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_000001845C4FD060

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\svchost.exe

File deleted: c:\users\user\desktop\r2-signed.exe

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EBFC0 OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,OpenEventLogW,ClearEventLogW,CloseEventLog,

2_2_000001845C4EBFC0

Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain checking for user administrative privileges

Source: C:\Windows\System32\dllhost.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode
Source: C:\Users\user\Desktop\R2-Signed.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode	graph_0-13630
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode
Source: C:\Windows\System32\svchost.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode	graph_2-41454

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4E6F60 GetCurrentProcessId,ProcessIdToSessionId,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,CloseHandle,WTSGetActiveConsoleSessionId,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,CreateThread,VirtualFree,VirtualFree,VirtualFree,VirtualFree,

2_2_000001845C4E6F60

Source: C:\Users\user\Desktop\R2-Signed.exe	Code function: malloc,memcpy,malloc,memset,memcpy,memset,GetModuleFileNameW,malloc,memset,memcpy,OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	0_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: malloc,memcpy,malloc,memset,memcpy,memset,GetModuleFileNameW,malloc,memset,memcpy,OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	2_2_00000001800015B0
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	2_2_000001845C4FD140
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4FF890
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	3_2_000000018002D140
Source: C:\Windows\System32\svchost.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018002F890
Source: C:\Windows\System32\dllhost.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	4_2_000000018002D140
Source: C:\Windows\System32\dllhost.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018002F890
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: OpenSCManagerW,EnumServicesStatusExW,malloc,memset,EnumServicesStatusExW,CloseServiceHandle,free,CloseServiceHandle,lstrcmpiW,free,	5_2_000000018002D140
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: OpenSCManagerW,EnumServicesStatusW,LocalAlloc,EnumServicesStatusW,memset,OpenServiceW,lstrlenW,memcpy,lstrlenW,memcpy,VirtualAlloc,QueryServiceConfig2W,lstrlenW,memcpy,lstrcpyW,VirtualAlloc,QueryServiceConfigW,lstrcpyW,lstrlenW,memcpy,lstrlenW,memcpy,lstrlenW,memcpy,CloseServiceHandle,VirtualFree,VirtualFree,CloseServiceHandle,LocalFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_000000018002F890

Source: C:\Windows\System32\svchost.exe	API coverage: 4.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.5 %
Source: C:\Windows\System32\dllhost.exe	API coverage: 3.2 %
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	API coverage: 3.3 %

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EDDD0 malloc,memset,FindFirstFileW,free,	2_2_000001845C4EDDD0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EC850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4EC850
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EE210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	2_2_000001845C4EE210
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4ECCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	2_2_000001845C4ECCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	3_2_000000018001E210
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001C850
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	3_2_000000018001CCF0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	3_2_000000018001DDD0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	4_2_000000018001E210
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001C850
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	4_2_000000018001CCF0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	4_2_000000018001DDD0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF767A08F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF767A08F78
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FFE11ED05EC FindFirstFileExW,	5_2_00007FFE11ED05EC
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001E210 __chkstk,memset,memset,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,memset,lstrcatW,lstrcatW,lstrcatW,Sleep,lstrlenW,wcsstr,GetCurrentThread,IsBadReadPtr,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,LeaveCriticalSection,WaitForSingleObject,VirtualFree,VirtualFree,	5_2_000000018001E210
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001C850 memset,lstrcatW,lstrcatW,memset,FindFirstFileW,FindNextFileW,FindNextFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_000000018001C850
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001CCF0 memset,memset,memset,memset,CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,ProcessIdToSessionId,memset,memset,wsprintfW,wsprintfW,FindFirstFileW,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,memset,memset,wsprintfW,FindFirstFileW,FindNextFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,memset,memset,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,lstrlenW,FindClose,VirtualFree,VirtualFree,VirtualFree,VirtualFree,	5_2_000000018001CCF0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001DDD0 malloc,memset,FindFirstFileW,free,	5_2_000000018001DDD0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FCD30 GetLogicalDriveStringsW,QueryDosDeviceW,lstrlenW,wcsncmp,lstrcpyW,lstrcpyW,lstrcatW,

2_2_000001845C4FCD30

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F24E0 memset,memset,memset,memset,gethostname,gethostbyname,inet_ntoa,wsprintfW,lstrcatW,GetForegroundWindow,GetWindowTextW,VirtualAlloc,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,VirtualFree,GetComputerNameW,GetCurrentProcess,IsWow64Process,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,GetSystemInfo,wsprintfW,GlobalMemoryStatusEx,wsprintfW,VirtualAlloc,VirtualAlloc,GetUserNameW,GetCurrentProcessId,wsprintfW,VirtualFree,VirtualFree,memset,GetWindowsDirectoryW,GetLastError,GetVolumeInformationW,wsprintfA,wsprintfA,wsprintfW,CoInitialize,CoCreateInstance,SysFreeString,CoUninitialize,GetCurrentProcess,IsWow64Process,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,VirtualFree,

2_2_000001845C4F24E0

Source: svchost.exe, 00000002.00000002.2927994658.000001845AC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@
Source: svchost.exe, 00000002.00000000.1672530680.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2928065655.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.2926027380.0000026539213000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2926510340.00000246DB213000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000002.2926000650.00000236CB6DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dllhost.exe, 00000004.00000002.2926057037.000002707A79B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%%
Source: ParphaCrashReport64.exe, 00000005.00000002.1709470295.000002B07F865000.00000004.00000020.00020000.00000000.sdmp, ParphaCrashReport64.exe, 00000005.00000003.1699861960.000002B07F865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll??

Source: C:\Users\user\Desktop\R2-Signed.exe	API call chain: ExitProcess graph end node			graph_0-13637
Source: C:\Windows\System32\svchost.exe	API call chain: ExitProcess graph end node			graph_2-41788

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FE010 BlockInput,BlockInput,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,mouse_event,BlockInput,

2_2_000001845C4FE010

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_0000000180064130

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Code function: 5_2_00007FF7679FD1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF7679FD1E8

Source: C:\Windows\System32\svchost.exe

2_2_000001845C4E6F60

Source: C:\Windows\System32\svchost.exe

Code function: 3_2_0000000180034DA0 VirtualAlloc ?,?,00000000,0000000180035130,?,?,00000000,0000000180014AAC

3_2_0000000180034DA0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F4080 VirtualAlloc,LoadLibraryW,GetProcAddress,FreeLibrary,

2_2_000001845C4F4080

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4FCA60 CreateToolhelp32Snapshot,GetProcessHeap,HeapAlloc,CloseHandle,Process32FirstW,lstrcmpiW,Process32NextW,GetProcessHeap,HeapFree,CloseHandle,

2_2_000001845C4FCA60

Source: C:\Users\user\Desktop\R2-Signed.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000001801129E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00000001801129E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C530030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_000001845C530030
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180060030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000000180060030
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000000180064130
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180060770 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000000180060770
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180060030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000000180060030
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000000180064130
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180060770 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000000180060770
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF7679FEEF4 SetUnhandledExceptionFilter,	5_2_00007FF7679FEEF4
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF7679FED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF7679FED0C
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF7679FE440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF7679FE440
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FF767A021D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF767A021D8
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FFE11EC5860 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFE11EC5860
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FFE11ECD3B4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFE11ECD3B4
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_00007FFE11EC6270 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFE11EC6270
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180060030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000000180060030
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180064130 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000000180064130
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180060770 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0000000180060770

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: ParphaCrashReport64.exe.2.dr

Jump to dropped file

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\R2-Signed.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B370000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845BE00000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B390000 protect: page read and write	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845C380000 protect: page execute and read and write	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845C390000 protect: page read and write	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845C420000 protect: page execute and read and write	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845C430000 protect: page read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4EF9E0 VirtualAllocEx,GetLastError,VirtualAllocEx,WriteProcessMemory,GetLastError,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,memset,GetThreadContext,SetThreadContext,memset,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,GetLastError,

2_2_000001845C4EF9E0

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F9E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	2_2_000001845C4F9E10
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4EF710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	2_2_000001845C4EF710
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4FE4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	2_2_000001845C4FE4D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018002E4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	3_2_000000018002E4D0
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018001F710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	3_2_000000018001F710
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180029E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	3_2_0000000180029E10
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018002E4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	4_2_000000018002E4D0
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018001F710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	4_2_000000018001F710
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180029E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	4_2_0000000180029E10
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018002E4D0 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,lstrcmpiW,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,Process32NextW,	5_2_000000018002E4D0
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018001F710 VirtualAllocEx,GetLastError,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,GetModuleHandleW,GetProcAddress,CreateRemoteThread,	5_2_000000018001F710
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180029E10 VirtualAlloc,GetLastError,VirtualFree,VirtualFree,GetLastError,memset,lstrcatW,lstrcatW,lstrcatW,memset,memset,memcpy,VirtualFree,VirtualFree,VirtualFree,VirtualFree,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,VirtualFree,GetLastError,VirtualFree,VirtualFree,	5_2_0000000180029E10

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtWriteVirtualMemory: Direct from: 0x18000E065	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtClose: Direct from: 0x18002CA47
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtProtectVirtualMemory: Direct from: 0x18002D4F8	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQuerySystemInformation: Direct from: 0x18001244C	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x1800209C4	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtProtectVirtualMemory: Direct from: 0x18002D89D	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtClose: Direct from: 0x18002052B
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18000D3EB	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180008FB0	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQuerySystemInformation: Direct from: 0x18001216D	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18001B0FA	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020758	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x1800207AD	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x1800208EE	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18000E4F4	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020A2F	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAdjustPrivilegesToken: Direct from: 0x180020511	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtWriteVirtualMemory: Direct from: 0x18000E8B1	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtUnmapViewOfSection: Direct from: 0x18002C9A7	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18002069D	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtWriteVirtualMemory: Direct from: 0x18000E6D2	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtUnmapViewOfSection: Direct from: 0x18002C9C4	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020818	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020959	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQueryInformationProcess: Direct from: 0x1800091B3	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x1800121DB	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtWriteVirtualMemory: Direct from: 0x18000B93E	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQuerySystemInformation: Direct from: 0x18002D84B	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020A9A	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18000E173	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18001B08C	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtProtectVirtualMemory: Direct from: 0x18002D52B	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAdjustPrivilegesToken: Direct from: 0x18000C5C9	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtProtectVirtualMemory: Direct from: 0x18002D88C	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18001B0C3	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020883	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtClose: Direct from: 0x180020741
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180008494	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQuerySystemInformation: Direct from: 0x180009000	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18001AFDD	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18000B8AD	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAdjustPrivilegesToken: Direct from: 0x180020727	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtQuerySystemInformation: Direct from: 0x18002C984	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180012212	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x180020544	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18001B131	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	NtAllocateVirtualMemory: Direct from: 0x18002D1CC	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 3128	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 7296	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 7216	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread register set: target process: 7336	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\R2-Signed.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845BE00000	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000	Jump to behavior
Source: C:\Users\user\Desktop\R2-Signed.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2707A630000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2707A6C0000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2707A620000	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845C380000	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845C390000	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845C420000	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845C430000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 236CB450000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 236CB4E0000	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 236CB440000	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe	2_2_000001845C4E2140
Source: C:\Windows\System32\svchost.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe	3_2_0000000180012140
Source: C:\Windows\System32\dllhost.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe	4_2_0000000180012140
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: WSAStartup,GetCommandLineW,CommandLineToArgvW,VirtualAlloc,InitializeCriticalSection,VirtualAlloc,InitializeCriticalSection,memset,GetCurrentProcessId,lstrcmpiW,lstrcmpiW,ExitThread,lstrcmpiW,GetCurrentProcess,TerminateProcess,lstrcmpiW,GetCurrentProcessId,OpenProcess,TerminateProcess,CloseHandle,WaitForSingleObject,GetExitCodeProcess,Sleep,CreateThread,WaitForSingleObject,CloseHandle,memset,GetModuleFileNameW,wcsstr,GetNativeSystemInfo,ExitProcess,memset,GetModuleFileNameW,IsUserAnAdmin,memset,wsprintfW,OpenSCManagerW,GetLastError,OpenServiceW,ChangeServiceConfig2W,GetLastError,CloseServiceHandle,CloseServiceHandle,lstrcmpiW,lstrcmpiW,GetNativeSystemInfo,ExitProcess,GetCurrentProcess,TerminateProcess, svchost.exe	5_2_0000000180012140

Source: C:\Windows\System32\svchost.exe

2_2_000001845C4FE010

Source: C:\Windows\System32\svchost.exe

2_2_000001845C4FE010

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Mail\ParphaCrashReport64.exe "C:\Program Files\Windows Mail\ParphaCrashReport64.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}	Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll	Jump to behavior

Source: svchost.exe, 00000003.00000002.2928204871.000002653A690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.2320497763.000002653A660000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000004.00000003.2300635309.000002707CD60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000003.00000003.2320869082.000002653A990000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2347105316.00000246DC900000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TCPProgram Manager

Source: C:\Users\user\Desktop\R2-Signed.exe

Code function: 0_2_000000018002BBA8 cpuid

0_2_000000018002BBA8

Source: C:\Users\user\Desktop\R2-Signed.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_000001845C4F7E20 CreateNamedPipeW,GetLastError,ConnectNamedPipe,GetLastError,

2_2_000001845C4F7E20

Source: C:\Users\user\Desktop\R2-Signed.exe

Code function: 0_2_0000000180112B5C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000180112B5C

Source: C:\Windows\System32\svchost.exe

2_2_000001845C4F24E0

Stealing of Sensitive Information

Yara detected ValleyRAT

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 1044, type: MEMORYSTR

Remote Access Functionality

Yara detected ValleyRAT

Source: Yara match

File source: Process Memory Space: svchost.exe PID: 1044, type: MEMORYSTR

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C4F1520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	2_2_000001845C4F1520
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C517630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	2_2_000001845C517630
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C51A830 socket,socket,htonl,bind,getsockname,	2_2_000001845C51A830
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_000001845C526B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	2_2_000001845C526B30
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180021520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	3_2_0000000180021520
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180047630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	3_2_0000000180047630
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_000000018004A830 socket,socket,htonl,bind,getsockname,	3_2_000000018004A830
Source: C:\Windows\System32\svchost.exe	Code function: 3_2_0000000180056B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	3_2_0000000180056B30
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180021520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	4_2_0000000180021520
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180047630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	4_2_0000000180047630
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_000000018004A830 socket,socket,htonl,bind,getsockname,	4_2_000000018004A830
Source: C:\Windows\System32\dllhost.exe	Code function: 4_2_0000000180056B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	4_2_0000000180056B30
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180021520 memset,VirtualFree,VirtualFree,socket,setsockopt,htons,inet_addr,htonl,bind,WSAGetLastError,listen,CreateThread,IsBadReadPtr,EnterCriticalSection,VirtualAlloc,LeaveCriticalSection,	5_2_0000000180021520
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180047630 socket,setsockopt,setsockopt,setsockopt,WSAGetLastError,listen,closesocket,WSAGetLastError,closesocket,closesocket,	5_2_0000000180047630
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_000000018004A830 socket,socket,htonl,bind,getsockname,	5_2_000000018004A830
Source: C:\Program Files\Windows Mail\ParphaCrashReport64.exe	Code function: 5_2_0000000180056B30 htons,_unlink,bind,WSAGetLastError,getsockname,htons,	5_2_0000000180056B30

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	3 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Create Account	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Abuse Elevation Control Mechanism	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	12 Windows Service	11 Access Token Manipulation	2 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	1 Scheduled Task/Job	12 Windows Service	1 Software Packing	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	523 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	1 Network Share Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 File Deletion	DCSync	141 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Masquerading	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	523 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
R2-Signed.exe	16%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files\Windows Mail\ParphaCrashReport64.exe	4%	ReversingLabs
C:\Program Files\Windows Mail\arphaDump64.dll	52%	ReversingLabs	Win64.Trojan.Generic

Name	Source	Malicious	Reputation
https://support.google.com/chrome/answer/6098869?hl=es	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/answer/6098869	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.html	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=es-419Ctrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=et&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=etCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSaved	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=zh-TWCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://myactivity.google.com/	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSelle	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://passwords.google.comGestoorde	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.com	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://policies.google.com/	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=esCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://ejemplo.com.Se	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=afCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comSe	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://www.google.com/chrome/privacy/eula_text.html&AideG	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherEnabled	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comMots	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore/category/extensions	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chromebook?p=app_intent	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=frCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=es-419&category=theme81https://myactivity.google.com/myactivit	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comT	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=en-GB&category=theme81https://myactivity.google.com/myactivity	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/answer/96817	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/a/?p=browser_profile_details	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=filCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlA&biHaldab	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comMga	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://support.google.com/chrome/a/answer/9122284	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=fil&category=theme81https://myactivity.google.com/myactivity/?	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=enCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://passwords.google.comContrase	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chrome.google.com/webstore?hl=fiCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlBestuur	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlO&hjeOrganisaatiosi	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
http://ejemplo.com	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist	R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://www.google.com/chrome/privacy/eula_text.htmlA&yudaAdministrado	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=en-GBCtrl$1	R2-Signed.exe, 00000000.00000000.1666745025.00007FF6AE6C5000.00000008.00000001.01000000.00000003.sdmp, R2-Signed.exe, 00000000.00000002.1692179704.00007FF6AE716000.00000008.00000001.01000000.00000003.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
18.139.89.40	unknown	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579841
Start date and time:	2024-12-23 11:21:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	R2-Signed.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 33 Number of non-executed functions: 299
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197, 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: R2-Signed.exe

Simulations

Behavior and APIs

Time	Type	Description
10:22:01	Task Scheduler	Run new task: MicrosoftMailUpdateTask path: C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	TsWpfWrp.exe	Get hash	malicious	ValleyRAT	Browse	52.74.204.186
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	3.5.232.230
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	3.5.232.130
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	3.5.234.55
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	armv5l.elf	Get hash	malicious	Unknown	Browse	108.159.159.70
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	185.166.143.48
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	52.216.152.124
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	185.166.143.49

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\Windows Mail\ParphaCrashReport64.exe	TsWpfWrp.exe	Get hash	malicious	ValleyRAT	Browse
	hvix64.exe	Get hash	malicious	ValleyRAT	Browse
	2024-12-10#U67e5#U9605_uninst.exe	Get hash	malicious	ValleyRAT	Browse
	2024-12-10#U67e5#U9605_uninst.exe	Get hash	malicious	ValleyRAT	Browse
	png131.exe	Get hash	malicious	ValleyRAT	Browse
	install.exe	Get hash	malicious	ValleyRAT	Browse
	Telegrm2.69.exe	Get hash	malicious	Unknown	Browse
	Telegrm2.69.exe	Get hash	malicious	Unknown	Browse
	file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip	Get hash	malicious	Unknown	Browse
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\Windows Mail\arphaDump64.dll	png131.exe	Get hash	malicious	ValleyRAT	Browse
C:\Program Files\Windows Mail\arphaDump64.dll	install.exe	Get hash	malicious	ValleyRAT	Browse

Created / dropped Files

C:\Program Files\Windows Mail\ParphaCrashReport64.exe

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: TsWpfWrp.exe, Detection: malicious, Browse Filename: hvix64.exe, Detection: malicious, Browse Filename: 2024-12-10#U67e5#U9605_uninst.exe, Detection: malicious, Browse Filename: 2024-12-10#U67e5#U9605_uninst.exe, Detection: malicious, Browse Filename: png131.exe, Detection: malicious, Browse Filename: install.exe, Detection: malicious, Browse Filename: Telegrm2.69.exe, Detection: malicious, Browse Filename: Telegrm2.69.exe, Detection: malicious, Browse Filename: file_6c73ff4553d147e39fc35434c1e9e972_2024-07-30_02_54_11_351000.zip, Detection: malicious, Browse Filename: SvpnLong2.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\Program Files\Windows Mail\arphaDump64.bin

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	546252
Entropy (8bit):	6.543977929343346
Encrypted:	false
SSDEEP:	12288:awnKbeNO/thmmWIK3z9rG3U9szzrHUPRxG0+UfYlrYSF:flXDp9HPYlr5F
MD5:	3E6532D7FE0BB87D94B2BB7986F12CC9
SHA1:	0644EEF386564C0411FDD067473F85A9921E34BC
SHA-256:	FAC90A422E92EDB585C4C89746ED47CDE8D045BEF7BBAE4F527CC8A0767E62B1
SHA-512:	1B431C7ECD2FDEC4FE601AFFA4AEAEC905860008A5420EAFFDC5892CA3AE1080BEA1427DFFCE53BABFCE0225F9133F4CE97BAA5D34817079CF3B9AFF70CE7B9B
Malicious:	false
Reputation:	low
Preview:	4...H..(H...D$8run.H.L$8.O...H..(...eH..%`......D..3.L..E..t"A........A..a.J..L.I....A..D....u..H.A.....H.\$.H.l$.H.t$.WAVAWH.. D......H.P.H.j L..I.......M..L.P0M..tLIcB<B.........t<I.<..O.I...j....w 3.I..D..9_.v...I...P...A..D;.t+..H...;_.r.L;.u.3.H.\$@H.l$HH.t$PH.. A_A^_.O$I..D...Y.O.I..B...I.......@SH.. H.......%...H..H.. [H....H.\$.WH.. H..H...........H..H..H.\$0H.. _H.....H.\$.UVWATAUAVAWH.. L..M..3.Z.H........2=..L.......-A..H.D$x....M..M.f.H.D$p3...A..y.H..(fA;A.s\|I..9.u29E8~ZHc]8A......O.H..I..A.....A..L..G.3.H...T$p.-.O.A.......I..A.....A..W.H..D..I..H...T$x._.I....H..(..H......;.\|.H.\$`H.. A_A^A]A\_^].H.\$.H.l$.H.t$ WATAUAVAWH..@L..-A........ ...H.L$ D..H..3...D.g.E..H.L$ A....E..W.H.L$$..E..W.H.L$(..E..W.H.L$,..E..W.H.L$0..E..W`H.L$4..E..H.L$8....E..W H.L$<....O.B....../.H...5...M..E3.L..A..H.........A..Y.I.q0H..(H#.fE;i.......I..D.C.A.....A.....E..A#.A...A#.A....s..K.A..@....H.....OH..B..I..RD.T. A....A....D.CT. ..u.A..@t.A.A ..E..y.A.A$..t..K.L.L$pH...E.

C:\Program Files\Windows Mail\arphaDump64.dll

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	6.391182582162269
Encrypted:	false
SSDEEP:	3072:qzZrTgN6uyqfkqc53wuY+OrGW2LRKK9+R/BsP3VkxQO6yOxaXLNC3dvMvuTYp:ksxkmyLRKiM/BsNd3yGaXpruT2
MD5:	1184B14D782403EAF5EB02DFA36777C5
SHA1:	7C6FBCFC3C26B1BFB232DADCE23F31124468BD72
SHA-256:	ACC214BCA1EE6212144EC1F45F247389FD81C462C8D4C4D85B323198F911759A
SHA-512:	B378B9D3A51919654A8C5D56B6359F870EC9C14C7EFB9F56BAB6F547CDF5A45A1A9BE793C2461752196B8BA64C7ED9CDCBE6E34BFFF68A8C05FA8CAA8A96FB5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Joe Sandbox View:	Filename: png131.exe, Detection: malicious, Browse Filename: install.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K+...Js..Js..Js.D2p..Js.D2v..Js.D2w..Js...p..Js...w..Js...v.,Js.D2r..Js..Jr.jJs...z..Js...s..Js.....Js...q..Js.Rich.Js.................PE..d....DDg.........." ...*.............^....................................................`..........................................,.......-..<............p..........................p.......................(.......@............................................text...P~.......................... ..`.rdata.............................@..@.data....&...@.......,..............@....pdata.......p.......B..............@..@.rsrc................X..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	3.559796516107948
Encrypted:	false
SSDEEP:	48:yei1q9tNTyOXZj9c9V9Lbra+iaiudupRCRvA9ufAuRa7T5XhPsV8ic4dTKp+++:tX4diaigVA9ll7dhFF7+
MD5:	79C8530188472FA4159DE398A9CA797F
SHA1:	0B8743354489D4460DA39E8E4EF2230E9925F638
SHA-256:	46722563913B24900DFD02AFD809AE2BBABB5CE420AA81ECBF008F7ACE247F34
SHA-512:	2079F7EA505FC410028A0D36A408AFE97E0BDED14548EE6448F692FEEF2D55D52CE6EC9DF5A016C6737595275FF6BD5F4D5397F0C128445ED262B75BF4DD7EE5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.A.u.t.h.o.r.>.S.Y.S.T.E.M.<./.A.u.t.h.o.r.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.M.i.c.r.o.s.o.f.t. .M.a.i.l. .U.p.d.a.t.e. .T.a.s.k. .M.a.c.h.i.n.e.C.o.r.e.<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t.M.a.i.l.U.p.d.a.t.e.T.a.s.k.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.B.o.o.t.T.r.i.g.g.e.r.>..... . . . . . .<.E.n.a.b.l.e.d.>.t.r.u.e.<./.E.n.a.b.l.e.d.>..... . . . .<./.B.o.o.t.T.r.i.g.g.e.r.>..... . .<./.T.r.i.g.g.e.r.s.>..... . .<.P.r.i.n.c.i.p.a.l.s.>..... . . . .<.P.r.i.n.c.i.p.a.l. .i.d.=.".A.u.t.h.o.r.".>..... . . . . . .<.U.s.e.r.I.d.>.S.-.1.-.5.-.1.8.<./.U.s.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.015585406867402
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	R2-Signed.exe
File size:	23'289'008 bytes
MD5:	a7471e097d4d4e84fa44a025603499e1
SHA1:	231bbd89584d137fb2a418776549aa3774638d42
SHA256:	deede7611a657fab998d2e354f0168adf7a9ab89f34ab1fd7ccab8c9736597e9
SHA512:	b5309cadd5e85a17a19e5c15a56eb2e668d1cc7b46f31f2977afde309d33b96fa93e1c3cb9c23314c027c895772821930d56388ccad5b75d0831f804892dc434
SSDEEP:	393216:G1/Uf6MyNXElYsjLl7Skew2j+bqJqJsv6tWKFdu9CnF:a4pKRiqJK
TLSH:	E737BF07B29006A9E072E078DA47C117FB71F418A76097DB35A896D92F73BF0A93B351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................\|.....7.............................................r...................\...r.......s.......s......

File Icon


Icon Hash:	03898f8f8f8f8b01

Static PE Info

General

Entrypoint:	0x1408afff0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x675000B5 [Wed Dec 4 07:11:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7ef050b01014b0234d5be0c3d4a81582

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/05/2010 20:00:00 15/07/2011 19:59:59
Subject Chain	CN="Dolby Laboratories, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Dolby Laboratories, Inc.", L=San Francisco, S=California, C=US
Version:	3
Thumbprint MD5:	1546F35EF8BB0380178D89F5A9756956
Thumbprint SHA-1:	191FF743577ED5AC47B800923ACA83D3352A0AEC
Thumbprint SHA-256:	D61CE0F870501FF2B1319CC53084963FDD016D456FB54BDB06D9D24301E0DA33
Serial:	20892E8E533FAE56ADE2E9120D5B9B5F

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD36131E8FCh
dec eax
add esp, 28h
jmp 00007FD36131DC5Fh
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
mov edx, 00000FA0h
dec eax
lea ecx, dword ptr [00D17776h]
call dword ptr [00110668h]
dec eax
lea ecx, dword ptr [00BD9769h]
call dword ptr [001102BBh]
dec eax
mov ebx, eax
dec eax
test eax, eax
jne 00007FD36131DDF7h
dec eax
lea ecx, dword ptr [00BD979Ch]
call dword ptr [001102A6h]
dec eax
mov ebx, eax
dec eax
test eax, eax
je 00007FD36131DE61h
dec eax
lea edx, dword ptr [00BD97A7h]
dec eax
mov ecx, ebx
call dword ptr [00110296h]
dec eax
lea edx, dword ptr [00BD97B7h]
dec eax
mov ecx, ebx
dec eax
mov edi, eax
call dword ptr [00110283h]
dec eax
test edi, edi
je 00007FD36131DDF7h
dec eax
test eax, eax
je 00007FD36131DDF2h
dec eax
mov dword ptr [00D1773Ah], edi
dec eax
mov dword ptr [00D1773Bh], eax
jmp 00007FD36131DE00h
inc ebp
xor ecx, ecx
inc ebp
xor eax, eax
xor ecx, ecx
inc ecx
lea edx, dword ptr [ecx+01h]
call dword ptr [001105A7h]
dec eax
mov dword ptr [00D176E8h], eax
dec eax
test eax, eax
je 00007FD36131DE06h
xor ecx, ecx
call 00007FD36131D909h
test al, al
je 00007FD36131DDFBh
dec eax
lea ecx, dword ptr [0000001Dh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c0f38	0x154	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1628000	0x21bc0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa221a8	0x75e1c	.vmp2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1630c00	0x50b0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x161b000	0xc1f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14d1238	0x1c	.vmp2
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x14d1400	0x28	.vmp2
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14d1260	0x138	.vmp2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c0000	0xf10	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9bea60	0x9bec00	ad7a18a94e844ab16267efbd30a99280	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.idata	0x9c0000	0x424e	0x4400	ffa77a54d4f138e8c9bbfab0fcc8e5ef	False	0.3131893382352941	data	4.775786531589324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp2	0x9c5000	0xc0455c	0xbf0400	be936bd807d3d0de837401ea3bbb98fc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.qtmetad	0x15ca000	0x536	0x600	bfd0a37e057f358d80d1716d9a9abd7e	False	0.24609375	data	5.0500249701877475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.qtmimed	0x15cb000	0x4ece5	0x4ee00	2d32d357ab751ffbbb513570c6ee6986	False	0.997458770800317	gzip compressed data, original size modulo 2^32 0	7.998000978505572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
_RDATA	0x161a000	0x130	0x200	4cf87728c7431acc28c0e2229f313f5a	False	0.318359375	data	2.6787961516860954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x161b000	0xc1f8	0xc200	ae4ac34fee01f20308f4133c27853680	False	0.16233086340206185	data	5.483512500297378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x1628000	0x21bc0	0x21c00	33c26467011d800558c1f808e28a0223	False	0.4668041087962963	data	5.570115815801445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x16281b0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.4333224890571395
RT_ICON	0x16389d8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 2835 x 2835 px/m	0.45877128442295567
RT_ICON	0x1641e80	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.5150566839867737
RT_ICON	0x16460a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.5564315352697096
RT_ICON	0x1648650	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.6531425891181989
RT_ICON	0x16496f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.8342198581560284
RT_GROUP_ICON	0x1649b60	0x5a	data	0.7777777777777778

Imports

DLL	Import
WTSAPI32.dll	WTSFreeMemory, WTSQuerySessionInformationW
UxTheme.dll	GetThemeColor, GetThemeInt, GetThemePartSize, OpenThemeData, GetThemeEnumValue, GetThemeMargins, GetCurrentThemeName, IsAppThemed, IsThemeActive, SetWindowTheme, GetThemeBool, IsThemeBackgroundPartiallyTransparent, GetThemeBackgroundRegion, CloseThemeData, GetThemeTransitionDuration, GetThemePropertyOrigin
dwmapi.dll	DwmGetWindowAttribute, DwmIsCompositionEnabled, DwmSetWindowAttribute, DwmEnableBlurBehindWindow
GDI32.dll	CreateRectRgn, DeleteDC, DeleteObject, GetRegionData, SelectClipRgn, SelectObject, CreateDIBSection, GdiFlush, BitBlt, CreateCompatibleDC, SetLayout, GetDeviceCaps, CreateCompatibleBitmap, CreateDCW, CreateBitmap, ChoosePixelFormat, SetPixelFormat, DescribePixelFormat, GetPixelFormat, SwapBuffers, GetBitmapBits, GetObjectW, CreateFontIndirectW, EnumFontFamiliesExW, GetFontData, GetStockObject, AddFontResourceExW, RemoveFontResourceExW, AddFontMemResourceEx, RemoveFontMemResourceEx, GetTextMetricsW, GetTextFaceW, GetCharABCWidthsW, GetCharABCWidthsFloatW, GetGlyphOutlineW, GetOutlineTextMetricsW, GetTextExtentPoint32W, GetCharABCWidthsI, SetBkMode, SetGraphicsMode, SetTextColor, SetTextAlign, SetWorldTransform, ExtTextOutW, CombineRgn, OffsetRgn, GetDIBits
OLEAUT32.dll	SafeArrayPutElement, SysAllocString, SafeArrayCreateVector, SysFreeString
IMM32.dll	ImmGetVirtualKey, ImmSetCandidateWindow, ImmGetDefaultIMEWnd, ImmGetContext, ImmReleaseContext, ImmAssociateContext, ImmAssociateContextEx, ImmGetCompositionStringW, ImmGetOpenStatus, ImmNotifyIME, ImmSetCompositionWindow
KERNEL32.dll	EnterCriticalSection, RaiseException, lstrcmpW, GetLastError, GetCurrentThreadId, GetModuleHandleW, GetProcAddress, LocalFree, FormatMessageW, WTSGetActiveConsoleSessionId, ExpandEnvironmentStringsW, CloseHandle, CreateProcessW, CheckRemoteDebuggerPresent, OpenProcess, GlobalAlloc, GlobalUnlock, GlobalLock, GetLocaleInfoW, LoadLibraryW, LoadLibraryA, GlobalSize, GetCurrentProcessId, GetUserDefaultLangID, CreateFileW, GetFileSizeEx, ReadFile, WriteFile, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, WideCharToMultiByte, RtlPcToFileHeader, GetExitCodeProcess, GetUserGeoID, InitializeCriticalSectionEx, GetTimeZoneInformation, GetModuleHandleExW, FreeLibrary, FindNextFileW, VirtualFree, VirtualAlloc, CreateMutexW, ReleaseMutex, InitializeCriticalSection, WriteConsoleW, HeapSize, GetProcessHeap, FreeEnvironmentStringsW, FindFirstFileExW, FindNextChangeNotification, FindFirstChangeNotificationW, FindCloseChangeNotification, MultiByteToWideChar, LCMapStringW, CompareStringW, RegisterWaitForSingleObject, UnregisterWaitEx, SetFilePointerEx, SetEndOfFile, GetFileType, FlushFileBuffers, GetFileInformationByHandleEx, SystemTimeToFileTime, FileTimeToSystemTime, TzSpecificLocalTimeToSystemTime, MoveFileExW, MoveFileW, CopyFileW, DeviceIoControl, SetErrorMode, GetVolumePathNamesForVolumeNameW, GetTempPathW, SetFileTime, RemoveDirectoryW, GetLogicalDrives, GetFullPathNameW, GetFileInformationByHandle, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, CreateDirectoryW, GetCurrentDirectoryW, GetModuleFileNameW, GetStartupInfoW, GetTickCount64, QueryPerformanceFrequency, QueryPerformanceCounter, GetFileAttributesExW, GetUserPreferredUILanguages, GetUserDefaultLCID, GetCurrencyFormatW, GetTimeFormatW, GetDateFormatW, ResetEvent, GetSystemInfo, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, ResumeThread, TerminateThread, GetThreadPriority, SetThreadPriority, GetCurrentThread, CreateThread, WaitForMultipleObjects, Sleep, WaitForSingleObject, DuplicateHandle, GetSystemDirectoryW, CreateEventW, WaitForSingleObjectEx, SetEvent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, OutputDebugStringW, GetLocalTime, GetSystemTime, InitializeCriticalSectionAndSpinCount, GetCommandLineW, CompareStringEx, GetConsoleWindow, GetDriveTypeW, GetVolumeInformationW, GetLongPathNameW, DeleteCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, SetLastError, RtlUnwind, LoadLibraryExW, ExitProcess, GetCommandLineA, ExitThread, FreeLibraryAndExitThread, SetFileAttributesW, SetStdHandle, GetConsoleMode, ReadConsoleW, GetConsoleCP, GetStdHandle, HeapFree, HeapAlloc, HeapReAlloc, RtlUnwindEx, GetCPInfo, IsValidLocale, GetGeoInfoW, SetEnvironmentVariableW, IsValidCodePage, GetACP, GetOEMCP, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EnumSystemLocalesW, GetEnvironmentStringsW, GetSystemTimeAsFileTime, InitializeSListHead
ole32.dll	OleFlushClipboard, OleGetClipboard, OleSetClipboard, CoCreateGuid, CoInitialize, CoCreateInstance, CoUninitialize, OleUninitialize, OleInitialize, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleIsCurrentClipboard, DoDragDrop, CoTaskMemFree, ReleaseStgMedium, CoInitializeEx, CoGetMalloc, StringFromGUID2
SHELL32.dll	SHGetKnownFolderPath, CommandLineToArgvW, SHGetFileInfoW, SHGetStockIconInfo, ShellExecuteW, SHCreateItemFromIDList, SHCreateItemFromParsingName, SHGetMalloc, SHGetPathFromIDListW, SHGetKnownFolderIDList, SHBrowseForFolderW, Shell_NotifyIconW, Shell_NotifyIconGetRect
USER32.dll	IsZoomed, PeekMessageW, FindWindowA, SetCaretPos, GetIconInfo, CreateIconIndirect, CreateCursor, ShowCaret, HideCaret, DestroyCaret, CreateCaret, IsWindowEnabled, RegisterWindowMessageW, GetKeyboardLayout, RegisterClipboardFormatW, SetClipboardViewer, IsHungAppWindow, LoadIconW, EnumDisplayMonitors, GetMonitorInfoW, MonitorFromWindow, SetMenuItemInfoW, GetMenuItemInfoW, TrackPopupMenu, RemoveMenu, ModifyMenuW, AppendMenuW, InsertMenuW, DestroyMenu, CreatePopupMenu, CreateMenu, DrawMenuBar, SetMenu, LoadImageW, GetSysColorBrush, ChildWindowFromPointEx, WindowFromPoint, GetCursorPos, GetFocus, RegisterClassExW, GetClassInfoW, UnregisterClassW, UnregisterPowerSettingNotification, RegisterPowerSettingNotification, GetKeyboardLayoutList, GetAncestor, DestroyIcon, DestroyCursor, GetWindow, GetWindowThreadProcessId, SetParent, GetParent, SetWindowLongPtrW, GetKeyboardState, LoadCursorW, GetWindowLongW, ScreenToClient, ClientToScreen, SetCursor, AdjustWindowRectEx, GetWindowRect, GetClientRect, SetWindowTextW, InvalidateRect, SetWindowRgn, GetUpdateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, EnableMenuItem, GetSystemMenu, GetMenu, ReleaseCapture, SetCapture, GetCapture, IsTouchWindow, UnregisterTouchWindow, RegisterTouchWindow, SetFocus, IsIconic, IsWindowVisible, SetWindowPlacement, GetWindowPlacement, SetWindowPos, MoveWindow, FlashWindowEx, SetLayeredWindowAttributes, UpdateLayeredWindow, ShowWindow, IsChild, CreateWindowExW, AttachThreadInput, PostMessageW, SendMessageW, UpdateLayeredWindowIndirect, GetCaretBlinkTime, MessageBeep, IsWindow, GetDoubleClickTime, GetDesktopWindow, GetSysColor, ReleaseDC, GetDC, DestroyWindow, DefWindowProcW, SystemParametersInfoW, GetSystemMetrics, GetKeyState, ToAscii, ToUnicode, MapVirtualKeyW, TrackPopupMenuEx, ChangeWindowMessageFilterEx, RealGetWindowClassW, EnumWindows, GetWindowTextW, CloseTouchInputHandle, GetTouchInputInfo, GetAsyncKeyState, GetMessageExtraInfo, TrackMouseEvent, GetClipboardFormatNameW, GetWindowLongPtrW, MessageBoxW, DrawIconEx, TranslateMessage, DispatchMessageW, GetQueueStatus, GetCursor, GetCursorInfo, SetCursorPos, EnumDisplayDevicesW, SetWindowLongW, RegisterClassW, MsgWaitForMultipleObjectsEx, SetTimer, KillTimer, CharNextExA, RegisterDeviceNotificationW, UnregisterDeviceNotification, MonitorFromPoint, ChangeClipboardChain
WINMM.dll	timeSetEvent, PlaySoundW, timeKillEvent
USERENV.dll	GetUserProfileDirectoryW
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
NETAPI32.dll	NetApiBufferFree, NetShareEnum
WS2_32.dll	WSAAsyncSelect
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegQueryValueExW, SystemFunction036, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegQueryInfoKeyW, RegSetValueExW, OpenProcessToken, AccessCheck, AllocateAndInitializeSid, CopySid, DuplicateToken, FreeSid, GetLengthSid, MapGenericMask, LookupAccountSidW, GetEffectiveRightsFromAclW, GetNamedSecurityInfoW, BuildTrusteeWithSidW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 11:22:02.387995005 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:02.507847071 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:02.507973909 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:02.508163929 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:02.627983093 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:04.090142965 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:04.141693115 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:04.210383892 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:04.330365896 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:04.376780987 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:04.499732971 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:04.502361059 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:04.634212017 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:04.754256010 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:06.133008957 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:06.172904015 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:06.221169949 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:06.341059923 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:14.344845057 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:14.464904070 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:16.344837904 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:16.464739084 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:24.469825029 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:24.589898109 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:26.469940901 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:26.590063095 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:34.594846964 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:34.714613914 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:36.594881058 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:36.714562893 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:44.719907999 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:44.839602947 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:46.719917059 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:46.839723110 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:54.842978001 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:54.962863922 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:22:56.855546951 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:22:56.975357056 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:04.969964027 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:05.089565992 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:05.231806040 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:05.351249933 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:06.985567093 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:07.105087042 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:07.860107899 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:07.979743958 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:15.360596895 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:15.535686970 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:17.985589981 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:18.105360985 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:25.548089981 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:25.667799950 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:28.110619068 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:28.230062962 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:35.673129082 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:35.792912960 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:38.235641956 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:38.355344057 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:45.798170090 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:45.917817116 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:48.360656023 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:48.480294943 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:55.923197031 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:56.043132067 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:23:58.485712051 CET	49743	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:23:58.605711937 CET	80	49743	18.139.89.40	192.168.2.4
Dec 23, 2024 11:24:06.048197985 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:24:06.126758099 CET	49741	80	192.168.2.4	18.139.89.40
Dec 23, 2024 11:24:06.168011904 CET	80	49741	18.139.89.40	192.168.2.4
Dec 23, 2024 11:24:06.246507883 CET	80	49741	18.139.89.40	192.168.2.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	18.139.89.40	80	3128	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 11:22:02.508163929 CET	56	OUT	Data Raw: 15 1a 09 2c 0d 03 28 17 20 0d 18 26 15 09 13 19 08 27 22 25 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 Data Ascii: ,( &'"%::::::::::::::::::::::::::::::::=8
Dec 23, 2024 11:22:04.090142965 CET	85	IN	Data Raw: 0f 23 1e 2e 06 0c 09 14 13 25 20 2e 0f 12 13 22 0c 1a 1c 22 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a 5e 3a 3a 3a 27 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c 63 b2 12 b1 e2 b3 e2 01 92 dc 56 1c 56 9c 60 9a c9 8a d9 8a 9a 00 00 b5 Data Ascii: #.% .""::::::::::::::::;:::^:::':::::::=8xcVV`Iu
Dec 23, 2024 11:22:04.210383892 CET	833	OUT	Data Raw: 0f 23 1e 2e 06 0c 09 14 13 25 20 2e 0f 12 13 22 0c 1a 1c 22 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a da 11 3a 3a 33 39 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 5a c9 6e 13 41 10 45 ce c5 d8 8e 93 83 0f 91 15 21 14 21 84 10 e2 c4 Data Ascii: #.% .""::::::::::::::::;:::::39::::::=8xZnAE!!"g1`Kq@Gg,^eLP=qOW%(b)"NDgV:UUYNQ@pizZMZ*%X,86Ij8\Q^Dww3ZDOi%
Dec 23, 2024 11:22:14.344845057 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:24.469825029 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:34.594846964 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:44.719907999 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:54.842978001 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:23:04.969964027 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:23:05.231806040 CET	645	OUT	Data Raw: 07 27 0c 10 1b 1b 2c 11 1a 1d 06 28 27 1c 09 15 15 28 2a 0f 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 32 1a 3a 3a 3a 1e 3a 3a 77 38 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 58 5d 6b 1a 51 10 85 3e 15 fa 92 87 3c 88 91 52 a4 84 12 42 c8 43 9e Data Ascii: ',('(*::::::::::::::::2:::::w8::::::=8xX]kQ><RBC}()ljUduMBm \|%\IH5TY=sj=BSx=AyBiE]}o!k-w\+{QQl7i}N>FES`aW J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	18.139.89.40	80	7296	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 11:22:04.634212017 CET	56	OUT	Data Raw: 0f 23 1e 2e 06 0c 09 14 13 25 20 2e 0f 12 13 22 0c 1a 1c 22 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 Data Ascii: #.% .""::::::::::::::::::::::::::::::::=8
Dec 23, 2024 11:22:06.133008957 CET	85	IN	Data Raw: 06 1b 2e 19 2b 1e 1e 1a 02 2d 28 06 11 27 10 06 00 18 09 0b 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a 5e 3a 3a 3a 27 3a 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c 63 b2 12 b1 e2 b3 e2 01 92 dc 56 1c 56 9c 60 9a c9 8a d9 8a 9a 00 00 b5 Data Ascii: .+-('::::::::::::::::;:::^:::':::::::=8xcVV`Iu
Dec 23, 2024 11:22:06.221169949 CET	801	OUT	Data Raw: 06 1b 2e 19 2b 1e 1e 1a 02 2d 28 06 11 27 10 06 00 18 09 0b 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3b 3a 3a 3a 96 11 3a 3a d3 38 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 58 5b 6f 12 51 10 36 f4 05 81 5e 1e 78 68 48 63 4c 63 8c 31 c6 27 9f Data Ascii: .+-('::::::::::::::::;:::::8::::::=8xX[oQ6^xhHcLc1'Fa]"Y.6>T4b~3eYf9{\|3ssv#m-%Vv!-xHx1lD#IyqR}qm'rW)<Dpa%nP%Mb\|p%t}')}G81;
Dec 23, 2024 11:22:16.344837904 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:26.469940901 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:36.594881058 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:46.719917059 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:22:56.855546951 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:23:06.985567093 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 23, 2024 11:23:07.860107899 CET	645	OUT	Data Raw: 29 1c 0c 03 1c 04 0d 16 15 05 0e 01 28 21 2e 19 09 1f 17 24 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 32 1a 3a 3a 3a 1e 3a 3a 77 38 3a 3a 3a 3a 3a 3a 1e 1a 3d 38 78 9c ed 58 5d 6b 1a 51 10 85 3e 15 fa 92 87 3c 88 91 52 a4 84 12 42 c8 43 9e Data Ascii: )(!.$::::::::::::::::2:::::w8::::::=8xX]kQ><RBC}()ljUduMBm \|%\IH5TY=sj=BSx=AyBiE]}o!k-w\+{QQl7i}N>FES`aW J

Target ID:	0
Start time:	05:21:58
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\R2-Signed.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\R2-Signed.exe"
Imagebase:	0x7ff6add00000
File size:	23'289'008 bytes
MD5 hash:	A7471E097D4D4E84FA44A025603499E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:21:59
Start date:	23/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:22:00
Start date:	23/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:22:01
Start date:	23/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:22:01
Start date:	23/12/2024
Path:	C:\Program Files\Windows Mail\ParphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Mail\ParphaCrashReport64.exe"
Imagebase:	0x7ff7679f0000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:22:02
Start date:	23/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:22:03
Start date:	23/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	76.4%
Total number of Nodes:	110
Total number of Limit Nodes:	4

Executed Functions

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211
servicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00000001800015E5
memcpy.NTDLL ref: 0000000180001609
malloc.MSVCRT ref: 0000000180001613
memset.NTDLL ref: 0000000180001648
memset.NTDLL ref: 00000001800016A8
GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
malloc.MSVCRT ref: 00000001800016CD
memset.NTDLL ref: 00000001800016E7
memcpy.NTDLL ref: 00000001800016F5
OpenSCManagerW.ADVAPI32 ref: 0000000180001789
EnumServicesStatusExW.ADVAPI32 ref: 00000001800017D0
malloc.MSVCRT ref: 00000001800017E2
memset.NTDLL ref: 00000001800017FC
EnumServicesStatusExW.ADVAPI32 ref: 0000000180001838
CloseServiceHandle.ADVAPI32 ref: 0000000180001845
free.MSVCRT ref: 000000018000184E
CloseServiceHandle.ADVAPI32 ref: 0000000180001856
lstrcmpiW.KERNEL32 ref: 0000000180001881

Strings

Schedule, xrefs: 0000000180001872

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: mallocmemset$CloseEnumHandleServiceServicesStatusmemcpy$FileManagerModuleNameOpenfreelstrcmpi
String ID: Schedule
API String ID: 3636854120-2739827629
Opcode ID: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction ID: 6ee3f7f16e62e9fbbf62cb728b63543f6f6100922e48a7ada6915e3d38cfd098
Opcode Fuzzy Hash: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction Fuzzy Hash: 84A1AE36705B8886EBA5CB19E4883EDB7A4F78DB94F54D128EE8903755EF38D648C700

Function 00000001800080F2 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
memorynativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000817B
WriteProcessMemory.KERNELBASE ref: 000000018000820C
memset.NTDLL ref: 0000000180008354
memcpy.NTDLL ref: 0000000180008375
NtAlpcConnectPort.NTDLL ref: 00000001800083E7

Strings

0, xrefs: 000000018000828B
Dive right in and make a splash,We're throwing a pool party in a flash!Bring your swimsuits and sunscreen galore,We'll turn up the heat and let the good times pour!, xrefs: 0000000180008315

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: AllocAlpcConnectMemoryPortProcessVirtualWritememcpymemset
String ID: 0$Dive right in and make a splash,We're throwing a pool party in a flash!Bring your swimsuits and sunscreen galore,We'll turn up the heat and let the good times pour!
API String ID: 2322259470-3460289035
Opcode ID: c43cf6f9343ddec1ca79c7315b89c45580cd43461ba35576a3c26a51ac169fb6
Instruction ID: a438414d86da3f9fa76c6e2917a93b97ec5bb287934b9f4f7f73d30ebcaf7dce
Opcode Fuzzy Hash: c43cf6f9343ddec1ca79c7315b89c45580cd43461ba35576a3c26a51ac169fb6
Instruction Fuzzy Hash: 6D713DB5324EC891EBA5CF65E8587DA6362F788798F80A216DE4D07668DF3CC249C700

Function 0000000180009BC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 0000000180009CB9

Strings

@, xrefs: 0000000180009CA1

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 08567cc30074b475b331b46d2cc87d554941ba0be2af3992f720d6e759045faf
Instruction ID: 13e2f726a9112c9c31c995d983c9da114070f7450b087ebba6d3042457f4b947
Opcode Fuzzy Hash: 08567cc30074b475b331b46d2cc87d554941ba0be2af3992f720d6e759045faf
Instruction Fuzzy Hash: 8F41CF32318B9881EB65CF62F854BD67764F788784F519116EE8D43B14DF38C61AC700

Function 0000000180005824 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

realloc.MSVCRT ref: 000000018000587E
NtQuerySystemInformation.NTDLL ref: 00000001800058CD

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: InformationQuerySystemrealloc
String ID:
API String ID: 4089764311-0
Opcode ID: aa0bfc6469bc17d5eeda48fd87731ce22d6874c3ca3fc959c4416cf641374c4d
Instruction ID: b0525076bbbf58c043072cd616ac76dc382e5d39b6996fcf6a95a9be821e6ce1
Opcode Fuzzy Hash: aa0bfc6469bc17d5eeda48fd87731ce22d6874c3ca3fc959c4416cf641374c4d
Instruction Fuzzy Hash: 27015EB632498485FB55CBA6E86839BB362E38CBD4F44E0269E0D47758CE28C1098700

Function 00000001800054D5 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE ref: 000000018000559C

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: de33ea6b4f9ce6d4b4402c8e18623ba837b56d9b22b6662e0c33dbf5e61d8208
Instruction ID: 9c50cbf5d08d3b6d4a605893f6b359a3682b26f1feaf6ace4ca51b493498b96a
Opcode Fuzzy Hash: de33ea6b4f9ce6d4b4402c8e18623ba837b56d9b22b6662e0c33dbf5e61d8208
Instruction Fuzzy Hash: 9211BFB1614B8885FB61CFA5E8187C773A0E38D794F45A116DE4E17B64CF38C209C704

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 000000018000194B
GetModuleFileNameW.KERNEL32 ref: 000000018000195D
wcsstr.NTDLL ref: 000000018000196F
IsUserAnAdmin.SHELL32 ref: 000000018000197A
ExitProcess.KERNEL32 ref: 00000001800019A1

Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800015E5
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 0000000180001609
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 0000000180001613
Part of subcall function 00000001800015B0: memset.NTDLL ref: 0000000180001648
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016A8
Part of subcall function 00000001800015B0: GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800016CD
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016E7
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 00000001800016F5
Part of subcall function 00000001800015B0: OpenSCManagerW.ADVAPI32 ref: 0000000180001789

ExitProcess.KERNEL32 ref: 000000018000198E

Strings

svchost.exe, xrefs: 0000000180001963

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: memset$malloc$ExitFileModuleNameProcessmemcpy$AdminManagerOpenUserwcsstr
String ID: svchost.exe
API String ID: 2075570005-3106260013
Opcode ID: 79fe10d2032a91db138303a6d4bba14be8b863467a7872a6f2e5965e82f79385
Instruction ID: bee279387a080e4ef1cf93fe2260fe9373c10eb3ce040ed65f2ee5617e8a23f3
Opcode Fuzzy Hash: 79fe10d2032a91db138303a6d4bba14be8b863467a7872a6f2e5965e82f79385
Instruction Fuzzy Hash: 87019631310A4C81FBAADB21E4A93DA6360BB8C795F449025A95E46695DF3CC34CC740

Function 000000018000AD3E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000ADC2

Strings

@, xrefs: 000000018000ADAC

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 25e8e2e1e41b46ff06f862ad0091e17087f53469a818b64f494525446fc89b42
Instruction ID: 6b845daad974ccd9c6abd76d61111d535f536517db2d34ef27256cbb8d76cfd7
Opcode Fuzzy Hash: 25e8e2e1e41b46ff06f862ad0091e17087f53469a818b64f494525446fc89b42
Instruction Fuzzy Hash: 7B016DB5729A8C41FBA9CBA1F465BD62360A78DBD4F40A21A9D0E17B55DE2CC2068304

Function 000000018000A9BE Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000000018000AA41

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e550c5f1444e37c0b1477e103827308c662109d29a65ec8f8fad6b41b1961b1e
Instruction ID: 251b8e02f3a2b925dc00676b0f08ae0c6924386de3889a0ff5d432a66f8cfcc3
Opcode Fuzzy Hash: e550c5f1444e37c0b1477e103827308c662109d29a65ec8f8fad6b41b1961b1e
Instruction Fuzzy Hash: 75012CB5619E8C41FBA9CBA1F464BDA6774E78DB94F40A11ADE0E17B51DF28C20AC304

Function 0000000180008E30 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAdjustPrivilege.NTDLL ref: 0000000180008E96

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: AdjustPrivilege
String ID:
API String ID: 3260937286-0
Opcode ID: 0831086ae50f2ba65709bcbf1c33f12cfd0f3053b93a604bdcfa268e10cb0fbc
Instruction ID: 04bb496a426d1b43e6b52f20395e61ae4e41d159ec3593a713d9b4970c529e46
Opcode Fuzzy Hash: 0831086ae50f2ba65709bcbf1c33f12cfd0f3053b93a604bdcfa268e10cb0fbc
Instruction Fuzzy Hash: A5F04F3A334F8C81EBE9DB21E85979667A0B74CB98F41A406ED4D43764CE3DC2158B00

Function 0000000180005A0D Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessId.KERNELBASE ref: 0000000180005A81

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: Process
String ID:
API String ID: 1235230986-0
Opcode ID: d16e56ca8ceffb6996a770eebb8859cff0112ba79151dc499dea6e218c25d2af
Instruction ID: d652ffa87c38ed1c04ac93e0a0d2335ef1528c7a1f19fbd04ef7ff50280f2555
Opcode Fuzzy Hash: d16e56ca8ceffb6996a770eebb8859cff0112ba79151dc499dea6e218c25d2af
Instruction Fuzzy Hash: 0C018BB271490485EB54CB59E4503AB7371F78DBD8F50A122EF4E87764DF29C256C704

Function 000000018000AF22 Relevance: 1.5, APIs: 1, Instructions: 31
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000AF9F

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4492a0bf8fcf8f33afd06441f64975728a7ffe302e5029ee3f64efdc84710f0c
Instruction ID: 56856a108c934b35fd8b12db096080665d1aff2e22ecb35535ebb708edeb7d18
Opcode Fuzzy Hash: 4492a0bf8fcf8f33afd06441f64975728a7ffe302e5029ee3f64efdc84710f0c
Instruction Fuzzy Hash: 9101E8B5319E8891FBA9CB52E898386A362A78DBD0F51D1169D0D47768CE2DC109C304

Function 000000018000A8B2 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000A932

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a9c6a2df7492c35cbc3cd719515342c8cda296547e204cd9f67484ff88ad8695
Instruction ID: 440d9c2e63d84a318507e4d3145013176a8cc7cafd38941c5fd7eab054e276a3
Opcode Fuzzy Hash: a9c6a2df7492c35cbc3cd719515342c8cda296547e204cd9f67484ff88ad8695
Instruction Fuzzy Hash: 4A013CF5319E8881FBA5CB56E898786A762E78EBD4F41D1168D4D0B768CF3DC109C304

Function 000000018000B100 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000000018000B17E

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 35ffae5299d4c335a8ff36bc6453c7f7216bb7ebbfbf3e1d59d74c353a4e1218
Instruction ID: 24c97e1a4b5bf787aa031fe235fe3c6da918f95ea593df74073bd4adbefb4954
Opcode Fuzzy Hash: 35ffae5299d4c335a8ff36bc6453c7f7216bb7ebbfbf3e1d59d74c353a4e1218
Instruction Fuzzy Hash: 73F03CF5329E9981FBA5CB12EC58786A322F789BD4F41E1168D0D4B768CE2DC2098384

Non-executed Functions

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000000018000103C
malloc.MSVCRT ref: 00000001800010C9
memcpy.NTDLL ref: 00000001800010EB
memcpy.NTDLL ref: 0000000180001100
memset.NTDLL ref: 00000001800011B4
wsprintfW.USER32 ref: 00000001800011D5
CreateFileW.KERNEL32 ref: 0000000180001203
GetLastError.KERNEL32 ref: 0000000180001212
WriteFile.KERNEL32 ref: 0000000180001233
GetLastError.KERNEL32 ref: 000000018000123D
CloseHandle.KERNEL32 ref: 0000000180001246
Sleep.KERNEL32 ref: 0000000180001251
memset.NTDLL ref: 0000000180001266
wsprintfW.USER32 ref: 0000000180001287
CreateFileW.KERNEL32 ref: 00000001800012B5
GetLastError.KERNEL32 ref: 00000001800012C4
WriteFile.KERNEL32 ref: 00000001800012E5
GetLastError.KERNEL32 ref: 00000001800012EF
CloseHandle.KERNEL32 ref: 00000001800012F8
Sleep.KERNEL32 ref: 0000000180001303
memset.NTDLL ref: 0000000180001318
wsprintfW.USER32 ref: 0000000180001339
CreateFileW.KERNEL32 ref: 0000000180001367
GetLastError.KERNEL32 ref: 0000000180001376
WriteFile.KERNEL32 ref: 0000000180001393
GetLastError.KERNEL32 ref: 000000018000139D
CloseHandle.KERNEL32 ref: 00000001800013A6
Sleep.KERNEL32 ref: 00000001800013B1
VirtualAlloc.KERNEL32 ref: 00000001800013D4
memcpy.NTDLL ref: 00000001800013F0
CreateThread.KERNEL32 ref: 000000018000140C
VariantInit.OLEAUT32 ref: 0000000180001441
SysAllocString.OLEAUT32 ref: 00000001800014A3
GetLastError.KERNEL32 ref: 00000001800014BE
memset.NTDLL ref: 00000001800014D6
wsprintfW.USER32 ref: 00000001800014F4
memset.NTDLL ref: 000000018000152F
memcpy.NTDLL ref: 0000000180001544
CreateThread.KERNEL32 ref: 0000000180001562

Strings

\Microsoft\Windows, xrefs: 000000018000149C
%s\%s, xrefs: 00000001800011C7, 0000000180001279, 000000018000132B, 00000001800014E9

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: ErrorLast$File$Creatememset$memcpywsprintf$CloseHandleSleepWrite$AllocThreadmalloc$InitStringVariantVirtual
String ID: %s\%s$\Microsoft\Windows
API String ID: 1085075972-4137575348
Opcode ID: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction ID: ca852493329d7e8b29278f03f5207e3e8a0b6c409a20f5d7edd43a4be3d27a44
Opcode Fuzzy Hash: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction Fuzzy Hash: 4DF18A32610F8985F7A6CF24E8087DD33A0F78DBA8F449215EE9A17694EF38C249C700

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 0000000180001A3B
CLSIDFromString.OLE32 ref: 0000000180001CFA
IIDFromString.OLE32 ref: 0000000180001D0D
CoCreateInstance.OLE32 ref: 0000000180001D2C

Strings

\:[:, xrefs: 0000000180001B9B
Y:\:, xrefs: 0000000180001AD8
\:^:, xrefs: 0000000180001C4D
X:^:, xrefs: 0000000180001AE8
Y::, xrefs: 0000000180001C46
:, xrefs: 0000000180001CA0
A::, xrefs: 0000000180001A4F
X:[:, xrefs: 0000000180001BAA
^:G:, xrefs: 0000000180001B44
:_:, xrefs: 0000000180001AF0
:Y:, xrefs: 0000000180001C3F

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: FromString$CreateInitializeInstance
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 511945936-2205580742
Opcode ID: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction ID: 28b9f900473ef5d70d4cda544e42fab565c9dc4f26e78512e927f69b0d8a042f
Opcode Fuzzy Hash: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction Fuzzy Hash: 0291FD73D18BD4CAE311CF7994016EDBB70F799348F14A249EB946A919EB78E684CF00

Function 0000000180001D60 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000180001DA5
SysAllocString.OLEAUT32 ref: 0000000180001DE4
SysAllocString.OLEAUT32 ref: 0000000180001DF0
IIDFromString.OLE32 ref: 0000000180001F31
SysAllocString.OLEAUT32 ref: 0000000180001F61
SysAllocString.OLEAUT32 ref: 0000000180001F71
VariantInit.OLEAUT32 ref: 0000000180001FEA
SysAllocString.OLEAUT32 ref: 0000000180001FF7

Strings

{4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}, xrefs: 0000000180001F26
SYSTEM, xrefs: 0000000180001DD9

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: String$Alloc$FromInitVariant
String ID: SYSTEM${4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}
API String ID: 929278495-107290059
Opcode ID: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction ID: 371f9a688604c33e3b5ae190077701ce0554801126743d20ac49bde758192535
Opcode Fuzzy Hash: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction Fuzzy Hash: E5B1C236B00B558AEB40DF6AD88829D77B1FB88FA9F559016DE0E57B28DF35C189C300

Function 0000000180028464 Relevance: 14.7, APIs: 9, Instructions: 1208COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00000001800284AD
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028AB8
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028C7B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180028E82
_invalid_parameter_noinfo.LIBCMT ref: 0000000180029146
_invalid_parameter_noinfo.LIBCMT ref: 0000000180029341
memcpy_s.LIBCPMT ref: 000000018002942F
memcpy_s.LIBCPMT ref: 00000001800294DA
memcpy_s.LIBCPMT ref: 00000001800295A3

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID:
API String ID: 808467561-0
Opcode ID: e6e2a47d0b7aca8797bf2f78af511f090b7de726a253ea606c4e540f123b5b7a
Instruction ID: 4599084cfb13f8c747939fbc3aba35a6bd4e8a08bbcc0f0b71949d4f47730483
Opcode Fuzzy Hash: e6e2a47d0b7aca8797bf2f78af511f090b7de726a253ea606c4e540f123b5b7a
Instruction Fuzzy Hash: 5FB2E0766022998BE7A7CE69D544BED37A5F78C3C8F509125EA0657B88DF34CB48CB00

Function 0000000180007550 Relevance: 9.2, Strings: 7, Instructions: 485COMMON

Download Yara Rule

Strings

?Vse4", xrefs: 000000018000759B
TpAllocAlpcCompletion, xrefs: 0000000180007A0A
\RPC Control\, xrefs: 0000000180007729
NtAlpcCreatePort, xrefs: 00000001800078E1
NtAlpcConnectPort, xrefs: 0000000180007C5F
NtAlpcSetInformation, xrefs: 0000000180007B33
ntdll.dll, xrefs: 000000018000780A

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: ?Vse4"$NtAlpcConnectPort$NtAlpcCreatePort$NtAlpcSetInformation$TpAllocAlpcCompletion$\RPC Control\$ntdll.dll
API String ID: 0-3440571002
Opcode ID: 3e7f587f86fd0b2bf1a8a0d1d2c8b2dcce1149cee181315916f08b714af195f2
Instruction ID: 8c3100648684ed6cf3a6acba9f1e9974d33f54458c7afc613a7cd7d66638faa8
Opcode Fuzzy Hash: 3e7f587f86fd0b2bf1a8a0d1d2c8b2dcce1149cee181315916f08b714af195f2
Instruction Fuzzy Hash: 53124DF5720E9891EF94CBB9E8687C66362F78D798F81A117DE0D57624DE38C20AC700

Function 0000000180016D88 Relevance: 7.0, Strings: 5, Instructions: 783COMMON

Download Yara Rule

Strings

__swift_1, xrefs: 0000000180017D10
call, xrefs: 0000000180016FE8
__restrict, xrefs: 0000000180017B37
__swift_2, xrefs: 0000000180017D34
__unaligned, xrefs: 0000000180017A1E

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: ExceptionThrow
String ID: __restrict$__swift_1$__swift_2$__unaligned$call
API String ID: 432778473-3141380587
Opcode ID: 6a396b12831feff5c6f80a323355d14ea9fae3a8da964f50d645d654625ebbdc
Instruction ID: 673e966dcc0d85f334313fac89718d38bf41ed5ef13417959e8c730922fdb805
Opcode Fuzzy Hash: 6a396b12831feff5c6f80a323355d14ea9fae3a8da964f50d645d654625ebbdc
Instruction Fuzzy Hash: 5C627E72701E8882EB86EB25D4583DD27A1FB8EBD4F408125FA5E577A6DF38C649C700

Function 0000000180023B98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180023BFC

Strings

gfffffff, xrefs: 0000000180023E99

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: 7c5b9028af6473dd728daef05391e74bafcea77e80a4e195b251d3550d854208
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: 869145767057CC86EF97CB2AE4013EDABA5A758BC4F06C022EA5947395DE3DC60AC701

Function 0000000180003DBC Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

WinSta0\Default, xrefs: 000000018000409C
C:\windows\system32\, xrefs: 0000000180003F43
C:\windows\, xrefs: 00000001800040A8
taskmgr.exe, xrefs: 0000000180003F94

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: C:\windows\$C:\windows\system32\$WinSta0\Default$taskmgr.exe
API String ID: 0-638001070
Opcode ID: 3c7d1f0fb87f662b2079bad57b09a5afaa48cb8c83d5525282594a227a335d39
Instruction ID: 1bf4e9e1e70513e3816d114cab4aa84c7a719184b3830627372934e1f9606700
Opcode Fuzzy Hash: 3c7d1f0fb87f662b2079bad57b09a5afaa48cb8c83d5525282594a227a335d39
Instruction Fuzzy Hash: 0C8127F5324E9982EF95CBA8F8697D66322F7897D8F80A112CD1E57624DE38D209C704

Function 0000000180003AE0 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

WinSta0\Default, xrefs: 0000000180003C39
C:\windows\system32\, xrefs: 0000000180003B90
winver.exe, xrefs: 0000000180003BE1
C:\windows\, xrefs: 0000000180003C45

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: C:\windows\$C:\windows\system32\$WinSta0\Default$winver.exe
API String ID: 0-1160837885
Opcode ID: 1308d712bd6591429a8d37c48bbd1829232a434116c75b441977ccfa919fa798
Instruction ID: 55855d67a1f766f1614c6ad6b77d44964cb4204ffe99e224a87b86ff19b563fd
Opcode Fuzzy Hash: 1308d712bd6591429a8d37c48bbd1829232a434116c75b441977ccfa919fa798
Instruction Fuzzy Hash: C841A4B5324E9882FF55CB69F8687966322F789BD8F40A116CD5E4B764DE3CC20AC704

Function 0000000180028038 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018002809E
memcpy_s.LIBCPMT ref: 00000001800280C9

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction ID: 57088630f82899a46a4f04304140a90d468cb093ad556e4d18a7d8c59b71a2f9
Opcode Fuzzy Hash: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction Fuzzy Hash: 5EC1387671628987EB66CF19E044B9EB791F7987C4F44C125EB4A43B84DB38EA09DB00

Function 000000018001FED8 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00000001800200A7
ko-KR, xrefs: 000000018001FEEC

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$ko-KR
API String ID: 3215553584-2196303776
Opcode ID: f96d09346a2f6e77d59369c2194a8b950e6b78dbaa0c336e0d12ce098f52cc8c
Instruction ID: 454ebc8193fa5ca865f8f1965dd2a4e4b4682b0a5584ee5ea9980d899769f2f6
Opcode Fuzzy Hash: f96d09346a2f6e77d59369c2194a8b950e6b78dbaa0c336e0d12ce098f52cc8c
Instruction Fuzzy Hash: 3A71D33521070D82FBFB9A1990807E963A1E74D7C4FA4D126BE49437ABCF35CA4B9705

Function 0000000180003220 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

0, xrefs: 0000000180003282
p, xrefs: 00000001800032F3

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: 0$p
API String ID: 0-2059906072
Opcode ID: e7e5a160b0dc7bf11acf6e058a7a07693b04e0544c402e7120b811fb21f28438
Instruction ID: 3ee67f828506e40d833cc10e170725f94807106ad1cab914bfb00022e22d59fe
Opcode Fuzzy Hash: e7e5a160b0dc7bf11acf6e058a7a07693b04e0544c402e7120b811fb21f28438
Instruction Fuzzy Hash: A731F075605E9D81EB55DF56E894BD62321F388BD8F42A212ED4E0BB24EE3CC15AC700

Function 0000000180024EB0 Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024EF9

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9a675805437782ecf3217d5187c311e375e8358acccf04f95891004c6cc889dd
Instruction ID: 1f61cd1c6d9a0cc47e5c3170d1c15f4e9de5b8ae94a737795fa3a990e1df4aaf
Opcode Fuzzy Hash: 9a675805437782ecf3217d5187c311e375e8358acccf04f95891004c6cc889dd
Instruction Fuzzy Hash: 0BA1E67231069881EBA3DB66A8047DAA3A0F78DBD4F549526FE9D07BC4DF78C64D8304

Function 000000018002C080 Relevance: 1.7, APIs: 1, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000018002C2CF

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 0e21b991dae342f80746e460734db2b0327f033799438967f91080e093b168d9
Instruction ID: 0593f73a9b31075b8e6bf2cb9e383320a294c5aeb291d1da762f6cdddc12ea76
Opcode Fuzzy Hash: 0e21b991dae342f80746e460734db2b0327f033799438967f91080e093b168d9
Instruction Fuzzy Hash: 10B12B73600B88CBEB56CF29C88679C77A0F349B88F19C916EB59877A8CB35C955C701

Function 0000000180010F18 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

l section in CAtlBaseModule, xrefs: 0000000180010FB7

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: ExceptionThrow
String ID: l section in CAtlBaseModule
API String ID: 432778473-2709337986
Opcode ID: a127ccbb264a5a4aec1e8b8c97d9fa5e153886bac66a3a6cc8a19aedac249b0e
Instruction ID: 3133a5dfd5f79aac6ce2c53f471fbcfe22b2aa6c2a7d5a5a984ae032cb248d46
Opcode Fuzzy Hash: a127ccbb264a5a4aec1e8b8c97d9fa5e153886bac66a3a6cc8a19aedac249b0e
Instruction Fuzzy Hash: 23027C36600E8886EB96DF25E8443DD73A1FB8DBD5F448526EA4E43BA4DF38C648C700

Function 00000001800180EE Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

__restrict, xrefs: 00000001800183C3

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: __restrict
API String ID: 0-803856930
Opcode ID: 5745e3cfed15ffb7b3e2fa7717aad80a57a6249b3a0910dbd319ea413861beba
Instruction ID: 2a1f3f8c5416bf1435224dd1e95b651f0a407b08188742a7ac323c2b5a68232f
Opcode Fuzzy Hash: 5745e3cfed15ffb7b3e2fa7717aad80a57a6249b3a0910dbd319ea413861beba
Instruction Fuzzy Hash: DAF15936601F4886EB928F65D8543DC73A5EB8DBC8F548526FE0E47BA4DE78CB498340

Function 000000018001FC0C Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 000000018001FDDB

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 5f4ddedfd77a8f2be46d5b27c9f7dfb0d5136d7c17e53cee70af679ad4ba4177
Instruction ID: 71f2418fc044250fc616a08c0bb954c8cfb89a1255eab9d4a98bc77a135e3a3b
Opcode Fuzzy Hash: 5f4ddedfd77a8f2be46d5b27c9f7dfb0d5136d7c17e53cee70af679ad4ba4177
Instruction Fuzzy Hash: 5871E235210A0D82FBFB9A29A0407F92392E7487C4F94D016BE46577EACF35CA4B9745

Function 0000000180002C8A Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

201ef99a-7fa0-444c-9399-19ba84f12a1a, xrefs: 0000000180002DAE

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: 201ef99a-7fa0-444c-9399-19ba84f12a1a
API String ID: 0-3963691810
Opcode ID: 305143c906e545cbbdba88b15ed8d96aa5c5b1023b370279aab489ed2de4cf70
Instruction ID: f859e3b1c76c282179c02603d62779a177e542a7d14e57d8a75f66858979eba8
Opcode Fuzzy Hash: 305143c906e545cbbdba88b15ed8d96aa5c5b1023b370279aab489ed2de4cf70
Instruction Fuzzy Hash: A54153B1715B9D46EF89CB78D9653A62322FB8C7ACF40A516C90E47765DE38C209C300

Function 0000000180002526 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

ncalrpc, xrefs: 00000001800025DE

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: ncalrpc
API String ID: 0-2983622238
Opcode ID: 8e139b6873f62461d47cfb06735ed223aa3699eae5bf13dfab6a051279dd2f2d
Instruction ID: 72ca54434e2e545ad87ad6f85711ca4f80c48705b1af1cf0b8a8e1738ac29a0d
Opcode Fuzzy Hash: 8e139b6873f62461d47cfb06735ed223aa3699eae5bf13dfab6a051279dd2f2d
Instruction Fuzzy Hash: 99312FB1721A6952EF49CF78E8687966762F79C794F91E522CE0E4B624DE3CC209C700

Function 0000000180014848 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e631ec45a2daf68f48d52614a6345ed429c570a616f22469c908a5fe8b28b5b
Instruction ID: 6d80879f2b6ca484a565809d41c0eb2dabc8ae21e66747f9efe079bfb1bd8c10
Opcode Fuzzy Hash: 3e631ec45a2daf68f48d52614a6345ed429c570a616f22469c908a5fe8b28b5b
Instruction Fuzzy Hash: DA22D177310AA882EB46DB65C0547AC33B6FB48B84F028116FB599B7B1DF38D668C354

Function 000000018000DEE8 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1622125fadd830d72695094e7b85cc31ec002336933b0e724cad098e10e2d7b0
Instruction ID: 946e0dd2bba7b3100fd246393857d7d015b19ff97fe3a12f1d34a5a40530aed8
Opcode Fuzzy Hash: 1622125fadd830d72695094e7b85cc31ec002336933b0e724cad098e10e2d7b0
Instruction Fuzzy Hash: E4E181722046C986EBB2CB15E8943E977A1F78E7D4F84C121EA8A936D5DF78C64DC700

Function 0000000180029E8C Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe71d8e7cd50308ca462f153a194306955503b02d46b76410196ab8a6e65239
Instruction ID: c02e86e1f92cc5576d6cd232989999bceb531278b49536794b781076c4770d9c
Opcode Fuzzy Hash: cfe71d8e7cd50308ca462f153a194306955503b02d46b76410196ab8a6e65239
Instruction Fuzzy Hash: BFE1D032708A848AE793CF68E5803DD77B1F74A7D8F548116EA4E57B99DE38C25AC700

Function 00000001800151E8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ae51d95b1815005dd45d5e3ab8a349bfdaaf9539e2a3891bf7a9a4281af68b
Instruction ID: 207e761d23252ea67ff1337872d1fa257f2b4668b6d9f4a23401ae9418e5b291
Opcode Fuzzy Hash: 16ae51d95b1815005dd45d5e3ab8a349bfdaaf9539e2a3891bf7a9a4281af68b
Instruction Fuzzy Hash: AFB1AB72A10B8886E352CF39D8457DC37A4F389B88F519216EE4D17B66DF35D689CB00

Function 00000001800069E0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86f20f7f5deea267c01afef8e7a4c05c31875faa151d310fea3b18ea46ae3c1
Instruction ID: 30b487c4dbfd5edb157edb9dd0446cf9089909246d75a709a71c41256c183c41
Opcode Fuzzy Hash: a86f20f7f5deea267c01afef8e7a4c05c31875faa151d310fea3b18ea46ae3c1
Instruction Fuzzy Hash: 4F410672B10A5886EB14CF64F815B9AB3A8F788794F505025DF8E47B68EF3CC156C700

Function 000000018000469C Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfda2f7c180109932206dffacf20a53aef2a56dc1179a3e9a6f89e125c1a26ad
Instruction ID: 6a73b4ca67aa358b5cca9cf8f50e7addbf38a80432c4fb2377473208703d20e7
Opcode Fuzzy Hash: bfda2f7c180109932206dffacf20a53aef2a56dc1179a3e9a6f89e125c1a26ad
Instruction Fuzzy Hash: 645126E9654B9982EF94DBA9F8693D62322FB497D8F80F112CE1E57724DD38D209C304

Function 00000001800096E0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073128fd360148c17e41ec35af6a18c2df5ced6b4e463a8a16fec66cb74d860e
Instruction ID: b6fa69fb7e3d6089a58b1dc0a55349c666dd73e1d328c0310e1d9ae523244059
Opcode Fuzzy Hash: 073128fd360148c17e41ec35af6a18c2df5ced6b4e463a8a16fec66cb74d860e
Instruction Fuzzy Hash: A351CF32715F8896EB64CB65F94478A73A5F7887C4F54412AEA8E83B28EF3CD119C700

Function 0000000180008EC0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1111058f7c16aa1c110f3b5979ca66c856bb8bda45b3eaebbbd55d773fd606
Instruction ID: 9937fe3f73516922539d469a7d9b5dbd200fa43091dfd9594953e81ca0841af9
Opcode Fuzzy Hash: de1111058f7c16aa1c110f3b5979ca66c856bb8bda45b3eaebbbd55d773fd606
Instruction Fuzzy Hash: 7F51C2B5760E9982EB64CF65E8687D66321FB89BD4F44E126DE0E57B24DE3CC11AC300

Function 0000000180021F44 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53c239ed1f9684605d2ef346be0b8bf89de5d156fdc40e0d799da5887b65061
Instruction ID: 211af31c44281ca6c3f3932d9a28d26ed70725301ca9e5a4bb4aa04c7d8998f6
Opcode Fuzzy Hash: a53c239ed1f9684605d2ef346be0b8bf89de5d156fdc40e0d799da5887b65061
Instruction Fuzzy Hash: 25419232310A5886EB85CF6AE954399A391E34CFD4F49D427EE4D97B58DE3CC649C300

Function 000000018000B1AC Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68527aba035480757e2393879a0d4de352a47f6bf703ed5fa56455fc597868c2
Instruction ID: 9b73b6c5183f860324fa61cee2baeb0ca0f8f8b507aed4a99a4e0eda6c344d24
Opcode Fuzzy Hash: 68527aba035480757e2393879a0d4de352a47f6bf703ed5fa56455fc597868c2
Instruction Fuzzy Hash: 984103B3714E4995EB25CF61E86478AB3A5F3887D8F44E126EE4D07A58DF38C246C300

Function 000000018001AA6C Relevance: .1, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaae997217fc1b3336f25de6e62d34e0746f7d3c2a6a256d0b5f71472e0a0425
Instruction ID: 048e6db2ecfd184872977d7eb727c5e493510e05d032e6f18c4ab6865a9947bf
Opcode Fuzzy Hash: eaae997217fc1b3336f25de6e62d34e0746f7d3c2a6a256d0b5f71472e0a0425
Instruction Fuzzy Hash: B341B37261C6888AF7EB8F15B4847967B91E34E3D0F11C429F94A87691DF79C6888F00

Function 0000000180006AB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59276b993bbd5f607d6d3a9a9acf607f8ad274a0d99c33aa421d3a75b3b8979b
Instruction ID: ea9816badbe891c07a2aded6d1ec92d5857af46983f2473552b7590bc608b90a
Opcode Fuzzy Hash: 59276b993bbd5f607d6d3a9a9acf607f8ad274a0d99c33aa421d3a75b3b8979b
Instruction Fuzzy Hash: 24419D76B20A8886EB14CB65F45479AB365F38CBC4F40912ADE4E53B68DE3CC216C740

Function 000000018000C2D0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a4f3e3c3f40ea96cedb268f2507c4aa92d7cf089ba266e7691892548829ecb
Instruction ID: ff810da637aa1fd401c95da2c6d69315e604f84d2d111450c1a2a7c20e68e2a5
Opcode Fuzzy Hash: f3a4f3e3c3f40ea96cedb268f2507c4aa92d7cf089ba266e7691892548829ecb
Instruction Fuzzy Hash: B941FFB2318F89D6DB54CFA5E4A579A7B61F388788F84901ADE4E47A14DF38C12AC340

Function 000000018000C6F0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7caa211d1805da3631b5417297298fbd746491c9ff13b9b06d3acbe089dc0ae
Instruction ID: 1f6bebfb10a220892d2831274fb9d9e41c253fa787b11ea253d3ff134c5c468f
Opcode Fuzzy Hash: a7caa211d1805da3631b5417297298fbd746491c9ff13b9b06d3acbe089dc0ae
Instruction Fuzzy Hash: FF419FB2214F88D2EB54CF55E88478AB7A6F3447C4F94D126EE8D5BA18CF78C15AC740

Function 000000018000BEB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc054b22e393740934c6599b1190f187be60ae239c821f3ddf288e380813183
Instruction ID: d558cfae5a731fffe16df58c07b62597b32ae423ecf54f032ed4b289fbb168ab
Opcode Fuzzy Hash: 9dc054b22e393740934c6599b1190f187be60ae239c821f3ddf288e380813183
Instruction Fuzzy Hash: 4041D3B2324E4DD2DF48CB15E454B9A7365F748BC8F658216DA4E87768EF39C21AC700

Function 000000018000B620 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711a5f6cc3d39d5f0aef55b7034a878137727931ce5006779a437fec81a29920
Instruction ID: c4b80034388e89da8ffe7b427c8155ba048d36e5b74cf413b7ce4096cc0294b9
Opcode Fuzzy Hash: 711a5f6cc3d39d5f0aef55b7034a878137727931ce5006779a437fec81a29920
Instruction Fuzzy Hash: AC4126B2728E48A2DB14CF25E69878E7762F3443C4F45A206EE4E57328DF39C225C700

Function 000000018000C370 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02ea177d7df7be9d47921f817159e6b389a93a74e3aee8d1a395a9d44e4e98a
Instruction ID: 30f2c0aa2bc627d33595a3753288768bcaf23473739ac437f1ff85fbf168e941
Opcode Fuzzy Hash: c02ea177d7df7be9d47921f817159e6b389a93a74e3aee8d1a395a9d44e4e98a
Instruction Fuzzy Hash: FA31CFB2764E8987EB94CFA4E4657EA3B21F384398F84911BDE4F47A14DE68C01AC341

Function 000000018000435B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43f2c2cbd10ab131c97a87bfb9a8d77e076664a556218998fa3f3ff93ba8f25
Instruction ID: 42c4d16a0e0d136c5a94160c46d85d5892129638e54f14ca30ac4ff8e229c4e5
Opcode Fuzzy Hash: c43f2c2cbd10ab131c97a87bfb9a8d77e076664a556218998fa3f3ff93ba8f25
Instruction Fuzzy Hash: 65310DF9654B9892EB55DBB8F8697C62322F74D7D8F81B502CE0E27624DE38D209C740

Function 000000018000947B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bce6376752d693395b932a5d9318ffbe6d4c9bed5557d96fc3b5228a6ed1993
Instruction ID: 91db3ca7ca736f51b2b9f4a1fdda40ff6b442f2c49d3b76bc6f7bd54feb42801
Opcode Fuzzy Hash: 2bce6376752d693395b932a5d9318ffbe6d4c9bed5557d96fc3b5228a6ed1993
Instruction Fuzzy Hash: 2531FBB5314E8481EF99CF66ECA93A66362FB88BE4F54E1168E0F57B64CE3DC1458304

Function 0000000180004153 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c12f5db1e7ae7d88fc0262756b9d0bf6622ca984ac394aaf837a3336d7d9a4
Instruction ID: b9540b73c02fa2fd8fd9ed4b04a7558bae6bb2522907684b3f8178f982c6447f
Opcode Fuzzy Hash: 11c12f5db1e7ae7d88fc0262756b9d0bf6622ca984ac394aaf837a3336d7d9a4
Instruction Fuzzy Hash: 3F215EF53159A882EB95CF65E8787972322FB49BD8F81E112CD1E57764DE38C209C304

Function 000000018000B280 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74b49f80d6d3cffa9bfb68b489edd80f871d1e69f348bd9d5bedd62bb40d514
Instruction ID: 34ebe62695f2a6a6ea2397927167a92a4784dc70ec7df40509b9419055f8788e
Opcode Fuzzy Hash: e74b49f80d6d3cffa9bfb68b489edd80f871d1e69f348bd9d5bedd62bb40d514
Instruction Fuzzy Hash: 7D31C1F6715A499AEB14CF60E46478AB3A5F3447C8F48E226EA4E47A1CDF78C219C304

Function 0000000180004CB0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ed0da8da41128ee95df92606b628508953cd21a2e597ae56ff743980468b27
Instruction ID: ea228047f8abccb8f34d8cb69d0855da280cee6fe6b78123f25de321abaee775
Opcode Fuzzy Hash: 29ed0da8da41128ee95df92606b628508953cd21a2e597ae56ff743980468b27
Instruction Fuzzy Hash: BD2101B2724E8885EB95CF62E828B9A7361F38CBD4F419126DE4E47B54CE3CC10AC700

Function 0000000180006F70 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659e1158283c071cac0272366369d00d1cfa562a966f2f5affa459bf10e8deba
Instruction ID: 6d7058e35041f85eefca8006119c3596d2fa62747ef7dd2be534be946fff4e46
Opcode Fuzzy Hash: 659e1158283c071cac0272366369d00d1cfa562a966f2f5affa459bf10e8deba
Instruction Fuzzy Hash: BB21D5B2764E5892DB59CFB6E864BC63761E759BD4F40A116EE0D57324EE38CA06C300

Function 000000018000B6C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879b8cc6a287b552be2b8c7838c9cf5361018535551b3c5eae2337da7c2a05c9
Instruction ID: 64e956f36281cdf23b4cab459502cafc9c3b83219f603c2a53f066b43bdf7739
Opcode Fuzzy Hash: 879b8cc6a287b552be2b8c7838c9cf5361018535551b3c5eae2337da7c2a05c9
Instruction Fuzzy Hash: 9931A2B2724A49A6DB15CF64D25878E7B62F3443D8F49A206DB0E57628EF39C16AC700

Function 0000000180003833 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7643b34bb1144c09516ca8224fed32c138a04b2f755b136cd71388444af2efbb
Instruction ID: 8007ea01a93bf6de8c95f9a16faa5e8d6c04bd6e38d315922757046993a1328b
Opcode Fuzzy Hash: 7643b34bb1144c09516ca8224fed32c138a04b2f755b136cd71388444af2efbb
Instruction Fuzzy Hash: 5F2148F5761EA982EB89CFB5E86979A2321E749BD8F41A112CD0E17724DE2CD6098300

Function 0000000180002666 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c104ebe3e0084b9c2d6c68d3b1b1809b1ba36be3a0ef8b7a361271054a232770
Instruction ID: baf3eb62263214422a0973d769ae56c08939dd68f110effc1bb9cb03c9f86de4
Opcode Fuzzy Hash: c104ebe3e0084b9c2d6c68d3b1b1809b1ba36be3a0ef8b7a361271054a232770
Instruction Fuzzy Hash: CE2159F5720AA892EB85CFB4E468BD627A1F74C3A4F81A413DE0D47620EE39C209C300

Function 00000001800044C1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d83384389e1bc3f5c40116a0a1417798e316c1697b6e029db620e488cbd2b1f
Instruction ID: 7d1135aa24797edbf35de8feb47ffd13e3235087d5b84f893e072cfd3e31e24b
Opcode Fuzzy Hash: 5d83384389e1bc3f5c40116a0a1417798e316c1697b6e029db620e488cbd2b1f
Instruction Fuzzy Hash: D1118EA271498C46FB96DBB4F969BD76322EB4C3A9F80A012DD0D07A55DD3CC24AC700

Function 0000000180002A19 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0213aaa7a16af12e76c05f13803a6cb1816da3aa76317169f32ff85a43e83aea
Instruction ID: 95480194bb9f6c9ad9d964584a4fad66eb43ce3f3ee230db89eb3e49904c33dd
Opcode Fuzzy Hash: 0213aaa7a16af12e76c05f13803a6cb1816da3aa76317169f32ff85a43e83aea
Instruction Fuzzy Hash: 56210BF2711A5D92EB49DF75D868BD667A2E78CBD4F41E512CD0E5B624DE3CC2098300

Function 0000000180003717 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f85260008f1cca6d719552e34a0840437b2decd6b2aec5b8999dc0ce01bbffe
Instruction ID: 02ba138fbc53fc0a7e206b6c0fccc1f4cb11f22df8a79a790e142c2087e4c986
Opcode Fuzzy Hash: 3f85260008f1cca6d719552e34a0840437b2decd6b2aec5b8999dc0ce01bbffe
Instruction Fuzzy Hash: 48213BB6761A5DC5EF49DF65E868B8A6721F788BD8F41A122CD0E47728DE3CD209C700

Function 000000018000290C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803c451430e3029bb009500dace81e7bc3217c3b4584f2ef31f91a53a698693d
Instruction ID: 4519c20df033b0754d584584f46a47e9c3f61284702b1b178af72c485ed47193
Opcode Fuzzy Hash: 803c451430e3029bb009500dace81e7bc3217c3b4584f2ef31f91a53a698693d
Instruction Fuzzy Hash: E02160F5714F8482EB45CBB5E8593CA63B1FB897A4F40A506DA4E57A24EE3CD20AC700

Function 0000000180002170 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566796d93a591df3f5db1c38c43d6e1f2c58bb1bf9c844d883f4a478785d6911
Instruction ID: bc53908923a101081ac78a2ff91d1596a8a62396a49556bd27b6b69a29ae519e
Opcode Fuzzy Hash: 566796d93a591df3f5db1c38c43d6e1f2c58bb1bf9c844d883f4a478785d6911
Instruction Fuzzy Hash: 6511E3E262096C82FB59DFA6A869F862332E349BD8F01E123DD5E5B714DD39C10BC300

Function 000000018000360B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a56065663d7f32470598edd8e4c56aa3322786b1e37be48fd2162c7dda414fd
Instruction ID: 8fbfe2caa4e00eb4ae2a73ae29cd16ebba4a4082f14f5113274d96e794981e6d
Opcode Fuzzy Hash: 3a56065663d7f32470598edd8e4c56aa3322786b1e37be48fd2162c7dda414fd
Instruction Fuzzy Hash: 0721A4B2709A9882EB55CF64E4687977761FB8C798F41A116DE4E47A14EF3DC109C700

Function 00000001800045A9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de039b8aeb4dd7a341e305cb49e7d4a566f2f03f9a363aa92138b342856feec
Instruction ID: 9e59c1c7de84271de07ddad5238888e61d5fae15b8e3d2a62c0818bf1ca1a5d9
Opcode Fuzzy Hash: 4de039b8aeb4dd7a341e305cb49e7d4a566f2f03f9a363aa92138b342856feec
Instruction Fuzzy Hash: 2F1151B5714E9882EB54CB74E46839A6361F7887B8F80A316C92E576E4DF39C10AC744

Function 0000000180002777 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00286fc56aac180519fed44c3472dbbed5625b745e2bf1041001a8241787df3
Instruction ID: 453c13d840d8ab8480c25eabad8a5a4e6cf22c2320a7064174f112572a8564ab
Opcode Fuzzy Hash: b00286fc56aac180519fed44c3472dbbed5625b745e2bf1041001a8241787df3
Instruction Fuzzy Hash: 8E113CE171196846FF89CF65D9697665393EB8C7E4F81E426CE0E8B768ED3CC1098304

Function 000000018000225E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6f47147aee9d0c5d2e3a57a73bf876d140cefaec2fbc1aba1964aca6a06b7c
Instruction ID: dcb26d1462b17352493136ca1a284502f5bdb4a1f8be4333a819d013a470b478
Opcode Fuzzy Hash: 3e6f47147aee9d0c5d2e3a57a73bf876d140cefaec2fbc1aba1964aca6a06b7c
Instruction Fuzzy Hash: 3311C2B6624A9E42E709DFF4B424FCA3771E389750F00B517DE4A53510DE38C21AC300

Function 000000018000284D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8879920a56ce6d951eaa2299e71384d51284fb55c40a98b48f618b07d76cb7
Instruction ID: 1bcc190078e11d5e3502c0fb8cfdf52a8957de65a2b1b8071e9e04ba3849ecfd
Opcode Fuzzy Hash: 0e8879920a56ce6d951eaa2299e71384d51284fb55c40a98b48f618b07d76cb7
Instruction Fuzzy Hash: 9D1100F5721E9841FB49CB75D4683D66362E788794F80A917CA0F57664DD39C2498340

Function 0000000180003CF2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fa84bd9608fd1e2ded7a46ac84a71bf4807f0703b11cbbff9e650931e748d0
Instruction ID: 81b86e7094c320bcc5e7f926c263843823ab5f04b050e6f3beb40bfc522f2c83
Opcode Fuzzy Hash: 62fa84bd9608fd1e2ded7a46ac84a71bf4807f0703b11cbbff9e650931e748d0
Instruction Fuzzy Hash: 4F114FB5614E9882EB54CB78F4687DA6321F78C798F80B113CD0E57625EE39C21AC340

Function 0000000180003530 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169374a88c9bc48999de202173db2c687a39263e6fb74efa0de97639e935559a
Instruction ID: 58ab01e0f729e006e025e3cd5db47f1a357a7dbbf023e6ea43b04656e7f2b6d0
Opcode Fuzzy Hash: 169374a88c9bc48999de202173db2c687a39263e6fb74efa0de97639e935559a
Instruction Fuzzy Hash: 6A113DB1715E6881EB59CF65E9587866362F74C798F82E122CC4E47728EE39C248C700

Function 0000000180002A06 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6214b3987fdb11ae9af8bb44ed0752c7393761a47505b246c2a752352195c6b7
Instruction ID: 246bc5305b8913a4d01db227893256f8bf5d597bde7be6eae501e461eb4fa0bc
Opcode Fuzzy Hash: 6214b3987fdb11ae9af8bb44ed0752c7393761a47505b246c2a752352195c6b7
Instruction Fuzzy Hash: A4113CB2711E5C91EB49CF25E868B9A67A1F78CB94F41E526DE0E47768DE3CC209C300

Function 0000000180003464 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a304966c8f6e6c63f3b4d1dc84eaa042215815f68f4f7ed99f7cad32e1286f1
Instruction ID: 91f1bf17694832eb7885352137df2ae2a0c82d5e88c9f87b3bad460dc89f63f9
Opcode Fuzzy Hash: 7a304966c8f6e6c63f3b4d1dc84eaa042215815f68f4f7ed99f7cad32e1286f1
Instruction Fuzzy Hash: 451169F531286D82EB89CF65E929B865322E7487D8F82F112CC0E4B718ED39D109C700

Function 0000000180005E58 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214099cfcd0ee3826ed9ef66e5b675abfeddc10177d1ca11de6341e968b0d06b
Instruction ID: 39990edd012c80a11a8c246ade81e0b00b1fb03419df7482220b1a2638345046
Opcode Fuzzy Hash: 214099cfcd0ee3826ed9ef66e5b675abfeddc10177d1ca11de6341e968b0d06b
Instruction Fuzzy Hash: 7E11A5F1330A8886FB95CBB5E8683DA6361E78D7D4F84B012CE0E47765CE28C20AC304

Function 0000000180003880 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcce50d7d365edf9bc1dcf0723df82f9ff79db8457ccb87dc38c7b0742b08610
Instruction ID: 15f0b12e67b83b815c9156cfa897ef3110cdd404d207d48cd89176b21f2d8fa0
Opcode Fuzzy Hash: dcce50d7d365edf9bc1dcf0723df82f9ff79db8457ccb87dc38c7b0742b08610
Instruction Fuzzy Hash: 06015EB5751E6D82EB89DF75E4697DA2320EB48B94F82B512CC0E57320ED3CDA0AC300

Function 0000000180002E24 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f73bb3cb6f5cf5abec075b9014cb563e06a4567c89c5d20f7171c5a4b410b69
Instruction ID: 22dcafcaff4b78d83aaf35a6f31f5da21172cbe544e4bfae6083fdcba81ddec3
Opcode Fuzzy Hash: 6f73bb3cb6f5cf5abec075b9014cb563e06a4567c89c5d20f7171c5a4b410b69
Instruction Fuzzy Hash: 080152F5611E9D82EB45CBB9E8A83D76325E78D7E8F40E1128E0E67625DE38C2098300

Function 00000001800033B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797ab2e302fecb4ee9151d5ec147357b9b6b8374a5a73c2aa17e4c7710b83c27
Instruction ID: c05fe9916e29f3615726ac8ab40efd06a7f832fe150a5180127c36e0d361f74a
Opcode Fuzzy Hash: 797ab2e302fecb4ee9151d5ec147357b9b6b8374a5a73c2aa17e4c7710b83c27
Instruction Fuzzy Hash: 130125F1652E5E82FB59CBA4E569BC66362EB487D8F40F1179D0D07618EE3CD219C304

Function 000000018002BBA8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction ID: c5723c18dcfd40d5e26eb64c6513ed8ad7c8279d3e69258c72aec0d621b19a73
Opcode Fuzzy Hash: c92cc2c6b8134dcd1d90e81fd4ee0dc0e69cf849aebd7e5d77ccca44f26df776
Instruction Fuzzy Hash: 15F06871714A548AEBD5CF2CA44276A77D0F30C3C4FA0C519E68983B04D63D8165CF04

Function 000000018001A7E8 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000018001A7F7

Part of subcall function 0000000180019CF8: __vcrt_initialize.LIBVCRUNTIME ref: 0000000180019D1A

__scrt_release_startup_lock.LIBCMT ref: 000000018001A87A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A890
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A8BC
__scrt_get_show_window_mode.LIBCMT ref: 000000018001A8CD
__scrt_is_managed_app.LIBCMT ref: 000000018001A8F0
__scrt_uninitialize_crt.LIBCMT ref: 000000018001A907
__scrt_fastfail.LIBCMT ref: 000000018001A939
__scrt_fastfail.LIBCMT ref: 000000018001A944
__security_init_cookie.LIBCMT ref: 000000018001A960

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 20208a98ab850ec38ed8325cc0af7ea2ed5af357558f35f83d8d5c5aa49ef683
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: C631923160994C86FBE7BBA5D4523EA2391AB4E3C4F45C425B94A473D7DE28CB4E8350

Function 0000000180019F69 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000000018001A062
__scrt_fastfail.LIBCMT ref: 000000018001A0B1
__scrt_fastfail.LIBCMT ref: 000000018001A0BC
__scrt_fastfail.LIBCMT ref: 000000018001A0C7

Strings

onstructor closure', xrefs: 0000000180019FF4
`eh vector vbase constructor iterator', xrefs: 0000000180019F9C
`local vftable', xrefs: 0000000180019FE0
`udt returning', xrefs: 0000000180019FCC

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 430d6e6a62d8c94c9c04e7e52013dca82c213aedb955d9ad44379b1780147ad5
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: FF416D35206B4C82FBA79B20E9503EA2361AB4EBD0F54D525E90E477A4DF3CC68E8304

Function 000000018002B9A8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002B9D0
_set_statfp.LIBCMT ref: 000000018002B9EB
_set_statfp.LIBCMT ref: 000000018002BA07
_set_statfp.LIBCMT ref: 000000018002BA43

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 3b9bd57b40fff3d8961f464b14179896b260d9c17b5d0c480fa0c6cf32fa7499
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: CB117732690A4D01F7E72129D4553F93340AB6D3F4F45C634BA76976D6CE248BC94302

Function 000000018001F660 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001F698
_invalid_parameter_noinfo.LIBCMT ref: 000000018001F8D2

Strings

*, xrefs: 000000018001F7A5
ko-KR, xrefs: 000000018001F6B7

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: 247b425bc4075f99800c1718c7ffe54540729addd1f222e63731e205efc231c0
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: B0718F72504E58C6E7FA9F2980443BC3BA0F34DBD8F649216EA4646399DF31CA8AC750

Function 0000000180017B98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_1, xrefs: 0000000180017D10
__swift_2, xrefs: 0000000180017D34

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: e36f902788c0381efdc077c6dc949100de42eee437ea8b415927d241f746463c
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: CF618E32300A8882EF96DB29E5447E963A1FB4CBD4F488525EF6D4779ADF38D645C340

Function 0000000180023FE4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024027

Strings

o-l1-2-1, xrefs: 00000001800240CC
gfff, xrefs: 0000000180024149

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 4e08fe91d50fd43471445e9309ac5ad4362738dffbe45d8770cad9fb3b789804
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: 5951F4737147C886E7A78B35E9413997B91E399BD0F48D221EB944BAD6CE38C698C700

Function 0000000180024430 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018002459E

Strings

synch-l1-2-0, xrefs: 00000001800244A4
api-ms-win-core-sysinfo-l1-2-1, xrefs: 00000001800244D1

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: 9d4985de47fc3aa1ddc341b920f7898ed377652abc42465d74999370fa1411ca
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: 86418E72705F888AE782CF65E8507CE73A5F7193C8F518126EA9807B99DF38C629C340

Function 000000018001D646 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001C478: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000000018001C47C

__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D66E
__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D6F8

Strings

csm, xrefs: 000000018001D6CB

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 011c5e600e2baba1b5aebe761702f78806dc8dec4a9d5acc90072a234146c346
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: 40212D76204A4887E7B2DF15E05079E7760F39DBE4F008206EEA943795CF39DA8ACB01

Function 000000018001A972 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000018001A99B

Strings

`vector destructor iterator', xrefs: 000000018001A980
nt delete closure', xrefs: 000000018001A9A0

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: c8ada3eb98077b3e77d28a4839308a809c4d6d91d1a7368aad5ed78790c858ba
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 9EE01AB1200B0490DB068F65E8513E873A4EB4CB90F48C032AA5C47354EF38C6A9C301

Function 000000018001AA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000018001AA55
_CxxThrowException.LIBVCRUNTIME ref: 000000018001AA66

Strings

File, xrefs: 000000018001AA5A

Memory Dump Source

Source File: 00000000.00000002.1685826341.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.1685804637.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686712081.0000000180119000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686852595.000000018011D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1686963387.0000000180121000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_R2-Signed.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 9145d171dbcecb2188c45693134888adfda474ee1ae56853841174419c243042
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 49C08C3221488D91EB62EB10E8917DA5330B7A8384F818111F19C824B69F1CC30ECB00

Analysis Process: svchost.exePID: 1044, Parent PID: 2084COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	51.2%
Total number of Nodes:	379
Total number of Limit Nodes:	39

Executed Functions

Function 000001845C4F0680 Relevance: 130.0, APIs: 73, Strings: 1, Instructions: 492
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,000001845C4E1B37), ref: 000001845C4F0697
GetCurrentProcess.KERNEL32 ref: 000001845C4F06C8
OpenProcessToken.ADVAPI32 ref: 000001845C4F06D9
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F0701
AdjustTokenPrivileges.KERNELBASE ref: 000001845C4F0721
GetLastError.KERNEL32 ref: 000001845C4F0727
CloseHandle.KERNEL32 ref: 000001845C4F073B
VirtualAlloc.KERNEL32 ref: 000001845C4F0752
InitializeCriticalSection.KERNEL32 ref: 000001845C4F0764
IsBadReadPtr.KERNEL32 ref: 000001845C4F077D
EnterCriticalSection.KERNEL32 ref: 000001845C4F0790
VirtualAlloc.KERNEL32 ref: 000001845C4F07A7
LeaveCriticalSection.KERNEL32 ref: 000001845C4F07D6
IsBadReadPtr.KERNEL32 ref: 000001845C4F07E8
EnterCriticalSection.KERNEL32 ref: 000001845C4F07FB
VirtualAlloc.KERNEL32 ref: 000001845C4F0812
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0841
IsBadReadPtr.KERNEL32 ref: 000001845C4F0853
EnterCriticalSection.KERNEL32 ref: 000001845C4F0866
VirtualAlloc.KERNEL32 ref: 000001845C4F087D
LeaveCriticalSection.KERNEL32 ref: 000001845C4F08AC
IsBadReadPtr.KERNEL32 ref: 000001845C4F08BE
EnterCriticalSection.KERNEL32 ref: 000001845C4F08D1
VirtualAlloc.KERNEL32 ref: 000001845C4F08E8
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0917
IsBadReadPtr.KERNEL32 ref: 000001845C4F0929
EnterCriticalSection.KERNEL32 ref: 000001845C4F093C
VirtualAlloc.KERNEL32 ref: 000001845C4F0953
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0982
IsBadReadPtr.KERNEL32 ref: 000001845C4F0994
EnterCriticalSection.KERNEL32 ref: 000001845C4F09A7
VirtualAlloc.KERNEL32 ref: 000001845C4F09BE
LeaveCriticalSection.KERNEL32 ref: 000001845C4F09ED
IsBadReadPtr.KERNEL32 ref: 000001845C4F09FF
EnterCriticalSection.KERNEL32 ref: 000001845C4F0A12
VirtualAlloc.KERNEL32 ref: 000001845C4F0A29
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0A58
IsBadReadPtr.KERNEL32 ref: 000001845C4F0A6A
EnterCriticalSection.KERNEL32 ref: 000001845C4F0A7D
VirtualAlloc.KERNEL32 ref: 000001845C4F0A94
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0AC3
IsBadReadPtr.KERNEL32 ref: 000001845C4F0AD5
EnterCriticalSection.KERNEL32 ref: 000001845C4F0AEB
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0B16
IsBadReadPtr.KERNEL32 ref: 000001845C4F0B2E
EnterCriticalSection.KERNEL32 ref: 000001845C4F0B44
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0B68
IsBadReadPtr.KERNEL32 ref: 000001845C4F0B81
EnterCriticalSection.KERNEL32 ref: 000001845C4F0B97
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0BBB
IsBadReadPtr.KERNEL32 ref: 000001845C4F0BD4
EnterCriticalSection.KERNEL32 ref: 000001845C4F0BEA
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0C16
IsBadReadPtr.KERNEL32 ref: 000001845C4F0C2F
EnterCriticalSection.KERNEL32 ref: 000001845C4F0C45
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0C69
IsBadReadPtr.KERNEL32 ref: 000001845C4F0C82
EnterCriticalSection.KERNEL32 ref: 000001845C4F0C98
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0CBC
IsBadReadPtr.KERNEL32 ref: 000001845C4F0CD5
EnterCriticalSection.KERNEL32 ref: 000001845C4F0CEB
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0D16
IsBadReadPtr.KERNEL32 ref: 000001845C4F0D2F
EnterCriticalSection.KERNEL32 ref: 000001845C4F0D45
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0D69
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DA4
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DB6
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DC8
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DDA
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DEC
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0DFE
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0E10
LeaveCriticalSection.KERNEL32 ref: 000001845C4F0E22

Strings

SeDebugPrivilege, xrefs: 000001845C4F06F0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead$AllocVirtual$ProcessToken$AdjustCloseCurrentErrorHandleInitializeLastLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3221255601-2896544425
Opcode ID: 79b32153c8a47bce9488e86581e1df08a4a5845b2d426890eb6905a67430a941
Instruction ID: 38a365d32710e25e2e81d19e58f1f5f30c45be460cad084a44fe52f2bcb49a47
Opcode Fuzzy Hash: 79b32153c8a47bce9488e86581e1df08a4a5845b2d426890eb6905a67430a941
Instruction Fuzzy Hash: B2324835300B4687EB598F51EA047ADA3A5FB95FC0F94C226CE5A43B94DF38E664C348

Function 000001845C4E2140 Relevance: 107.0, APIs: 49, Strings: 12, Instructions: 295
memorystringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001845C4FB990: VirtualAlloc.KERNEL32 ref: 000001845C4FB9B9
Part of subcall function 000001845C4FB990: memcpy.NTDLL ref: 000001845C4FB9DD
Part of subcall function 000001845C4FB990: VirtualAlloc.KERNEL32 ref: 000001845C4FBA08
Part of subcall function 000001845C4FB990: memcpy.NTDLL ref: 000001845C4FBA3D
Part of subcall function 000001845C4FB990: memcpy.NTDLL ref: 000001845C4FBA73
Part of subcall function 000001845C4FB990: memset.NTDLL ref: 000001845C4FBB0C
Part of subcall function 000001845C4FB990: ExpandEnvironmentStringsW.KERNEL32 ref: 000001845C4FBB23
Part of subcall function 000001845C4FB990: memset.NTDLL ref: 000001845C4FBB38

Part of subcall function 000001845C4FD340: GetModuleHandleW.KERNEL32 ref: 000001845C4FD35F
Part of subcall function 000001845C4FD340: GetCurrentProcess.KERNEL32 ref: 000001845C4FD379
Part of subcall function 000001845C4FD340: K32GetModuleInformation.KERNEL32 ref: 000001845C4FD390
Part of subcall function 000001845C4FD340: memset.NTDLL ref: 000001845C4FD3A8
Part of subcall function 000001845C4FD340: GetSystemDirectoryW.KERNEL32 ref: 000001845C4FD3B7
Part of subcall function 000001845C4FD340: lstrcatW.KERNEL32 ref: 000001845C4FD3D9
Part of subcall function 000001845C4FD340: CreateFileW.KERNEL32 ref: 000001845C4FD406
Part of subcall function 000001845C4FD340: CreateFileMappingW.KERNELBASE ref: 000001845C4FD42D
Part of subcall function 000001845C4FD340: MapViewOfFile.KERNEL32 ref: 000001845C4FD457
Part of subcall function 000001845C4FD340: VirtualProtect.KERNEL32 ref: 000001845C4FD4F2
Part of subcall function 000001845C4FD340: memcpy.NTDLL ref: 000001845C4FD507

WSAStartup.WS2_32 ref: 000001845C4E2167

Part of subcall function 000001845C4FD7D0: CoInitializeEx.OLE32 ref: 000001845C4FD820
Part of subcall function 000001845C4FD7D0: CoCreateInstance.COMBASE ref: 000001845C4FD845
Part of subcall function 000001845C4FD7D0: CoUninitialize.OLE32 ref: 000001845C4FD86E

GetCommandLineW.KERNEL32 ref: 000001845C4E21A4
CommandLineToArgvW.SHELL32 ref: 000001845C4E21B4

Part of subcall function 000001845C4EAFC0: VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EAFD7
Part of subcall function 000001845C4EAFC0: CreateEventW.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB061
Part of subcall function 000001845C4EAFC0: VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB086
Part of subcall function 000001845C4EAFC0: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB098
Part of subcall function 000001845C4EAFC0: VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0BD
Part of subcall function 000001845C4EAFC0: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0CF
Part of subcall function 000001845C4EAFC0: VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0F4
Part of subcall function 000001845C4EAFC0: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB106
Part of subcall function 000001845C4EAFC0: VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB12B
Part of subcall function 000001845C4EAFC0: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB13D

VirtualAlloc.KERNEL32 ref: 000001845C4E21D5
InitializeCriticalSection.KERNEL32 ref: 000001845C4E21E7
VirtualAlloc.KERNEL32 ref: 000001845C4E220C
InitializeCriticalSection.KERNEL32 ref: 000001845C4E221E
memset.NTDLL ref: 000001845C4E223F
GetCurrentProcessId.KERNEL32 ref: 000001845C4E2244
lstrcmpiW.KERNEL32 ref: 000001845C4E2264
lstrcmpiW.KERNEL32 ref: 000001845C4E227F
ExitThread.KERNEL32 ref: 000001845C4E2290

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E2416, 000001845C4E24B7, 000001845C4E24FD
%s\%s, xrefs: 000001845C4E2504
Schedule, xrefs: 000001845C4E22D8, 000001845C4E2642
Microsoft Mail Update Task MachineCore, xrefs: 000001845C4E2586
18.139.89.40, xrefs: 000001845C4E24CA, 000001845C4E24D6
taskmgr.exe, xrefs: 000001845C4E2273
svchost.exe, xrefs: 000001845C4E22BE
/Processid:{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 000001845C4E25CB, 000001845C4E25F1
Inject Test, xrefs: 000001845C4E2256
ParphaCrashReport64.exe, xrefs: 000001845C4E22F4, 000001845C4E24F6
MicrosoftMailUpdateTask, xrefs: 000001845C4E2532, 000001845C4E2567
perfmon.exe, xrefs: 000001845C4E2297

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$Initialize$CriticalSection$Creatememcpymemset$File$CommandCurrentLineModuleProcesslstrcmpi$ArgvDirectoryEnvironmentEventExitExpandHandleInformationInstanceMappingProtectStartupStringsSystemThreadUninitializeViewlstrcat
String ID: %s\%s$/Processid:{F8284233-48F4-4680-ADDD-F8284233}$18.139.89.40$C:\Program Files\Windows Mail$Inject Test$Microsoft Mail Update Task MachineCore$MicrosoftMailUpdateTask$ParphaCrashReport64.exe$Schedule$perfmon.exe$svchost.exe$taskmgr.exe
API String ID: 3540647475-1260490244
Opcode ID: e4bfe4048ee3d54e59998916ce248c807bf3acb0d7d6f17c8420b9b790105c66
Instruction ID: b020d48f581f3a51a80805c9025c464bb803209034d44802e40c84033a74db8e
Opcode Fuzzy Hash: e4bfe4048ee3d54e59998916ce248c807bf3acb0d7d6f17c8420b9b790105c66
Instruction Fuzzy Hash: 5EE19031200A57D3EB289FB1ED407DD6361FBA6B44F84C326D90A466A6EF38C745C749

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000000018000103C
malloc.MSVCRT ref: 00000001800010C9
memcpy.NTDLL ref: 00000001800010EB
memcpy.NTDLL ref: 0000000180001100
memset.NTDLL ref: 00000001800011B4
wsprintfW.USER32 ref: 00000001800011D5
CreateFileW.KERNEL32 ref: 0000000180001203
GetLastError.KERNEL32 ref: 0000000180001212
WriteFile.KERNEL32 ref: 0000000180001233
GetLastError.KERNEL32 ref: 000000018000123D
CloseHandle.KERNEL32 ref: 0000000180001246
SleepEx.KERNEL32 ref: 0000000180001251
memset.NTDLL ref: 0000000180001266
wsprintfW.USER32 ref: 0000000180001287
CreateFileW.KERNEL32 ref: 00000001800012B5
GetLastError.KERNEL32 ref: 00000001800012C4
WriteFile.KERNEL32 ref: 00000001800012E5
GetLastError.KERNEL32 ref: 00000001800012EF
CloseHandle.KERNEL32 ref: 00000001800012F8
SleepEx.KERNEL32 ref: 0000000180001303
memset.NTDLL ref: 0000000180001318
wsprintfW.USER32 ref: 0000000180001339
CreateFileW.KERNEL32 ref: 0000000180001367
GetLastError.KERNEL32 ref: 0000000180001376
WriteFile.KERNEL32 ref: 0000000180001393
GetLastError.KERNEL32 ref: 000000018000139D
CloseHandle.KERNEL32 ref: 00000001800013A6
Sleep.KERNEL32 ref: 00000001800013B1
VirtualAlloc.KERNEL32 ref: 00000001800013D4
memcpy.NTDLL ref: 00000001800013F0
CreateThread.KERNEL32 ref: 000000018000140C
VariantInit.OLEAUT32 ref: 0000000180001441
SysAllocString.OLEAUT32 ref: 00000001800014A3
GetLastError.KERNEL32 ref: 00000001800014BE
memset.NTDLL ref: 00000001800014D6
wsprintfW.USER32 ref: 00000001800014F4
memset.NTDLL ref: 000000018000152F
memcpy.NTDLL ref: 0000000180001544
CreateThread.KERNEL32 ref: 0000000180001562

Strings

%s\%s, xrefs: 00000001800011C7, 0000000180001279, 000000018000132B, 00000001800014E9
\Microsoft\Windows, xrefs: 000000018000149C

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$File$Creatememset$memcpywsprintf$CloseHandleSleepWrite$AllocThreadmalloc$InitStringVariantVirtual
String ID: %s\%s$\Microsoft\Windows
API String ID: 1085075972-4137575348
Opcode ID: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction ID: ca852493329d7e8b29278f03f5207e3e8a0b6c409a20f5d7edd43a4be3d27a44
Opcode Fuzzy Hash: 11d6cde565b72d1d43927487ff83bed9824f46b89a23802b2bfd78be970e790e
Instruction Fuzzy Hash: 4DF18A32610F8985F7A6CF24E8087DD33A0F78DBA8F449215EE9A17694EF38C249C700

Function 000001845C4EF9E0 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 201
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32 ref: 000001845C4EFA31
GetLastError.KERNEL32 ref: 000001845C4EFA3F
VirtualAllocEx.KERNEL32 ref: 000001845C4EFA6B
WriteProcessMemory.KERNEL32 ref: 000001845C4EFA8F
GetLastError.KERNEL32 ref: 000001845C4EFA99

Strings

@, xrefs: 000001845C4EFABA
h, xrefs: 000001845C4EFB9B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: AllocErrorLastVirtual$MemoryProcessWrite
String ID: @$h
API String ID: 1382438346-1029331998
Opcode ID: 68fc5231bb649cffb2ef201a26c0452fc735f8ffc7358dd3c59d4300c21df8ec
Instruction ID: ffa8bb9d5679060274c192edda8875a2e98292844422b8fdaf3ff4d0c8d1a91d
Opcode Fuzzy Hash: 68fc5231bb649cffb2ef201a26c0452fc735f8ffc7358dd3c59d4300c21df8ec
Instruction Fuzzy Hash: A781E532218BC587E7648F69B84079EAB50F796BC4F849219EEC643B89DF3CC605CB45

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE ref: 0000000180001A3B
CLSIDFromString.OLE32 ref: 0000000180001CFA
IIDFromString.OLE32 ref: 0000000180001D0D
CoCreateInstance.COMBASE ref: 0000000180001D2C

Strings

Y:\:, xrefs: 0000000180001AD8
X:^:, xrefs: 0000000180001AE8
X:[:, xrefs: 0000000180001BAA
:_:, xrefs: 0000000180001AF0
:, xrefs: 0000000180001CA0
A::, xrefs: 0000000180001A4F
\:[:, xrefs: 0000000180001B9B
Y::, xrefs: 0000000180001C46
^:G:, xrefs: 0000000180001B44
:Y:, xrefs: 0000000180001C3F
\:^:, xrefs: 0000000180001C4D

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: FromString$CreateInitializeInstance
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 511945936-2205580742
Opcode ID: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction ID: 28b9f900473ef5d70d4cda544e42fab565c9dc4f26e78512e927f69b0d8a042f
Opcode Fuzzy Hash: 024cd465da59768dcf6c08cf3900c20a72cd4ffd1450610ea91f3c4b38ce9232
Instruction Fuzzy Hash: 0291FD73D18BD4CAE311CF7994016EDBB70F799348F14A249EB946A919EB78E684CF00

Function 0000000180001D60 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000180001DA5
SysAllocString.OLEAUT32 ref: 0000000180001DE4
SysAllocString.OLEAUT32 ref: 0000000180001DF0
IIDFromString.OLE32 ref: 0000000180001F31
SysAllocString.OLEAUT32 ref: 0000000180001F61
SysAllocString.OLEAUT32 ref: 0000000180001F71
VariantInit.OLEAUT32 ref: 0000000180001FEA
SysAllocString.OLEAUT32 ref: 0000000180001FF7

Strings

SYSTEM, xrefs: 0000000180001DD9
{4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}, xrefs: 0000000180001F26

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: String$Alloc$FromInitVariant
String ID: SYSTEM${4c3d624d-fd6b-49a3-b9b7-09cb3cd3f047}
API String ID: 929278495-107290059
Opcode ID: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction ID: 371f9a688604c33e3b5ae190077701ce0554801126743d20ac49bde758192535
Opcode Fuzzy Hash: ce7cb2923214bf6d84e2195aaa923cf65e5dbc7fe3967ba643ece21ae7ad8fe5
Instruction Fuzzy Hash: E5B1C236B00B558AEB40DF6AD88829D77B1FB88FA9F559016DE0E57B28DF35C189C300

Function 000001845C4FD140 Relevance: 15.1, APIs: 10, Instructions: 95
servicestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD165
EnumServicesStatusExW.ADVAPI32 ref: 000001845C4FD1B1
malloc.MSVCRT ref: 000001845C4FD1C6
memset.NTDLL ref: 000001845C4FD1DC
EnumServicesStatusExW.ADVAPI32 ref: 000001845C4FD21B
CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD228
free.MSVCRT ref: 000001845C4FD231
CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD24D
lstrcmpiW.KERNEL32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD26D
free.MSVCRT ref: 000001845C4FD291

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseEnumHandleServiceServicesStatusfree$ManagerOpenlstrcmpimallocmemset
String ID:
API String ID: 2647132813-0
Opcode ID: c2b9930ff57626eae451ef52e78241fd2a7e99a3c5bb9cb5767dca943c792e03
Instruction ID: 88a1558a43fc4ea7b045347fb81026a46ee3ca45e6e6e98a1b7e4a01a8cff4e5
Opcode Fuzzy Hash: c2b9930ff57626eae451ef52e78241fd2a7e99a3c5bb9cb5767dca943c792e03
Instruction Fuzzy Hash: 7C41A632204B558BD764CF66F84069EB7A4F7C9B44F948225DA8E43B14DF3CD649CB44

Function 000001845C4FCA60 Relevance: 15.1, APIs: 10, Instructions: 65
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4FCA7B
GetProcessHeap.KERNEL32(?,?,00000000,000001845C4E2300), ref: 000001845C4FCAA2
HeapAlloc.KERNEL32(?,?,00000000,000001845C4E2300), ref: 000001845C4FCAB6
CloseHandle.KERNEL32(?,?,00000000,000001845C4E2300), ref: 000001845C4FCAC7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Heap$AllocCloseCreateHandleProcessSnapshotToolhelp32
String ID:
API String ID: 1926892967-0
Opcode ID: 556f8c45a5b3be51068a5fed4b8b05554424f686ed4d881aa42d630a1535f563
Instruction ID: a2db3c4f43d9a416bc19abeb2d76d44d3a3296e32b18dfd239547535403be05e
Opcode Fuzzy Hash: 556f8c45a5b3be51068a5fed4b8b05554424f686ed4d881aa42d630a1535f563
Instruction Fuzzy Hash: 9221C131310A4283EB689F62E8047ADB7A0F789FE4F888321EE5647795DF3CD6418708

Function 000001845C4FC950 Relevance: 7.6, APIs: 5, Instructions: 68processCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4FC974
CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4FC97E
Process32FirstW.KERNEL32 ref: 000001845C4FC9A1
Process32NextW.KERNEL32 ref: 000001845C4FC9BE
CloseHandle.KERNEL32 ref: 000001845C4FCA41

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: 44c899de9843c07d997477ea65153a2f26deeedfdeec94036e1e1bc8e67b5a7d
Instruction ID: 72a64ac5ab2b89b045fcb62132ac7ec593ad37646025f2d6bf68d860be30e048
Opcode Fuzzy Hash: 44c899de9843c07d997477ea65153a2f26deeedfdeec94036e1e1bc8e67b5a7d
Instruction Fuzzy Hash: 51317C22E18B9583E711CB28D5083AD73A0F3AAB98F49E315DF9902756EF34E284C704

Function 000001845C4FD340 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 129
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000001845C4FD35F
GetCurrentProcess.KERNEL32 ref: 000001845C4FD379
K32GetModuleInformation.KERNEL32 ref: 000001845C4FD390
memset.NTDLL ref: 000001845C4FD3A8
GetSystemDirectoryW.KERNEL32 ref: 000001845C4FD3B7
lstrcatW.KERNEL32 ref: 000001845C4FD3D9
CreateFileW.KERNEL32 ref: 000001845C4FD406
CreateFileMappingW.KERNELBASE ref: 000001845C4FD42D
MapViewOfFile.KERNEL32 ref: 000001845C4FD457
VirtualProtect.KERNEL32 ref: 000001845C4FD4F2
memcpy.NTDLL ref: 000001845C4FD507
VirtualProtect.KERNEL32 ref: 000001845C4FD525

Strings

ntdll.dll, xrefs: 000001845C4FD34C
\ntdll.dll, xrefs: 000001845C4FD3C5
.text, xrefs: 000001845C4FD497

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: File$CreateModuleProtectVirtual$CurrentDirectoryHandleInformationMappingProcessSystemViewlstrcatmemcpymemset
String ID: .text$\ntdll.dll$ntdll.dll
API String ID: 992094507-3745270394
Opcode ID: 69df7cb737dd3e51747fbe578d65583dad7475f3be71c5b6a57530708f646bad
Instruction ID: df02ff196e07b9798dbf293d1abc4370a181084f91e3cececcd59cfe634687cd
Opcode Fuzzy Hash: 69df7cb737dd3e51747fbe578d65583dad7475f3be71c5b6a57530708f646bad
Instruction Fuzzy Hash: D651AE72714A9687EB65CF21E4487DEB3A0F799B48F848215CA8A03B58DF3CD244CB08

Function 000001845B3A0508 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001845B3A0627
GetProcAddressForCaller.KERNELBASE ref: 000001845B3A06C1

Strings

ateH, xrefs: 000001845B3A05B5
l.dl, xrefs: 000001845B3A059A
RtlA, xrefs: 000001845B3A05A7
l.dl, xrefs: 000001845B3A054B
eHea, xrefs: 000001845B3A056D
lloc, xrefs: 000001845B3A05AE
ntdl, xrefs: 000001845B3A0593
eAll, xrefs: 000001845B3A055F
eap, xrefs: 000001845B3A05BC
ocat, xrefs: 000001845B3A0566
ntdl, xrefs: 000001845B3A0541
RtlR, xrefs: 000001845B3A0558

Memory Dump Source

Source File: 00000002.00000002.2928848258.000001845B3A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b3a0000_svchost.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID: RtlA$RtlR$ateH$eAll$eHea$eap$l.dl$l.dl$lloc$ntdl$ntdl$ocat
API String ID: 4215043672-3994871222
Opcode ID: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction ID: c381af4db78858afda48622ee0d699de6729f89d134ab15c92d4731855fb9dee
Opcode Fuzzy Hash: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction Fuzzy Hash: 4771D130604A0A8BEB58EF58C845BED77E1FF94710F20815AD80AE7296DF35E9428F85

Function 000001845B370508 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 231
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001845B370627

Strings

RtlR, xrefs: 000001845B370558
lloc, xrefs: 000001845B3705AE
ntdl, xrefs: 000001845B370541
l.dl, xrefs: 000001845B37054B
ateH, xrefs: 000001845B3705B5
eAll, xrefs: 000001845B37055F
ocat, xrefs: 000001845B370566
eap, xrefs: 000001845B3705BC
l.dl, xrefs: 000001845B37059A
eHea, xrefs: 000001845B37056D
RtlA, xrefs: 000001845B3705A7
ntdl, xrefs: 000001845B370593

Memory Dump Source

Source File: 00000002.00000002.2928816017.000001845B370000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b370000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID: RtlA$RtlR$ateH$eAll$eHea$eap$l.dl$l.dl$lloc$ntdl$ntdl$ocat
API String ID: 1029625771-3994871222
Opcode ID: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction ID: a74a42356ef8f54fa7955b3c366e675d3a8961867c6609bc0195d9789616b061
Opcode Fuzzy Hash: 1e80394ff1d37946f5ee3994f364bbb739b556a1a1e79a645345825dff1cf6d4
Instruction Fuzzy Hash: 8471A031614A0A8BEB58EF58C855BED77E1FF94310F21815AD80AE7286DF34DA42CF85

Function 000001845C4FD7D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62
commemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32 ref: 000001845C4FD820
CoCreateInstance.COMBASE ref: 000001845C4FD845
CoUninitialize.OLE32 ref: 000001845C4FD86E
SysAllocString.OLEAUT32 ref: 000001845C4FD886
SysFreeString.OLEAUT32 ref: 000001845C4FD8A0
CoUninitialize.OLE32 ref: 000001845C4FD8BA

Strings

Block All Outbound, xrefs: 000001845C4FD87A

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: StringUninitialize$AllocCreateFreeInitializeInstance
String ID: Block All Outbound
API String ID: 4211003860-2946277995
Opcode ID: 295a4f62168f5a6f5119dea70b951de674f26a9291ccd047ab80a2b95cdfc5e8
Instruction ID: 4c0aa9e46115998dcc924684b757b4575249f13291dda10f3b73d0ed50671016
Opcode Fuzzy Hash: 295a4f62168f5a6f5119dea70b951de674f26a9291ccd047ab80a2b95cdfc5e8
Instruction Fuzzy Hash: 50311876B00B15CBEB009F76D84429C7770F794F88B448926DA1D47B28DF38C664CB84

Function 000001845C4EF560 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4EF59E
memcpy.NTDLL ref: 000001845C4EF5BA
VirtualFree.KERNEL32 ref: 000001845C4EF6AF
VirtualFree.KERNEL32 ref: 000001845C4EF6CF
VirtualFree.KERNELBASE ref: 000001845C4EF6E4

Strings

Z, xrefs: 000001845C4EF5C4
M, xrefs: 000001845C4EF5BF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$Allocmemcpy
String ID: M$Z
API String ID: 2981101286-4250246861
Opcode ID: ec89bfb9e9449c1fd831b7383df3345bb054ba2f3537415f9bda132d024155c3
Instruction ID: 98ecbdbaaa5dde0254cb65932f8bcb7f3ff8020b1b5658f4ccc75085e62ecc5e
Opcode Fuzzy Hash: ec89bfb9e9449c1fd831b7383df3345bb054ba2f3537415f9bda132d024155c3
Instruction Fuzzy Hash: 9D410236B10BC283FB158F3DD0007AD6790A7E6B94F55C315EA96163E5EF29C602C309

Function 000001845C4EFE20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
processthreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 000001845C4EFEBC
GetLastError.KERNEL32 ref: 000001845C4EFEC6
CloseHandle.KERNEL32 ref: 000001845C4EFED8
CloseHandle.KERNEL32 ref: 000001845C4EFEED
SuspendThread.KERNEL32 ref: 000001845C4EFEFC

Strings

h, xrefs: 000001845C4EFEB4

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcessSuspendThread
String ID: h
API String ID: 2500411409-2439710439
Opcode ID: 0b268da3d10d4c3e51607ed6fa644b71a4395eb09a036cb45f3a7793d543c8a6
Instruction ID: a1a21c8a76dd3432da82a2d8d92c1181e469f071f561da0d7d75e3bff373a155
Opcode Fuzzy Hash: 0b268da3d10d4c3e51607ed6fa644b71a4395eb09a036cb45f3a7793d543c8a6
Instruction Fuzzy Hash: 8731AE37A18B81C7E7508F91E44479EB3A4F3A8B94F129326EA9803B15DF79C5D0CB04

Function 000001845C4F6F00 Relevance: 9.0, APIs: 6, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C4F6F0E
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F2B
VirtualFree.KERNELBASE(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F4F
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F66
DeleteCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F70
VirtualFree.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F81

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$FreeVirtual$DeleteEnterLeaveRead
String ID:
API String ID: 4123369522-0
Opcode ID: aa19078ca0c6afd7a821f8a8ac8a84ee5709a37a32491cc2cb8c739b25d204c7
Instruction ID: 8ae27e31e23b89755b310283ec15db42feeb2ec51d47047bda7a1a9d16e5319e
Opcode Fuzzy Hash: aa19078ca0c6afd7a821f8a8ac8a84ee5709a37a32491cc2cb8c739b25d204c7
Instruction Fuzzy Hash: C3019A31324F4283FB488F62E54439DA361FBA9F88F88C122DE5A03B54DF38D2658718

Function 00000001800019D0 Relevance: 4.5, APIs: 3, Instructions: 16fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00000001800019D9
SleepEx.KERNEL32 ref: 00000001800019E8
DeleteFileW.KERNEL32 ref: 00000001800019F1

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: DeleteFile$Sleep
String ID:
API String ID: 2100639427-0
Opcode ID: 819f48160997e5889829df66ddb1cfbaf94046e4fda21bae77f85b2f67c4eaa9
Instruction ID: ee9c1bd20bde787a3df6403edb75ddca03fdaf3f5216dae4a0b383b50a80e175
Opcode Fuzzy Hash: 819f48160997e5889829df66ddb1cfbaf94046e4fda21bae77f85b2f67c4eaa9
Instruction Fuzzy Hash: 5CD05E20301A0986FB9A5BB2E8583E613A85B0DBD2F0860249C1685280DF18C7CE8301

Function 000001845B3A0345 Relevance: 1.4, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001845B3A0395

Memory Dump Source

Source File: 00000002.00000002.2928848258.000001845B3A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b3a0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: ef4bb6c71454d22b561e0105ee1553b42766148eaa3c283ca195eff69e386f39
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: 2131C3316586018BDB5CEA1CE8C26A973D0F795304B30529EE9C7D71C7EE39E9438B89

Function 000001845C380345 Relevance: 1.4, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001845C380395

Memory Dump Source

Source File: 00000002.00000002.2931401683.000001845C380000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001845C380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c380000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: 951e66a6b1d21aabd3b8155fc870e722c2ada9e282e41ce921d080dec94f9224
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: 6E31E5316496058BDB5CDA1CE8C26A873D0FB55304B60429DDAC7C7187EE39E803C789

Function 000001845B370345 Relevance: 1.4, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001845B370395

Memory Dump Source

Source File: 00000002.00000002.2928816017.000001845B370000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001845B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845b370000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction ID: fb5624946f701f58ffc31c8419db3424fa54852be020087c6986d22e8504e12a
Opcode Fuzzy Hash: 88289986f9ffe6edc648fa77a415d0491739a420f0f8400cd95d764a84c61761
Instruction Fuzzy Hash: 7131C3316586018BEB5CDA1CE8C26AD73D0F795304B20519EE9C7D7187EE39E9438B89

Non-executed Functions

Function 000001845C4E5FB0 Relevance: 105.2, APIs: 47, Strings: 13, Instructions: 229threadsleepstringCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4E6010

Part of subcall function 000001845C4FC950: memset.NTDLL ref: 000001845C4FC974
Part of subcall function 000001845C4FC950: CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4FC97E
Part of subcall function 000001845C4FC950: Process32FirstW.KERNEL32 ref: 000001845C4FC9A1
Part of subcall function 000001845C4FC950: Process32NextW.KERNEL32 ref: 000001845C4FC9BE
Part of subcall function 000001845C4FC950: CloseHandle.KERNEL32 ref: 000001845C4FCA41

TerminateThread.KERNEL32 ref: 000001845C4E604B
TerminateProcess.KERNEL32 ref: 000001845C4E607B
lstrcmpiW.KERNEL32 ref: 000001845C4E6098
Sleep.KERNEL32 ref: 000001845C4E60AD
ExitThread.KERNEL32 ref: 000001845C4E60B5

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E61F0, 000001845C4E6226, 000001845C4E625C, 000001845C4E6290, 000001845C4E62C4
arphaDump64.bin, xrefs: 000001845C4E6255
\drivers\, xrefs: 000001845C4E6124
install.cfg, xrefs: 000001845C4E6289
temp.key, xrefs: 000001845C4E62BD
Inject Test, xrefs: 000001845C4E608A
MicrosoftMailUpdateTask, xrefs: 000001845C4E60D0, 000001845C4E6136, 000001845C4E63C9
arphaDump64.dll, xrefs: 000001845C4E621F
%s\%s, xrefs: 000001845C4E61F7, 000001845C4E622D, 000001845C4E6263, 000001845C4E6297, 000001845C4E62CB
.sys, xrefs: 000001845C4E6148
18.139.89.40, xrefs: 000001845C4E637F
ParphaCrashReport64.exe, xrefs: 000001845C4E61E9
sys, xrefs: 000001845C4E60E4

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ProcessProcess32TerminateThread$CloseCreateCurrentExitFirstHandleNextSleepSnapshotToolhelp32lstrcmpimemset
String ID: %s\%s$.sys$18.139.89.40$C:\Program Files\Windows Mail$Inject Test$MicrosoftMailUpdateTask$ParphaCrashReport64.exe$\drivers\$arphaDump64.bin$arphaDump64.dll$install.cfg$sys$temp.key
API String ID: 946687889-3621241513
Opcode ID: 8dbe50d77f5718792daa63e7825474cf3ac01c488a0ec9092139019c621d13d3
Instruction ID: 6ab1ac2c70caad825dfc093b1eae6746e03858c719bffa4d84152d2260ec190f
Opcode Fuzzy Hash: 8dbe50d77f5718792daa63e7825474cf3ac01c488a0ec9092139019c621d13d3
Instruction Fuzzy Hash: 45C14E32200AABD7EB25DFA1EC447DDA371F7A5B48F84C212C90A46665EF38C749C749

Function 000001845C4F9300 Relevance: 98.4, APIs: 53, Strings: 3, Instructions: 425stringprocessmemoryCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4F9315
memset.NTDLL ref: 000001845C4F9337
memset.NTDLL ref: 000001845C4F934B
GetCurrentProcess.KERNEL32 ref: 000001845C4F937A
OpenProcessToken.ADVAPI32 ref: 000001845C4F938D
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F93B5
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F93D7
GetLastError.KERNEL32 ref: 000001845C4F93DD
CloseHandle.KERNEL32 ref: 000001845C4F93F3
CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4F93FE
Process32FirstW.KERNEL32 ref: 000001845C4F9437
OpenProcess.KERNEL32 ref: 000001845C4F945B
memset.NTDLL ref: 000001845C4F9487
lstrcpyW.KERNEL32 ref: 000001845C4F9497
GetPriorityClass.KERNEL32 ref: 000001845C4F94A9
memset.NTDLL ref: 000001845C4F94D8
memset.NTDLL ref: 000001845C4F94EC
OpenProcessToken.ADVAPI32 ref: 000001845C4F9507
GetTokenInformation.ADVAPI32 ref: 000001845C4F9539
GlobalAlloc.KERNEL32 ref: 000001845C4F9554
GetTokenInformation.ADVAPI32 ref: 000001845C4F9585
LookupAccountSidW.ADVAPI32 ref: 000001845C4F95E1
LookupAccountSidW.ADVAPI32 ref: 000001845C4F963E
lstrcpyW.KERNEL32 ref: 000001845C4F9656
GlobalFree.KERNEL32 ref: 000001845C4F965F
CloseHandle.KERNEL32 ref: 000001845C4F966F
ProcessIdToSessionId.KERNEL32 ref: 000001845C4F967F
K32GetProcessMemoryInfo.KERNEL32 ref: 000001845C4F96B3
K32EnumProcessModules.KERNEL32 ref: 000001845C4F96E6
K32GetProcessImageFileNameW.KERNEL32 ref: 000001845C4F96FC
GetLogicalDriveStringsW.KERNEL32 ref: 000001845C4F971E
QueryDosDeviceW.KERNEL32 ref: 000001845C4F9774
lstrlenW.KERNEL32 ref: 000001845C4F9785
wcsncmp.NTDLL ref: 000001845C4F979F
lstrcpyW.KERNEL32 ref: 000001845C4F97D5
CreateFileW.KERNEL32 ref: 000001845C4F97FF
GetFileSize.KERNEL32 ref: 000001845C4F9813
CloseHandle.KERNEL32 ref: 000001845C4F982A
lstrcpyW.KERNEL32 ref: 000001845C4F983E
lstrcatW.KERNEL32 ref: 000001845C4F9856
CloseHandle.KERNEL32 ref: 000001845C4F9885
Process32NextW.KERNEL32 ref: 000001845C4F9892
GetCurrentProcess.KERNEL32 ref: 000001845C4F98B8
OpenProcessToken.ADVAPI32 ref: 000001845C4F98CD
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F98F1
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F9915
GetLastError.KERNEL32 ref: 000001845C4F991B
CloseHandle.KERNEL32 ref: 000001845C4F9931
CloseHandle.KERNEL32 ref: 000001845C4F993F
VirtualFree.KERNEL32 ref: 000001845C4F99D9
VirtualFree.KERNEL32 ref: 000001845C4F9A03
VirtualFree.KERNEL32 ref: 000001845C4F9A21
VirtualFree.KERNEL32 ref: 000001845C4F9A4B

Strings

H, xrefs: 000001845C4F96A3
SeDebugPrivilege, xrefs: 000001845C4F93A4, 000001845C4F98E4
unknown, xrefs: 000001845C4F9706

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$Token$CloseHandle$Freememset$LookupOpenVirtuallstrcpy$File$AccountAdjustCreateCurrentErrorGlobalInformationLastPrivilegePrivilegesProcess32Value$AllocClassDeviceDriveEnumFirstImageInfoLogicalMemoryModulesNameNextPriorityQuerySessionSizeSnapshotStringsToolhelp32__chkstklstrcatlstrlenwcsncmp
String ID: H$SeDebugPrivilege$unknown
API String ID: 976869081-3969872153
Opcode ID: 6a6d9660973f71720e87b200dc9c58f4d9867713f3a693197156d62844a92ba2
Instruction ID: 9f82c31e2c7568b2c87e75ad0a7f684a87b3a53f41341551b6bd8e16aead4708
Opcode Fuzzy Hash: 6a6d9660973f71720e87b200dc9c58f4d9867713f3a693197156d62844a92ba2
Instruction Fuzzy Hash: E522A332600B9687EB24CF61E8447DD73A1FB99B98F808316EA5947B98EF38C745C744

Function 000001845C4EEA40 Relevance: 77.3, APIs: 39, Strings: 5, Instructions: 330memorystringprocessCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4EEA54
memset.NTDLL ref: 000001845C4EEA78
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4EEA86
GetLastError.KERNEL32 ref: 000001845C4EEA90
lstrcatW.KERNEL32 ref: 000001845C4EEAA9
CreateFileW.KERNEL32 ref: 000001845C4EEB28
GetLastError.KERNEL32 ref: 000001845C4EEB37
WriteFile.KERNEL32 ref: 000001845C4EEB54
GetLastError.KERNEL32 ref: 000001845C4EEB5E
CloseHandle.KERNEL32 ref: 000001845C4EEB6C
CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4EEB83
GetProcessHeap.KERNEL32 ref: 000001845C4EEB92
HeapAlloc.KERNEL32 ref: 000001845C4EEBA6
CloseHandle.KERNEL32 ref: 000001845C4EEBB7
GetLastError.KERNEL32 ref: 000001845C4EEBBD
Process32FirstW.KERNEL32 ref: 000001845C4EEBFA
lstrcmpiW.KERNEL32 ref: 000001845C4EEC0F
Process32NextW.KERNEL32 ref: 000001845C4EEC2E
GetProcessHeap.KERNEL32 ref: 000001845C4EEC38
HeapFree.KERNEL32 ref: 000001845C4EEC46
CloseHandle.KERNEL32 ref: 000001845C4EEC54
memset.NTDLL ref: 000001845C4EEC69
memset.NTDLL ref: 000001845C4EEC7D
memset.NTDLL ref: 000001845C4EEC91
memset.NTDLL ref: 000001845C4EECA5
memset.NTDLL ref: 000001845C4EED41
memset.NTDLL ref: 000001845C4EED55
PathRemoveFileSpecW.SHLWAPI ref: 000001845C4EED6F
wsprintfW.USER32 ref: 000001845C4EED8D
CreateProcessW.KERNEL32 ref: 000001845C4EEDD3
CloseHandle.KERNEL32 ref: 000001845C4EEDE5
CloseHandle.KERNEL32 ref: 000001845C4EEDFA
memset.NTDLL ref: 000001845C4EEE18
wsprintfW.USER32 ref: 000001845C4EEE35
lstrlenW.KERNEL32 ref: 000001845C4EEE42
VirtualFree.KERNEL32 ref: 000001845C4EEF39
VirtualFree.KERNEL32 ref: 000001845C4EEF63
VirtualFree.KERNEL32 ref: 000001845C4EEF79
VirtualFree.KERNEL32 ref: 000001845C4EEFA3

Part of subcall function 000001845C4F6F00: IsBadReadPtr.KERNEL32 ref: 000001845C4F6F0E
Part of subcall function 000001845C4F6F00: EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F2B
Part of subcall function 000001845C4F6F00: VirtualFree.KERNELBASE(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F4F
Part of subcall function 000001845C4F6F00: LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F66
Part of subcall function 000001845C4F6F00: DeleteCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F70
Part of subcall function 000001845C4F6F00: VirtualFree.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F81

Strings

\rar.exe, xrefs: 000001845C4EEA96
rar.exe a "tdata_%d.rar" %s -m5, xrefs: 000001845C4EED7F
"tdata\key_datas" "tdata\D877F783D5D3EF8Cs" "tdata\D877F783D5D3EF8C\configs" "tdata\D877F783D5D3EF8C\maps" "tdata\A7FDF864FBC10B77, xrefs: 000001845C4EED75
Telegram.exe, xrefs: 000001845C4EEC08
%s\tdata_%d.rar, xrefs: 000001845C4EEE27

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memset$Free$Virtual$CloseHandle$ErrorHeapLast$CreateCriticalFileProcessSection$Process32wsprintf$AllocDeleteDirectoryEnterFirstLeaveNextPathReadRemoveSnapshotSpecToolhelp32WindowsWrite__chkstklstrcatlstrcmpilstrlen
String ID: "tdata\key_datas" "tdata\D877F783D5D3EF8Cs" "tdata\D877F783D5D3EF8C\configs" "tdata\D877F783D5D3EF8C\maps" "tdata\A7FDF864FBC10B77$%s\tdata_%d.rar$Telegram.exe$\rar.exe$rar.exe a "tdata_%d.rar" %s -m5
API String ID: 1825664495-2162963810
Opcode ID: 08fa0c8610ccb77aff50ece9baa1541d2cea37af8860a12628358939bf64a7d1
Instruction ID: d94f99b3b8208d82541a41e23b3f2df4e259abba0e6f1c034aa8e22557180a9e
Opcode Fuzzy Hash: 08fa0c8610ccb77aff50ece9baa1541d2cea37af8860a12628358939bf64a7d1
Instruction Fuzzy Hash: 38E19D32700B9697EB24DFA2E9447DD63A1FB9AB88F408215CE4A47B98DF38C345C745

Function 000001845C4E76E0 Relevance: 73.8, APIs: 26, Strings: 16, Instructions: 273memorythreadstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4E7709
GetSystemDirectoryW.KERNEL32 ref: 000001845C4E771A
GetLastError.KERNEL32 ref: 000001845C4E7724
lstrcatW.KERNEL32 ref: 000001845C4E78FB
IsBadReadPtr.KERNEL32 ref: 000001845C4E7910
EnterCriticalSection.KERNEL32 ref: 000001845C4E7926
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7949

Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,000001845C4E1B37), ref: 000001845C4F0697
Part of subcall function 000001845C4F0680: GetCurrentProcess.KERNEL32 ref: 000001845C4F06C8
Part of subcall function 000001845C4F0680: OpenProcessToken.ADVAPI32 ref: 000001845C4F06D9
Part of subcall function 000001845C4F0680: LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F0701
Part of subcall function 000001845C4F0680: AdjustTokenPrivileges.KERNELBASE ref: 000001845C4F0721
Part of subcall function 000001845C4F0680: GetLastError.KERNEL32 ref: 000001845C4F0727
Part of subcall function 000001845C4F0680: CloseHandle.KERNEL32 ref: 000001845C4F073B
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F0752
Part of subcall function 000001845C4F0680: InitializeCriticalSection.KERNEL32 ref: 000001845C4F0764
Part of subcall function 000001845C4F0680: IsBadReadPtr.KERNEL32 ref: 000001845C4F077D
Part of subcall function 000001845C4F0680: EnterCriticalSection.KERNEL32 ref: 000001845C4F0790
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F07A7
Part of subcall function 000001845C4F0680: LeaveCriticalSection.KERNEL32 ref: 000001845C4F07D6
Part of subcall function 000001845C4F0680: IsBadReadPtr.KERNEL32 ref: 000001845C4F07E8
Part of subcall function 000001845C4F0680: EnterCriticalSection.KERNEL32 ref: 000001845C4F07FB
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F0812

IsBadReadPtr.KERNEL32 ref: 000001845C4E79C4
EnterCriticalSection.KERNEL32 ref: 000001845C4E79D7
VirtualAlloc.KERNEL32 ref: 000001845C4E79EF
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7A13
CreateThread.KERNEL32 ref: 000001845C4E7A43
IsBadReadPtr.KERNEL32 ref: 000001845C4E7A67
EnterCriticalSection.KERNEL32 ref: 000001845C4E7A7A
VirtualAlloc.KERNEL32 ref: 000001845C4E7A91
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7AB5
memset.NTDLL ref: 000001845C4E7AD5
GetCurrentProcessId.KERNEL32 ref: 000001845C4E7ADA
wsprintfW.USER32 ref: 000001845C4E7AF4
IsBadReadPtr.KERNEL32 ref: 000001845C4E7B17
EnterCriticalSection.KERNEL32 ref: 000001845C4E7B2A
VirtualAlloc.KERNEL32 ref: 000001845C4E7B41
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7B65
CreateThread.KERNEL32 ref: 000001845C4E7B87
VirtualFree.KERNEL32 ref: 000001845C4E7BAD
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7BDD

Strings

V:V:, xrefs: 000001845C4E7747
I:N:, xrefs: 000001845C4E775F
j:H:, xrefs: 000001845C4E7792
\\.\Pipe\%d_pipe%d, xrefs: 000001845C4E7AE3
B:_:, xrefs: 000001845C4E7777
I:S:, xrefs: 000001845C4E77C4
:G:, xrefs: 000001845C4E786F
f:^:, xrefs: 000001845C4E773B
A:|:, xrefs: 000001845C4E77DA
_:I:, xrefs: 000001845C4E77BC
^:, xrefs: 000001845C4E77CC
{:~:, xrefs: 000001845C4E7845
:, xrefs: 000001845C4E7890
U:Y:, xrefs: 000001845C4E77B4
R:U:, xrefs: 000001845C4E7753
~:~:, xrefs: 000001845C4E784C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterLeaveRead$Process$CreateCurrentErrorLastThreadTokenmemset$AdjustCloseDirectoryFreeHandleInitializeLookupOpenPrivilegePrivilegesSystemValuelstrcatwsprintf
String ID: :G:$:$A:|:$B:_:$I:N:$I:S:$R:U:$U:Y:$V:V:$\\.\Pipe\%d_pipe%d$^:$_:I:$f:^:$j:H:${:~:$~:~:
API String ID: 1888231936-1994672154
Opcode ID: d1dc49243b75cc45df72bb56242f6d83b0d0b9c438548c6c26e7b7a07f614e83
Instruction ID: 20ce504eacf646f25851e58ed7774aef9c0973e047861bcb9b446a15f24958d5
Opcode Fuzzy Hash: d1dc49243b75cc45df72bb56242f6d83b0d0b9c438548c6c26e7b7a07f614e83
Instruction Fuzzy Hash: 99E1AB73604B91CBE7148F61E8007EEBBB0F795B98F459216DE9907A59EF38D284CB04

Function 000001845C4F7290 Relevance: 72.1, APIs: 38, Strings: 3, Instructions: 334stringnetworkmemoryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F72B9
lstrlenW.KERNEL32 ref: 000001845C4F72D6
lstrlenW.KERNEL32 ref: 000001845C4F72E9
GetCurrentProcess.KERNEL32 ref: 000001845C4F72FF
OpenProcessToken.ADVAPI32 ref: 000001845C4F7313
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F733B
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F735D
GetLastError.KERNEL32 ref: 000001845C4F7363
CloseHandle.KERNEL32 ref: 000001845C4F7379
GetExtendedTcpTable.IPHLPAPI ref: 000001845C4F739F
VirtualAlloc.KERNEL32 ref: 000001845C4F73B7
GetExtendedTcpTable.IPHLPAPI ref: 000001845C4F73EA
VirtualFree.KERNEL32 ref: 000001845C4F73FF
memset.NTDLL ref: 000001845C4F747F
lstrlenW.KERNEL32 ref: 000001845C4F749A
memset.NTDLL ref: 000001845C4F7519
inet_ntoa.WS2_32 ref: 000001845C4F7521
lstrcpyA.KERNEL32 ref: 000001845C4F752E
lstrlenA.KERNEL32 ref: 000001845C4F7538
htons.WS2_32 ref: 000001845C4F7567
memset.NTDLL ref: 000001845C4F75A6
inet_ntoa.WS2_32 ref: 000001845C4F75AE
lstrcpyA.KERNEL32 ref: 000001845C4F75BE
lstrlenA.KERNEL32 ref: 000001845C4F75CB
htons.WS2_32 ref: 000001845C4F75FD
memset.NTDLL ref: 000001845C4F762C
lstrlenW.KERNEL32 ref: 000001845C4F7647
VirtualFree.KERNEL32 ref: 000001845C4F769E
GetCurrentProcess.KERNEL32 ref: 000001845C4F76B4
OpenProcessToken.ADVAPI32 ref: 000001845C4F76C9
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F76EE
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F7712
GetLastError.KERNEL32 ref: 000001845C4F7718
CloseHandle.KERNEL32 ref: 000001845C4F772E
VirtualFree.KERNEL32 ref: 000001845C4F77D7
VirtualFree.KERNEL32 ref: 000001845C4F7801
VirtualFree.KERNEL32 ref: 000001845C4F781F
VirtualFree.KERNEL32 ref: 000001845C4F7849

Strings

TCP, xrefs: 000001845C4F72C1, 000001845C4F7500
SeDebugPrivilege, xrefs: 000001845C4F732A, 000001845C4F76E0
System, xrefs: 000001845C4F72DE

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Freelstrlen$memset$ProcessToken$AdjustCloseCurrentErrorExtendedHandleLastLookupOpenPrivilegePrivilegesTableValuehtonsinet_ntoalstrcpy$Alloc
String ID: SeDebugPrivilege$System$TCP
API String ID: 2139412910-32757284
Opcode ID: 384d3e7db38810127ba93bf50e6bd7a6e267d232edd2a4c281dac7082b692298
Instruction ID: 8d6277c870a552f8d83a9848704f5c7af2f372fc1522890840096eaa4a836adc
Opcode Fuzzy Hash: 384d3e7db38810127ba93bf50e6bd7a6e267d232edd2a4c281dac7082b692298
Instruction Fuzzy Hash: 9BF18F76310A9587EB24DF66E844BDE77B0F789B98F408216CA5A47B58DF38C248CB44

Function 000001845C4E6630 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 267stringfileprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E668C
VirtualFree.KERNEL32 ref: 000001845C4E66B6
VirtualAlloc.KERNEL32 ref: 000001845C4E671B
VirtualFree.KERNEL32 ref: 000001845C4E674D
VirtualFree.KERNEL32 ref: 000001845C4E6777
memcpy.NTDLL ref: 000001845C4E679D
memcpy.NTDLL ref: 000001845C4E6848
memset.NTDLL ref: 000001845C4E6859
memset.NTDLL ref: 000001845C4E686D
lstrcatW.KERNEL32 ref: 000001845C4E687D
lstrcatW.KERNEL32 ref: 000001845C4E688E
lstrcatW.KERNEL32 ref: 000001845C4E689F
lstrcatW.KERNEL32 ref: 000001845C4E68B0
lstrcatW.KERNEL32 ref: 000001845C4E68C4
MoveFileW.KERNEL32 ref: 000001845C4E68D5
CreateFileW.KERNEL32 ref: 000001845C4E6909
GetLastError.KERNEL32 ref: 000001845C4E6918
WriteFile.KERNEL32 ref: 000001845C4E6937
GetLastError.KERNEL32 ref: 000001845C4E6941
CloseHandle.KERNEL32 ref: 000001845C4E6951
MoveFileW.KERNEL32 ref: 000001845C4E6966
VirtualFree.KERNEL32 ref: 000001845C4E6977
CloseHandle.KERNEL32 ref: 000001845C4E698A
DeleteFileW.KERNEL32 ref: 000001845C4E6997
VirtualFree.KERNEL32 ref: 000001845C4E69A8
memset.NTDLL ref: 000001845C4E69FD
lstrcatW.KERNEL32 ref: 000001845C4E6A10
lstrcatW.KERNEL32 ref: 000001845C4E6A24
lstrcatW.KERNEL32 ref: 000001845C4E6A38
CreateProcessW.KERNEL32 ref: 000001845C4E6A78
GetLastError.KERNEL32 ref: 000001845C4E6A82
CloseHandle.KERNEL32 ref: 000001845C4E6A92
CloseHandle.KERNEL32 ref: 000001845C4E6AA7
GetCurrentProcess.KERNEL32 ref: 000001845C4E6AB2
TerminateProcess.KERNEL32 ref: 000001845C4E6AC0

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E6872, 000001845C4E6A02
arphaDump64.bin, xrefs: 000001845C4E6894
.bak, xrefs: 000001845C4E68B6
18.139.89.40, xrefs: 000001845C4E6790
ParphaCrashReport64.exe, xrefs: 000001845C4E6A2A
h, xrefs: 000001845C4E69C7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$lstrcat$AllocCriticalFreeSection$File$CloseHandle$EnterErrorLastProcessReadmemset$CreateLeaveMovememcpy$CurrentDeleteInitializeTerminateWrite
String ID: .bak$18.139.89.40$C:\Program Files\Windows Mail$ParphaCrashReport64.exe$arphaDump64.bin$h
API String ID: 2211108363-2823075684
Opcode ID: f313ddb08190d7dbab8043538d75833c288af8143399ff6012ff730f18fde2a1
Instruction ID: 92e861b1de5cff73e44cb5ed11c8745a511073350e7177d4ebdad224838e7f76
Opcode Fuzzy Hash: f313ddb08190d7dbab8043538d75833c288af8143399ff6012ff730f18fde2a1
Instruction Fuzzy Hash: B7D1D132710B9687EB24CF71E8447ED6361FB99B88F40D316DA4A17A69EF38C255C348

Function 000001845C4F7870 Relevance: 66.8, APIs: 34, Strings: 4, Instructions: 324stringmemorynetworkCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F7899
lstrlenW.KERNEL32 ref: 000001845C4F78B6
lstrlenW.KERNEL32 ref: 000001845C4F78C9
GetCurrentProcess.KERNEL32 ref: 000001845C4F78DF
OpenProcessToken.ADVAPI32 ref: 000001845C4F78F3
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F791B
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F793D
GetLastError.KERNEL32 ref: 000001845C4F7943
CloseHandle.KERNEL32 ref: 000001845C4F7959
GetExtendedUdpTable.IPHLPAPI ref: 000001845C4F797F
VirtualAlloc.KERNEL32 ref: 000001845C4F7997
GetExtendedUdpTable.IPHLPAPI ref: 000001845C4F79CA
VirtualFree.KERNEL32 ref: 000001845C4F79DF
memset.NTDLL ref: 000001845C4F7A5F
lstrlenW.KERNEL32 ref: 000001845C4F7A7A
memset.NTDLL ref: 000001845C4F7AF9
inet_ntoa.WS2_32 ref: 000001845C4F7B01
lstrcpyA.KERNEL32 ref: 000001845C4F7B0E
lstrlenA.KERNEL32 ref: 000001845C4F7B18
htons.WS2_32 ref: 000001845C4F7B47
lstrlenA.KERNEL32 ref: 000001845C4F7B84
memset.NTDLL ref: 000001845C4F7BDB
lstrlenW.KERNEL32 ref: 000001845C4F7BF6
VirtualFree.KERNEL32 ref: 000001845C4F7C4D
GetCurrentProcess.KERNEL32 ref: 000001845C4F7C63
OpenProcessToken.ADVAPI32 ref: 000001845C4F7C78
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F7C9D
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F7CC1
GetLastError.KERNEL32 ref: 000001845C4F7CC7
CloseHandle.KERNEL32 ref: 000001845C4F7CDD
VirtualFree.KERNEL32 ref: 000001845C4F7D84
VirtualFree.KERNEL32 ref: 000001845C4F7DAE
VirtualFree.KERNEL32 ref: 000001845C4F7DCC
VirtualFree.KERNEL32 ref: 000001845C4F7DF6

Part of subcall function 000001845C4F6F00: IsBadReadPtr.KERNEL32 ref: 000001845C4F6F0E
Part of subcall function 000001845C4F6F00: EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F2B
Part of subcall function 000001845C4F6F00: VirtualFree.KERNELBASE(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F4F
Part of subcall function 000001845C4F6F00: LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F66
Part of subcall function 000001845C4F6F00: DeleteCriticalSection.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F70
Part of subcall function 000001845C4F6F00: VirtualFree.KERNEL32(?,?,00000000,000001845C4E1E65), ref: 000001845C4F6F81

Strings

SeDebugPrivilege, xrefs: 000001845C4F790A, 000001845C4F7C8F
UDP, xrefs: 000001845C4F78A1, 000001845C4F7AE0
System, xrefs: 000001845C4F78BE
0.0.0.0, xrefs: 000001845C4F7B7D, 000001845C4F7BA4

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$lstrlen$ProcessTokenmemset$CriticalSection$AdjustCloseCurrentErrorExtendedHandleLastLookupOpenPrivilegePrivilegesTableValue$AllocDeleteEnterLeaveReadhtonsinet_ntoalstrcpy
String ID: 0.0.0.0$SeDebugPrivilege$System$UDP
API String ID: 3759433425-459619966
Opcode ID: 2bc8028b07d01d9ba69e09a3802a839e12856a2c9f2d2d692c2ea6f1d234ecb0
Instruction ID: 6072c5dda7ee4d97fa871a10c0060a0dd374e28672bf7c5220c29cb99e6c07db
Opcode Fuzzy Hash: 2bc8028b07d01d9ba69e09a3802a839e12856a2c9f2d2d692c2ea6f1d234ecb0
Instruction Fuzzy Hash: 18F17D76310B9187EB24DF62E8547DE77B1F789B98F809216CA4A47B58DF38C248CB44

Function 000001845C4F8880 Relevance: 63.3, APIs: 26, Strings: 10, Instructions: 311stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F88D0
VirtualFree.KERNEL32 ref: 000001845C4F88FA
VirtualAlloc.KERNEL32 ref: 000001845C4F8949
IsBadReadPtr.KERNEL32 ref: 000001845C4F89AB
EnterCriticalSection.KERNEL32 ref: 000001845C4F89D3
LeaveCriticalSection.KERNEL32 ref: 000001845C4F89F6
IsBadReadPtr.KERNEL32 ref: 000001845C4F8A5C
VirtualAlloc.KERNEL32 ref: 000001845C4F8A92
VirtualFree.KERNEL32 ref: 000001845C4F8AC1
VirtualFree.KERNEL32 ref: 000001845C4F8AEB
memset.NTDLL ref: 000001845C4F8B00
lstrcatA.KERNEL32 ref: 000001845C4F8B21
LeaveCriticalSection.KERNEL32 ref: 000001845C4F8B3E
lstrcatW.KERNEL32 ref: 000001845C4F8B66
memcpy.NTDLL ref: 000001845C4F8C20
memset.NTDLL ref: 000001845C4F8C46
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4F8C5D
GetLastError.KERNEL32 ref: 000001845C4F8C67
lstrcatW.KERNEL32 ref: 000001845C4F8C78
GetSystemDirectoryW.KERNEL32 ref: 000001845C4F8C90
GetLastError.KERNEL32 ref: 000001845C4F8C9A
lstrcatW.KERNEL32 ref: 000001845C4F8D1D
lstrcatW.KERNEL32 ref: 000001845C4F8D2E
lstrcatW.KERNEL32 ref: 000001845C4F8D3B
VirtualFree.KERNEL32 ref: 000001845C4F8D8B
VirtualFree.KERNEL32 ref: 000001845C4F8D9C

Strings

\syswow64, xrefs: 000001845C4F8C6D
TCP, xrefs: 000001845C4F8B32
I:N:, xrefs: 000001845C4F8CCB
R:U:, xrefs: 000001845C4F8CBD
UDP, xrefs: 000001845C4F8B4D
B:_:, xrefs: 000001845C4F8CDB
HTTP, xrefs: 000001845C4F8B58
f:^:, xrefs: 000001845C4F8CB8
:, xrefs: 000001845C4F8CE3
V:V:, xrefs: 000001845C4F8CB0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Freelstrcat$Read$EnterLeave$DirectoryErrorLastmemset$InitializeSystemWindowsmemcpy
String ID: :$B:_:$HTTP$I:N:$R:U:$TCP$UDP$V:V:$\syswow64$f:^:
API String ID: 1846020110-2823427824
Opcode ID: e9a6c1f68d46521105151d4f1ece7a9abb65f008cd8859d4eff4fac00e1c520e
Instruction ID: 42946c8f20094921fd708f5c627bdb64249f0c9afd15bfcd2357cd910dcb922c
Opcode Fuzzy Hash: e9a6c1f68d46521105151d4f1ece7a9abb65f008cd8859d4eff4fac00e1c520e
Instruction Fuzzy Hash: 96E1BF32710A9687EB24CF66D844BEDB7A1FB9AB84F84C211DE4A4BB54DF38D644C704

Function 000001845C4E8DA0 Relevance: 63.2, APIs: 28, Strings: 8, Instructions: 243memorystringprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E8DF9
VirtualFree.KERNEL32 ref: 000001845C4E8E23
memset.NTDLL ref: 000001845C4E8E60
lstrcatA.KERNEL32 ref: 000001845C4E8E81
lstrcatW.KERNEL32 ref: 000001845C4E8EB4
memcpy.NTDLL ref: 000001845C4E8F7B
memset.NTDLL ref: 000001845C4E8FA4
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4E8FB6
GetLastError.KERNEL32 ref: 000001845C4E8FC0
lstrcatW.KERNEL32 ref: 000001845C4E8FD2
GetSystemDirectoryW.KERNEL32 ref: 000001845C4E8FE7
GetLastError.KERNEL32 ref: 000001845C4E8FF1
lstrcatW.KERNEL32 ref: 000001845C4E9003
CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4E9015
GetProcessHeap.KERNEL32 ref: 000001845C4E9024
HeapAlloc.KERNEL32 ref: 000001845C4E9038
CloseHandle.KERNEL32 ref: 000001845C4E9049
WTSGetActiveConsoleSessionId.KERNEL32 ref: 000001845C4E9059
Process32FirstW.KERNEL32 ref: 000001845C4E906A
lstrcmpiW.KERNEL32 ref: 000001845C4E907F
Process32NextW.KERNEL32 ref: 000001845C4E908F
GetProcessHeap.KERNEL32 ref: 000001845C4E909F
HeapFree.KERNEL32 ref: 000001845C4E90AD
CloseHandle.KERNEL32 ref: 000001845C4E90B6
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E90CB
VirtualFree.KERNEL32 ref: 000001845C4E9115
VirtualFree.KERNEL32 ref: 000001845C4E9145
VirtualFree.KERNEL32 ref: 000001845C4E9163

Strings

explorer.exe, xrefs: 000001845C4E9078
\syswow64, xrefs: 000001845C4E8FC6
\dllhost.exe, xrefs: 000001845C4E8FF7
TCP, xrefs: 000001845C4E8E92
UDP, xrefs: 000001845C4E8E9B
@, xrefs: 000001845C4E8FDA
HTTP, xrefs: 000001845C4E8EA6
, xrefs: 000001845C4E8FA9

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalFreeSection$Heaplstrcat$EnterProcessRead$CloseDirectoryErrorHandleLastLeaveProcess32Sessionmemset$ActiveConsoleCreateFirstInitializeNextSnapshotSystemToolhelp32Windowslstrcmpimemcpy
String ID: $@$HTTP$TCP$UDP$\dllhost.exe$\syswow64$explorer.exe
API String ID: 2239626338-2826464075
Opcode ID: 5757aa08a514de2e174b95a11b239ba89f8451405a39913d70d3799bc8b63680
Instruction ID: 936c318d8bb76c10f9edc0e9f4b44dd6d277d331021b6920636caa95345f5202
Opcode Fuzzy Hash: 5757aa08a514de2e174b95a11b239ba89f8451405a39913d70d3799bc8b63680
Instruction Fuzzy Hash: 06B1B432700B9683FB258F76D9447EDA3A1FB99B84F84C315DA4A47A95EF38C245C348

Function 000001845C4F9E10 Relevance: 59.8, APIs: 30, Strings: 4, Instructions: 347stringmemoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F9EBC
GetLastError.KERNEL32 ref: 000001845C4F9ECA
VirtualFree.KERNEL32 ref: 000001845C4F9EEA
VirtualFree.KERNEL32 ref: 000001845C4F9F14
GetLastError.KERNEL32 ref: 000001845C4F9F1A
memset.NTDLL ref: 000001845C4F9F5A
lstrcatW.KERNEL32 ref: 000001845C4FA020
lstrcatW.KERNEL32 ref: 000001845C4FA034
lstrcatW.KERNEL32 ref: 000001845C4FA048
memset.NTDLL ref: 000001845C4FA05D
memset.NTDLL ref: 000001845C4FA071
memcpy.NTDLL ref: 000001845C4FA18B
VirtualFree.KERNEL32 ref: 000001845C4FA1D4
VirtualFree.KERNEL32 ref: 000001845C4FA1EA
VirtualFree.KERNEL32 ref: 000001845C4FA214
VirtualFree.KERNEL32 ref: 000001845C4FA225
OpenProcess.KERNEL32 ref: 000001845C4FA25A
VirtualAllocEx.KERNEL32 ref: 000001845C4FA28D
WriteProcessMemory.KERNEL32 ref: 000001845C4FA2B6
CreateRemoteThread.KERNEL32 ref: 000001845C4FA2E0
VirtualFree.KERNEL32 ref: 000001845C4FA2FF
VirtualFree.KERNEL32 ref: 000001845C4FA329
VirtualFree.KERNEL32 ref: 000001845C4FA33A
GetLastError.KERNEL32 ref: 000001845C4FA34F

Part of subcall function 000001845C4F9220: VirtualFree.KERNEL32 ref: 000001845C4F92AE
Part of subcall function 000001845C4F9220: VirtualFree.KERNEL32 ref: 000001845C4F92D8

VirtualFree.KERNEL32 ref: 000001845C4FA36F
VirtualFree.KERNEL32 ref: 000001845C4FA399
VirtualFree.KERNEL32 ref: 000001845C4FA3AA
GetLastError.KERNEL32 ref: 000001845C4FA3B0
VirtualFree.KERNEL32 ref: 000001845C4FA3C8
VirtualFree.KERNEL32 ref: 000001845C4FA3F2

Strings

:, xrefs: 000001845C4FA160
18.139.89.40, xrefs: 000001845C4F9F69
Inject Test, xrefs: 000001845C4F9FC6, 000001845C4FA026, 000001845C4FA03A
@, xrefs: 000001845C4FA282

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$ErrorLast$lstrcatmemset$AllocProcess$CreateMemoryOpenRemoteThreadWritememcpy
String ID: 18.139.89.40$:$@$Inject Test
API String ID: 1625309433-3053173843
Opcode ID: 5566dcc5605b0a6cd22809c0907e2384aa0d6f53cf907175bde78d5295b26e8a
Instruction ID: 75599436faed15a21e071ca58675c9fd74d6aaaac53634a0fb8bab240016c077
Opcode Fuzzy Hash: 5566dcc5605b0a6cd22809c0907e2384aa0d6f53cf907175bde78d5295b26e8a
Instruction Fuzzy Hash: E6F18D32B15BC287E724CF35D810BED73A1FBAAB88F44D315DA4946A59EF389284C744

Function 000001845C4F9A70 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 204stringsleeplibraryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F9AB5
memset.NTDLL ref: 000001845C4F9AC9
VirtualFree.KERNEL32 ref: 000001845C4F9B00
VirtualFree.KERNEL32 ref: 000001845C4F9B42
GetModuleHandleW.KERNEL32 ref: 000001845C4F9B4F
GetProcAddress.KERNEL32 ref: 000001845C4F9B6B
GetProcAddress.KERNEL32 ref: 000001845C4F9B7E
GetCurrentProcess.KERNEL32 ref: 000001845C4F9B95
OpenProcessToken.ADVAPI32 ref: 000001845C4F9BA8
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F9BD0
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4F9BF2
GetLastError.KERNEL32 ref: 000001845C4F9BF8
CloseHandle.KERNEL32 ref: 000001845C4F9C0C
OpenProcess.KERNEL32 ref: 000001845C4F9C20
K32EnumProcessModules.KERNEL32 ref: 000001845C4F9C3E
K32GetProcessImageFileNameW.KERNEL32 ref: 000001845C4F9C51
GetLogicalDriveStringsW.KERNEL32 ref: 000001845C4F9C73
QueryDosDeviceW.KERNEL32 ref: 000001845C4F9CC3
lstrlenW.KERNEL32 ref: 000001845C4F9CD2
wcsncmp.NTDLL ref: 000001845C4F9CE7
lstrcpyW.KERNEL32 ref: 000001845C4F9D1B
TerminateProcess.KERNEL32 ref: 000001845C4F9D51
Sleep.KERNEL32 ref: 000001845C4F9D60
DeleteFileW.KERNEL32 ref: 000001845C4F9D6D
lstrcpyW.KERNEL32 ref: 000001845C4F9D81
lstrcatW.KERNEL32 ref: 000001845C4F9D96
CloseHandle.KERNEL32 ref: 000001845C4F9DC1
Sleep.KERNEL32 ref: 000001845C4F9DCC

Strings

ntdll.dll, xrefs: 000001845C4F9B48
NtSuspendProcess, xrefs: 000001845C4F9B61
SeDebugPrivilege, xrefs: 000001845C4F9BBF
NtResumeProcess, xrefs: 000001845C4F9B71

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$Handle$AddressCloseFileFreeOpenProcSleepTokenVirtuallstrcpymemset$AdjustCurrentDeleteDeviceDriveEnumErrorImageLastLogicalLookupModuleModulesNamePrivilegePrivilegesQueryStringsTerminateValuelstrcatlstrlenwcsncmp
String ID: NtResumeProcess$NtSuspendProcess$SeDebugPrivilege$ntdll.dll
API String ID: 335747669-263106891
Opcode ID: 0323485f620a88985792f302705c0bf60f5310987a287480cf63306c896622fa
Instruction ID: f3197051485fedc0ca87157b2d918fa8f2b333e413703a3c5d74fee0b059c2f3
Opcode Fuzzy Hash: 0323485f620a88985792f302705c0bf60f5310987a287480cf63306c896622fa
Instruction Fuzzy Hash: 3FA1E631210A9683EB64DF61E8447DD73A0FB95F48F80C216DA4A477A8EF38C749C798

Function 000001845C4EE550 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 289memorystringfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4EE58B
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4EE599
GetLastError.KERNEL32 ref: 000001845C4EE5A3
lstrcatW.KERNEL32 ref: 000001845C4EE5D4
CreateFileW.KERNEL32 ref: 000001845C4EE643
GetLastError.KERNEL32 ref: 000001845C4EE652
WriteFile.KERNEL32 ref: 000001845C4EE66F
GetLastError.KERNEL32 ref: 000001845C4EE679
CloseHandle.KERNEL32 ref: 000001845C4EE687
VirtualAlloc.KERNEL32 ref: 000001845C4EE6DD
VirtualAlloc.KERNEL32 ref: 000001845C4EE795
lstrlenW.KERNEL32 ref: 000001845C4EE7C4
lstrlenW.KERNEL32 ref: 000001845C4EE7F2
VirtualFree.KERNEL32 ref: 000001845C4EE814
VirtualAlloc.KERNEL32 ref: 000001845C4EE840
VirtualAlloc.KERNEL32 ref: 000001845C4EE875
wsprintfW.USER32 ref: 000001845C4EE897
VirtualAlloc.KERNEL32 ref: 000001845C4EE8EF
lstrcatW.KERNEL32 ref: 000001845C4EE907
PathRemoveFileSpecW.SHLWAPI ref: 000001845C4EE910
CreateProcessW.KERNEL32 ref: 000001845C4EE94C
CloseHandle.KERNEL32 ref: 000001845C4EE95C
CloseHandle.KERNEL32 ref: 000001845C4EE971
VirtualFree.KERNEL32 ref: 000001845C4EE987
VirtualFree.KERNEL32 ref: 000001845C4EE998
VirtualFree.KERNEL32 ref: 000001845C4EE9A9
VirtualFree.KERNEL32 ref: 000001845C4EE9BA
VirtualFree.KERNEL32 ref: 000001845C4EE9D0
VirtualFree.KERNEL32 ref: 000001845C4EE9FA

Strings

\rar.exe, xrefs: 000001845C4EE5B1
rar.exe a "%s" %s -m5, xrefs: 000001845C4EE88A
h, xrefs: 000001845C4EE8DE

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$CloseErrorFileHandleLast$Createlstrcatlstrlen$DirectoryPathProcessRemoveSpecWindowsWritememsetwsprintf
String ID: \rar.exe$h$rar.exe a "%s" %s -m5
API String ID: 460989278-1571478729
Opcode ID: d6fa1d8524bb85152559a8366e61b1b4fff8d11480b6a2d1cb8cd4eedd6e302b
Instruction ID: e2fbdecf61e0fb942767ecf5abb77764f15f048ed007a063d6527037c42ffe07
Opcode Fuzzy Hash: d6fa1d8524bb85152559a8366e61b1b4fff8d11480b6a2d1cb8cd4eedd6e302b
Instruction Fuzzy Hash: B1D17032310AA287EB648F62E9587DD73A1F799F88F45C225CE4A47B58DF38C644C744

Function 000001845C4FBDC0 Relevance: 52.9, APIs: 5, Strings: 25, Instructions: 441stringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4FC5CE
lstrcatW.KERNEL32 ref: 000001845C4FC5F9
lstrcatW.KERNEL32 ref: 000001845C4FC61F
lstrcatW.KERNEL32 ref: 000001845C4FC72A
lstrcatW.KERNEL32 ref: 000001845C4FC73A

Strings

U:M:, xrefs: 000001845C4FC508
Windows 2003, xrefs: 000001845C4FC611
H:L:, xrefs: 000001845C4FC21E
:, xrefs: 000001845C4FC24D
T:I:, xrefs: 000001845C4FBE02
_:H:, xrefs: 000001845C4FBECC
N:[:, xrefs: 000001845C4FBE22
U:M:, xrefs: 000001845C4FBEB7
T:^:, xrefs: 000001845C4FC500
_:H:, xrefs: 000001845C4FC226
:, xrefs: 000001845C4FBE2A
i:_:, xrefs: 000001845C4FC216
:U:M:m:S:, xrefs: 000001845C4FBF6F
_:H:i:_:U:M:m:S:, xrefs: 000001845C4FBE55
Windows XP, xrefs: 000001845C4FC5EB
m:S:, xrefs: 000001845C4FBE15
::, xrefs: 000001845C4FBFF1
L:_:, xrefs: 000001845C4FBED3
U:M:, xrefs: 000001845C4FC206
m:S:, xrefs: 000001845C4FBFDF
T:^:, xrefs: 000001845C4FC1FE
T:I:, xrefs: 000001845C4FBEBE
:, xrefs: 000001845C4FC547
T:^:, xrefs: 000001845C4FBEAF
m:S:, xrefs: 000001845C4FBE9F

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcat$memset
String ID: ::$:U:M:m:S:$:$:$:$H:L:$L:_:$N:[:$T:I:$T:I:$T:^:$T:^:$T:^:$U:M:$U:M:$U:M:$Windows 2003$Windows XP$_:H:$_:H:$_:H:i:_:U:M:m:S:$i:_:$m:S:$m:S:$m:S:
API String ID: 2788080104-1869930141
Opcode ID: 89cf57517cdc68ef62da7d3c9f9d36e19b96a16481536b5742197b23cda8ce07
Instruction ID: 3209f0c0310a924eedcc98963ad7d168b0a569009cdc6da933647491b931516b
Opcode Fuzzy Hash: 89cf57517cdc68ef62da7d3c9f9d36e19b96a16481536b5742197b23cda8ce07
Instruction Fuzzy Hash: 444228735186C1CEE331CF64E4406DEBBB0F796748F14920AE7991AA59EB78E284CF05

Function 000001845C4E5150 Relevance: 52.7, APIs: 22, Strings: 8, Instructions: 248stringfilethreadCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4E5186
wsprintfW.USER32 ref: 000001845C4E51A5
CreateFileW.KERNEL32 ref: 000001845C4E51E3
GetFileSize.KERNEL32 ref: 000001845C4E51FA
ReadFile.KERNEL32 ref: 000001845C4E5221
CloseHandle.KERNEL32 ref: 000001845C4E52AF
SetThreadExecutionState.KERNEL32 ref: 000001845C4E52C5
SystemParametersInfoW.USER32 ref: 000001845C4E52D6
SystemParametersInfoW.USER32 ref: 000001845C4E52E7
lstrlenW.KERNEL32 ref: 000001845C4E5326
lstrlenA.KERNEL32 ref: 000001845C4E533B
lstrcmpiW.KERNEL32 ref: 000001845C4E5353
lstrcmpiW.KERNEL32 ref: 000001845C4E5375
lstrcmpiW.KERNEL32 ref: 000001845C4E5396
htons.WS2_32 ref: 000001845C4E53CE
VirtualFree.KERNEL32 ref: 000001845C4E53F7
VirtualAlloc.KERNEL32 ref: 000001845C4E5450
CreateThread.KERNEL32 ref: 000001845C4E54A0
VirtualFree.KERNEL32 ref: 000001845C4E54DA
VirtualFree.KERNEL32 ref: 000001845C4E5504
VirtualFree.KERNEL32 ref: 000001845C4E551C
WaitForSingleObject.KERNEL32 ref: 000001845C4E554A

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E5192
%s\%s, xrefs: 000001845C4E5199
PTCP, xrefs: 000001845C4E52B8
TCP, xrefs: 000001845C4E536E
install.cfg, xrefs: 000001845C4E518B
UDP, xrefs: 000001845C4E534C
HTTP, xrefs: 000001845C4E538F
18.139.89.40, xrefs: 000001845C4E51B0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$Filelstrcmpi$CreateInfoParametersSystemThreadlstrlen$AllocCloseExecutionHandleObjectReadSingleSizeStateWaithtonsmemsetwsprintf
String ID: %s\%s$18.139.89.40$C:\Program Files\Windows Mail$HTTP$PTCP$TCP$UDP$install.cfg
API String ID: 1274318034-1750346968
Opcode ID: 663568433656cea89e63caccbc2b97e320fd9943314f34955629d2a210d6f6f0
Instruction ID: 279198e5256eebe434b84e88c2fc52f54e3657562092c87de20093b324365a66
Opcode Fuzzy Hash: 663568433656cea89e63caccbc2b97e320fd9943314f34955629d2a210d6f6f0
Instruction Fuzzy Hash: 2EB19A71600B6687EB54CFA2E844BDEB7A1FB99B84F458325CD4A43754EF38C648C748

Function 000001845C4FF890 Relevance: 50.0, APIs: 33, Instructions: 451servicestringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

OpenSCManagerW.ADVAPI32 ref: 000001845C4FF8DA
EnumServicesStatusW.ADVAPI32 ref: 000001845C4FF91C
LocalAlloc.KERNEL32 ref: 000001845C4FF92D
EnumServicesStatusW.ADVAPI32 ref: 000001845C4FF986
memset.NTDLL ref: 000001845C4FF9AC
OpenServiceW.ADVAPI32 ref: 000001845C4FF9C9
lstrlenW.KERNEL32 ref: 000001845C4FF9E0
memcpy.NTDLL ref: 000001845C4FFA85
lstrlenW.KERNEL32 ref: 000001845C4FFA8F
memcpy.NTDLL ref: 000001845C4FFB12
VirtualAlloc.KERNEL32 ref: 000001845C4FFB28
QueryServiceConfig2W.ADVAPI32 ref: 000001845C4FFB57
lstrlenW.KERNEL32 ref: 000001845C4FFB69
memcpy.NTDLL ref: 000001845C4FFBEF
CloseServiceHandle.ADVAPI32 ref: 000001845C4FFF40
LocalFree.KERNEL32 ref: 000001845C4FFF49
VirtualFree.KERNEL32 ref: 000001845C4FFFF5
VirtualFree.KERNEL32 ref: 000001845C50001F
VirtualFree.KERNEL32 ref: 000001845C500035
VirtualFree.KERNEL32 ref: 000001845C50005F

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalSection$Free$EnterReadServicelstrlenmemcpy$EnumLeaveLocalOpenServicesStatus$CloseConfig2HandleInitializeManagerQuerymemset
String ID:
API String ID: 1976463032-0
Opcode ID: e31869551b353607aec46271203f30b5e22ed9872d805ff8829a815e3cabd60d
Instruction ID: a2685cfbf0fc5e2b1515055897b777ef9423c0977dfd28e286cfe3fa25aead5a
Opcode Fuzzy Hash: e31869551b353607aec46271203f30b5e22ed9872d805ff8829a815e3cabd60d
Instruction Fuzzy Hash: 3C326B66A14BC587E715CF29D9447EC73A0F7AAB88F54E315CF8912A26EF35A2D4C300

Function 000001845C529E90 Relevance: 49.4, APIs: 14, Strings: 14, Instructions: 427networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C526480: memcpy.NTDLL(?,?,Unable to connect,000001845C529EE8), ref: 000001845C526573
Part of subcall function 000001845C526480: memcpy.NTDLL(?,?,Unable to connect,000001845C529EE8), ref: 000001845C526591

Part of subcall function 000001845C52F0A0: memcpy.NTDLL(?,?,?,?,?,?,?,?,Unable to connect,000001845C529EF3), ref: 000001845C52F0F8

freeaddrinfo.WS2_32 ref: 000001845C529EF6
connect.WS2_32 ref: 000001845C529FF7
WSAGetLastError.WS2_32 ref: 000001845C52A005
WSAGetLastError.WS2_32 ref: 000001845C52A050
strncpy.MSVCRT ref: 000001845C52A0A9
htons.WS2_32 ref: 000001845C52A102
socket.WS2_32 ref: 000001845C52A179
WSAGetLastError.WS2_32 ref: 000001845C52A18B
WSAGetLastError.WS2_32 ref: 000001845C52A1D6
closesocket.WS2_32 ref: 000001845C52A4B3
getsockname.WS2_32 ref: 000001845C52A57F

Strings

conn fail: %d, xrefs: 000001845C52A056
lws_free, xrefs: 000001845C52A0E7
client_connect3, xrefs: 000001845C52A4FA
POST, xrefs: 000001845C529E95
conn fail: change pollfd, xrefs: 000001845C52A28A
conn fail: skt options: errno %d, xrefs: 000001845C52A1DC
conn fail: sock accept, xrefs: 000001845C52A23A
conn fail: socket bind, xrefs: 000001845C52A31D
waiting for event loop watcher to close, xrefs: 000001845C52A52B
conn fail: skt creation: errno %d, xrefs: 000001845C52A191
Unable to connect, xrefs: 000001845C529EAE, 000001845C52A367, 000001845C52A42F, 000001845C52A441, 000001845C52A489
conn fail: insert fd, xrefs: 000001845C52A26D
GET, xrefs: 000001845C529E99
RAW, xrefs: 000001845C529E97

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$memcpy$closesocketconnectfreeaddrinfogetsocknamehtonssocketstrncpy
String ID: GET$POST$RAW$Unable to connect$client_connect3$conn fail: %d$conn fail: change pollfd$conn fail: insert fd$conn fail: skt creation: errno %d$conn fail: skt options: errno %d$conn fail: sock accept$conn fail: socket bind$lws_free$waiting for event loop watcher to close
API String ID: 3000816023-458479724
Opcode ID: 45b74619e095686916e0e6cf39154984f1e692daa841b6c70865dabd898a1b92
Instruction ID: 6006729060838bc4a7cd8bbd2eafa0bd0f939fa7e99a5df2ab3374e1f787e082
Opcode Fuzzy Hash: 45b74619e095686916e0e6cf39154984f1e692daa841b6c70865dabd898a1b92
Instruction Fuzzy Hash: 2512C1322107AB83EB65DFA1D4443EDA3A0F7A4B88F449232DE4957699DF38C785C358

Function 000001845C4E8780 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 274memoryfilestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4E8798
lstrcatW.KERNEL32 ref: 000001845C4E87A9
lstrcatW.KERNEL32 ref: 000001845C4E87BB
CreateFileW.KERNEL32 ref: 000001845C4E87F3
GetFileSize.KERNEL32 ref: 000001845C4E881B
VirtualAlloc.KERNEL32 ref: 000001845C4E8832
ReadFile.KERNEL32 ref: 000001845C4E885A
VirtualFree.KERNEL32 ref: 000001845C4E894C
VirtualAlloc.KERNEL32 ref: 000001845C4E89A8
VirtualAlloc.KERNEL32 ref: 000001845C4E8A10
IsBadReadPtr.KERNEL32 ref: 000001845C4E8A5A
EnterCriticalSection.KERNEL32 ref: 000001845C4E8A70
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8A95
IsBadReadPtr.KERNEL32 ref: 000001845C4E8AAA
EnterCriticalSection.KERNEL32 ref: 000001845C4E8ABD
VirtualAlloc.KERNEL32 ref: 000001845C4E8AD4
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8AF8
VirtualFree.KERNEL32 ref: 000001845C4E8B3D
VirtualFree.KERNEL32 ref: 000001845C4E8B67
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8B7A
IsBadReadPtr.KERNEL32 ref: 000001845C4E8B99
EnterCriticalSection.KERNEL32 ref: 000001845C4E8BB4
GetLastError.KERNEL32 ref: 000001845C4E8BE2
CloseHandle.KERNEL32 ref: 000001845C4E8C00

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E879D
@, xrefs: 000001845C4E887B
\cp.cfg, xrefs: 000001845C4E87AF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocRead$EnterFileFreeLeave$lstrcat$CloseCreateErrorHandleLastSizememset
String ID: @$C:\Program Files\Windows Mail$\cp.cfg
API String ID: 1502650097-1776503346
Opcode ID: 03e5816f0febf9f2516ba56efb62d54b0cca26d4fb6bcd281216f8244b78d330
Instruction ID: 8e3b75837cc7b169952f15b97cae5d8daba851652c660947d9d54fbaeab44093
Opcode Fuzzy Hash: 03e5816f0febf9f2516ba56efb62d54b0cca26d4fb6bcd281216f8244b78d330
Instruction Fuzzy Hash: EFC1AD32315B9687EB248F29E5447ADA3A0FB9AF84F44C315DE5A03B94DF38C615C709

Function 000001845C4E99F0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 175stringclipboardmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 000001845C4E9A3A
WideCharToMultiByte.KERNEL32 ref: 000001845C4E9A66
VirtualAlloc.KERNEL32 ref: 000001845C4E9A89
lstrlenW.KERNEL32 ref: 000001845C4E9A9E

Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC907
Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC92F

lstrlenW.KERNEL32 ref: 000001845C4E9B1F
WideCharToMultiByte.KERNEL32 ref: 000001845C4E9B48
VirtualAlloc.KERNEL32 ref: 000001845C4E9B5D
lstrlenW.KERNEL32 ref: 000001845C4E9B76
WideCharToMultiByte.KERNEL32 ref: 000001845C4E9BA2
WideCharToMultiByte.KERNEL32 ref: 000001845C4E9BC9
lstrlenA.KERNEL32 ref: 000001845C4E9BD2
memcpy.NTDLL ref: 000001845C4E9BE4
OpenClipboard.USER32 ref: 000001845C4E9BEB
EmptyClipboard.USER32 ref: 000001845C4E9BF5
lstrlenA.KERNEL32 ref: 000001845C4E9BFE
GlobalAlloc.KERNEL32 ref: 000001845C4E9C0E
GlobalLock.KERNEL32 ref: 000001845C4E9C23
lstrlenA.KERNEL32 ref: 000001845C4E9C34
memcpy.NTDLL ref: 000001845C4E9C43
GlobalUnlock.KERNEL32 ref: 000001845C4E9C4F
SetClipboardData.USER32 ref: 000001845C4E9C5D
CloseClipboard.USER32 ref: 000001845C4E9C63
VirtualFree.KERNEL32 ref: 000001845C4E9C74
VirtualFree.KERNEL32 ref: 000001845C4E9C85

Strings

!, xrefs: 000001845C4E9AD6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiWide$ClipboardVirtual$AllocGlobal$Freememcpy$CloseDataEmptyLockOpenUnlock
String ID: !
API String ID: 17242508-2657877971
Opcode ID: d0d0cce1298095d55bda04961aa882279e2f81b3c830c1949f663db54f22f3fc
Instruction ID: 5b9c281e286b791352693fe723b8e59261dbe8a990d5c48c14216bf7fb0d0741
Opcode Fuzzy Hash: d0d0cce1298095d55bda04961aa882279e2f81b3c830c1949f663db54f22f3fc
Instruction Fuzzy Hash: 3A71D031200B5683EB18DF62E9447DDB7A5FBA9FC1F848225D94B52BA4DF3CC2058389

Function 000001845C4EE210 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 199stringfilesleepCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4EE23C
memset.NTDLL ref: 000001845C4EE264
memset.NTDLL ref: 000001845C4EE278
lstrcatW.KERNEL32 ref: 000001845C4EE287
lstrcatW.KERNEL32 ref: 000001845C4EE29B
FindFirstFileW.KERNEL32 ref: 000001845C4EE2E6
FindNextFileW.KERNEL32 ref: 000001845C4EE305
memset.NTDLL ref: 000001845C4EE352
lstrcatW.KERNEL32 ref: 000001845C4EE361
lstrcatW.KERNEL32 ref: 000001845C4EE372
lstrcatW.KERNEL32 ref: 000001845C4EE386
Sleep.KERNEL32 ref: 000001845C4EE391
lstrlenW.KERNEL32 ref: 000001845C4EE39E
wcsstr.NTDLL ref: 000001845C4EE3D0
GetCurrentThread.KERNEL32 ref: 000001845C4EE41F
IsBadReadPtr.KERNEL32 ref: 000001845C4EE430
EnterCriticalSection.KERNEL32 ref: 000001845C4EE443
LeaveCriticalSection.KERNEL32 ref: 000001845C4EE464
FindNextFileW.KERNEL32 ref: 000001845C4EE4AE
LeaveCriticalSection.KERNEL32 ref: 000001845C4EE4C2
WaitForSingleObject.KERNEL32 ref: 000001845C4EE4D5
VirtualFree.KERNEL32 ref: 000001845C4EE4EF
VirtualFree.KERNEL32 ref: 000001845C4EE51F

Strings

*.*, xrefs: 000001845C4EE28D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcat$CriticalFileFindSectionmemset$FreeLeaveNextVirtual$CurrentEnterFirstObjectReadSingleSleepThreadWait__chkstklstrlenwcsstr
String ID: *.*
API String ID: 491004167-438819550
Opcode ID: b29965504f393d0c0be59b7089e5a45caf17d60b96d961a43351eaaa3ebd01c0
Instruction ID: ced4531eee078bbbe823f11d09c565f9c8d1db08c924db771b935d818814606c
Opcode Fuzzy Hash: b29965504f393d0c0be59b7089e5a45caf17d60b96d961a43351eaaa3ebd01c0
Instruction Fuzzy Hash: 2991AD32300B56C7EB24CF62E9447EDA3A1F799B84F85C226DE4947A98EF38C605C705

Function 000001845C4E8230 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 320memoryfilestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4E838D
lstrcatW.KERNEL32 ref: 000001845C4E83A1
lstrcatW.KERNEL32 ref: 000001845C4E83B6
CreateFileW.KERNEL32 ref: 000001845C4E83ED
SetFilePointer.KERNEL32 ref: 000001845C4E8409
WriteFile.KERNEL32 ref: 000001845C4E8427
CloseHandle.KERNEL32 ref: 000001845C4E8430
VirtualAlloc.KERNEL32 ref: 000001845C4E853B
VirtualAlloc.KERNEL32 ref: 000001845C4E85A3
IsBadReadPtr.KERNEL32 ref: 000001845C4E85ED
EnterCriticalSection.KERNEL32 ref: 000001845C4E8603
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8626
IsBadReadPtr.KERNEL32 ref: 000001845C4E863B
EnterCriticalSection.KERNEL32 ref: 000001845C4E864E
VirtualAlloc.KERNEL32 ref: 000001845C4E8665
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8689
VirtualFree.KERNEL32 ref: 000001845C4E869F
VirtualFree.KERNEL32 ref: 000001845C4E86C9
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8705
IsBadReadPtr.KERNEL32 ref: 000001845C4E8724
EnterCriticalSection.KERNEL32 ref: 000001845C4E873F

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4E8392
\cp.cfg, xrefs: 000001845C4E83A7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$AllocEnterFileLeaveRead$Freelstrcat$CloseCreateHandlePointerWritememset
String ID: C:\Program Files\Windows Mail$\cp.cfg
API String ID: 1370748441-3904790782
Opcode ID: 6ecfbc1e04c89c64a0ee336d11aee912bcb92c8e0a2a77cad56ae9ff53fce122
Instruction ID: ac4151d6723362a57e44ce5fad30c030c7318ceefd1bcdbb7c1b4b8f14dbfa1b
Opcode Fuzzy Hash: 6ecfbc1e04c89c64a0ee336d11aee912bcb92c8e0a2a77cad56ae9ff53fce122
Instruction Fuzzy Hash: 9EE1BD32710B8683EB258F39E544BADA3A1FB96F84F55D316DA8A03B54EF38C654C704

Function 000001845C4F6530 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 173filestringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F657F
VirtualFree.KERNEL32 ref: 000001845C4F65A9
memset.NTDLL ref: 000001845C4F65E7
lstrcatW.KERNEL32 ref: 000001845C4F65FB
CreateFileW.KERNEL32 ref: 000001845C4F6635
htons.WS2_32 ref: 000001845C4F6668
memset.NTDLL ref: 000001845C4F6696
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4F66A8
GetLastError.KERNEL32 ref: 000001845C4F66B2
lstrcatW.KERNEL32 ref: 000001845C4F66C7
CreateFileW.KERNEL32 ref: 000001845C4F670D
GetLastError.KERNEL32 ref: 000001845C4F671C
WriteFile.KERNEL32 ref: 000001845C4F673A
GetLastError.KERNEL32 ref: 000001845C4F6744
CloseHandle.KERNEL32 ref: 000001845C4F6752
htons.WS2_32 ref: 000001845C4F6773
VirtualFree.KERNEL32 ref: 000001845C4F679C
VirtualFree.KERNEL32 ref: 000001845C4F67B2
VirtualFree.KERNEL32 ref: 000001845C4F67DC

Strings

18.139.89.40, xrefs: 000001845C4F6758
tpdrivers, xrefs: 000001845C4F65EC
\system32\drivers\tpdrivers.sys, xrefs: 000001845C4F66B8
\\.\{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 000001845C4F6614

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocFree$EnterErrorFileLastRead$CreateLeavehtonslstrcatmemset$CloseDirectoryHandleInitializeWindowsWrite
String ID: 18.139.89.40$\\.\{F8284233-48F4-4680-ADDD-F8284233}$\system32\drivers\tpdrivers.sys$tpdrivers
API String ID: 3655753775-2065539051
Opcode ID: db220a0706c505ffdfe986e89b00e689603627b43e6aef5444c71a3e61a513cc
Instruction ID: 965c3f4858349bc1e6c5326b625feddbe776735589b2fbc3194db656e353939b
Opcode Fuzzy Hash: db220a0706c505ffdfe986e89b00e689603627b43e6aef5444c71a3e61a513cc
Instruction Fuzzy Hash: FE71C232315A6683FB64DF62E8547DEA3A1FB99B84F40C215DA8A43B94DF3CD2548708

Function 000001845C4E9190 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 195sleepmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E91E0
VirtualFree.KERNEL32 ref: 000001845C4E920A
memset.NTDLL ref: 000001845C4E9256
VirtualFree.KERNEL32 ref: 000001845C4E928A
VirtualFree.KERNEL32 ref: 000001845C4E92B4
malloc.MSVCRT ref: 000001845C4E92BF
wsprintfA.USER32 ref: 000001845C4E92E5
CreateMutexA.KERNEL32 ref: 000001845C4E92F2
GetLastError.KERNEL32 ref: 000001845C4E92FD
free.MSVCRT ref: 000001845C4E930D
lstrcatW.KERNEL32 ref: 000001845C4E9327
VirtualAlloc.KERNEL32 ref: 000001845C4E93CA
memcpy.NTDLL ref: 000001845C4E93F4
memcpy.NTDLL ref: 000001845C4E940E
Sleep.KERNEL32 ref: 000001845C4E9418
GetCurrentProcessId.KERNEL32 ref: 000001845C4E9426
VirtualFree.KERNEL32 ref: 000001845C4E945A
VirtualFree.KERNEL32 ref: 000001845C4E9475
VirtualFree.KERNEL32 ref: 000001845C4E949F

Strings

Inject Test, xrefs: 000001845C4E9318
:, xrefs: 000001845C4E93A0
%s%d, xrefs: 000001845C4E92DB

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$AllocCriticalSection$EnterRead$Leavememcpy$CreateCurrentErrorInitializeLastMutexProcessSleepfreelstrcatmallocmemsetwsprintf
String ID: %s%d$:$Inject Test
API String ID: 3230380526-1060902658
Opcode ID: 8dbd244c4dc7ff5931541ce9d241f2be0e44287da5020331176b23af610f2178
Instruction ID: e6adcabd7d0182bcec813dbf64fbb96e906a5a8de0cbbcfd531fe0369516a711
Opcode Fuzzy Hash: 8dbd244c4dc7ff5931541ce9d241f2be0e44287da5020331176b23af610f2178
Instruction Fuzzy Hash: CB919032705B5683EB14CF66E4047EDA361FBAAF84F44C325DA8A42B55DF3CC2448745

Function 000001845C4E9EC0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 152stringmemorythreadCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4E9ED2
MultiByteToWideChar.KERNEL32 ref: 000001845C4EA10E
MultiByteToWideChar.KERNEL32 ref: 000001845C4EA12E
lstrlenW.KERNEL32 ref: 000001845C4EA137

Part of subcall function 000001845C4EA190: WriteFile.KERNEL32 ref: 000001845C4EA3BA
Part of subcall function 000001845C4EA190: VirtualFree.KERNEL32 ref: 000001845C4EA3CB
Part of subcall function 000001845C4EA190: SetFileAttributesW.KERNEL32 ref: 000001845C4EA3DB
Part of subcall function 000001845C4EA190: CloseHandle.KERNEL32 ref: 000001845C4EA3E9

lstrlenW.KERNEL32 ref: 000001845C4E9EEB

Part of subcall function 000001845C4EA190: GetTickCount.KERNEL32 ref: 000001845C4EA1AB
Part of subcall function 000001845C4EA190: memset.NTDLL ref: 000001845C4EA1C4
Part of subcall function 000001845C4EA190: lstrcatW.KERNEL32 ref: 000001845C4EA1D5
Part of subcall function 000001845C4EA190: lstrcatW.KERNEL32 ref: 000001845C4EA1E7
Part of subcall function 000001845C4EA190: CreateFileW.KERNEL32 ref: 000001845C4EA21E
Part of subcall function 000001845C4EA190: CreateFileW.KERNEL32 ref: 000001845C4EA253
Part of subcall function 000001845C4EA190: SetFilePointer.KERNEL32 ref: 000001845C4EA268
Part of subcall function 000001845C4EA190: WriteFile.KERNEL32 ref: 000001845C4EA297
Part of subcall function 000001845C4EA190: SetFileAttributesW.KERNEL32 ref: 000001845C4EA2A6
Part of subcall function 000001845C4EA190: SetFilePointer.KERNEL32 ref: 000001845C4EA2BA
Part of subcall function 000001845C4EA190: VirtualAlloc.KERNEL32 ref: 000001845C4EA2CF

memset.NTDLL ref: 000001845C4E9F13
memset.NTDLL ref: 000001845C4E9F33
GetForegroundWindow.USER32 ref: 000001845C4E9F38
GetWindowTextW.USER32 ref: 000001845C4E9F53
GetWindowThreadProcessId.USER32 ref: 000001845C4E9F67
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E9F90
memset.NTDLL ref: 000001845C4E9FA5
lstrlenW.KERNEL32 ref: 000001845C4E9FC3
GetLocalTime.KERNEL32 ref: 000001845C4E9FD6
wsprintfW.USER32 ref: 000001845C4EA03E
lstrlenW.KERNEL32 ref: 000001845C4EA04B
lstrlenA.KERNEL32 ref: 000001845C4EA091
MultiByteToWideChar.KERNEL32 ref: 000001845C4EA0AA
VirtualAlloc.KERNEL32 ref: 000001845C4EA0D6
lstrlenA.KERNEL32 ref: 000001845C4EA0F3

Strings

[PROCESS:]%s[USERID:]%d[TITLE:]%s[TIME:]%d-%d-%d %d:%d:%d, xrefs: 000001845C4EA015
[Keyboard recording content:], xrefs: 000001845C4E9EE4, 000001845C4E9EF1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: File$lstrlen$memset$ByteCharMultiVirtualWideWindow$AllocAttributesCreatePointerProcessWritelstrcat$CloseCountForegroundFreeHandleLocalSessionTextThreadTickTime__chkstkwsprintf
String ID: [Keyboard recording content:]$[PROCESS:]%s[USERID:]%d[TITLE:]%s[TIME:]%d-%d-%d %d:%d:%d
API String ID: 599969897-1868071797
Opcode ID: f17e409ea88a83495190c95706f18a929b1a90729d272230387f25703c5392a2
Instruction ID: 13cf37d4eb13a2916675e06d7e140b1f935d3c9c174cbcf0b39b325502ee8666
Opcode Fuzzy Hash: f17e409ea88a83495190c95706f18a929b1a90729d272230387f25703c5392a2
Instruction Fuzzy Hash: 2D7181326047A6C7E724DF65E8403DEBBA1F795B84F448216E94E87A64DF38C345CB84

Function 000001845C4FB2D0 Relevance: 37.9, APIs: 25, Instructions: 372registryCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4FB2E8
memset.NTDLL ref: 000001845C4FB30D
memset.NTDLL ref: 000001845C4FB321

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4FB3B6
VirtualFree.KERNEL32 ref: 000001845C4FB3E0
RegOpenKeyExW.ADVAPI32 ref: 000001845C4FB41A
VirtualFree.KERNEL32 ref: 000001845C4FB45C
VirtualFree.KERNEL32 ref: 000001845C4FB486
memset.NTDLL ref: 000001845C4FB49D
RegEnumKeyExW.ADVAPI32 ref: 000001845C4FB4D2
memset.NTDLL ref: 000001845C4FB528
RegEnumKeyExW.ADVAPI32 ref: 000001845C4FB55D
memset.NTDLL ref: 000001845C4FB586
memset.NTDLL ref: 000001845C4FB59A
RegEnumValueW.ADVAPI32 ref: 000001845C4FB5F5
memset.NTDLL ref: 000001845C4FB696
memset.NTDLL ref: 000001845C4FB6AA
RegEnumValueW.ADVAPI32 ref: 000001845C4FB705
RegCloseKey.ADVAPI32 ref: 000001845C4FB718
VirtualFree.KERNEL32 ref: 000001845C4FB815
VirtualFree.KERNEL32 ref: 000001845C4FB83F
VirtualFree.KERNEL32 ref: 000001845C4FB855
VirtualFree.KERNEL32 ref: 000001845C4FB87F
VirtualFree.KERNEL32 ref: 000001845C4FB895
VirtualFree.KERNEL32 ref: 000001845C4FB8BF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$memset$CriticalSection$Alloc$Enum$EnterRead$LeaveValue$CloseInitializeOpen__chkstk
String ID:
API String ID: 2734444383-0
Opcode ID: 0595414e30b50002a461e2897ac5610cd8ac295fcac56b89b3caa5011188017e
Instruction ID: 6a23d256e1bb42cfa1fb084b5c4ea3267bc4720471d036c788e4943138a5079d
Opcode Fuzzy Hash: 0595414e30b50002a461e2897ac5610cd8ac295fcac56b89b3caa5011188017e
Instruction Fuzzy Hash: 4BF16A32310A9187EB64CF62D998ADEB3A1FB8AB85F408115CF5A47B58DF38C215CB04

Function 000001845C504FA0 Relevance: 37.7, APIs: 25, Instructions: 205memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C504FB7
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C504FF6
memset.NTDLL ref: 000001845C505015
CreateEventW.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C50502C
CreateEventW.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505041
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505053
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505145
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505157
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C50516C
IsBadReadPtr.KERNEL32 ref: 000001845C50517E
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505191
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5051A8
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5051D7
IsBadReadPtr.KERNEL32 ref: 000001845C5051E9
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5051FC
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505213
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505242
IsBadReadPtr.KERNEL32 ref: 000001845C505254
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505267
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C50527E
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5052AD
IsBadReadPtr.KERNEL32 ref: 000001845C5052BF
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5052D2
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C5052E9
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E4AAC), ref: 000001845C505318

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocVirtual$EnterLeaveRead$Initialize$CreateEvent$memset
String ID:
API String ID: 1099351009-0
Opcode ID: 4c432805fc150b9a5a3aab3c4a807d14a13fc8452305bb2b73dd0958c01303ba
Instruction ID: aae15803255ae537419887a5efdcd0fe6b9860a4dd9f75eccf2556c079e3fabb
Opcode Fuzzy Hash: 4c432805fc150b9a5a3aab3c4a807d14a13fc8452305bb2b73dd0958c01303ba
Instruction Fuzzy Hash: 1EB11D31311F5693EB498F61E9403DDB3A4FB64B80F84C62ADA5993764EF38D664C348

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211servicestringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00000001800015E5
memcpy.NTDLL ref: 0000000180001609
malloc.MSVCRT ref: 0000000180001613
memset.NTDLL ref: 0000000180001648
memset.NTDLL ref: 00000001800016A8
GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
malloc.MSVCRT ref: 00000001800016CD
memset.NTDLL ref: 00000001800016E7
memcpy.NTDLL ref: 00000001800016F5
OpenSCManagerW.ADVAPI32 ref: 0000000180001789
EnumServicesStatusExW.ADVAPI32 ref: 00000001800017D0
malloc.MSVCRT ref: 00000001800017E2
memset.NTDLL ref: 00000001800017FC
EnumServicesStatusExW.ADVAPI32 ref: 0000000180001838
CloseServiceHandle.ADVAPI32 ref: 0000000180001845
free.MSVCRT ref: 000000018000184E
CloseServiceHandle.ADVAPI32 ref: 0000000180001856
lstrcmpiW.KERNEL32 ref: 0000000180001881

Strings

Schedule, xrefs: 0000000180001872

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: mallocmemset$CloseEnumHandleServiceServicesStatusmemcpy$FileManagerModuleNameOpenfreelstrcmpi
String ID: Schedule
API String ID: 3636854120-2739827629
Opcode ID: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction ID: 6ee3f7f16e62e9fbbf62cb728b63543f6f6100922e48a7ada6915e3d38cfd098
Opcode Fuzzy Hash: 7697f6b2c45ef8c94f65c33818677cfec83935d60c7d49dafd4f2fb68cf7ed65
Instruction Fuzzy Hash: 84A1AE36705B8886EBA5CB19E4883EDB7A4F78DB94F54D128EE8903755EF38D648C700

Function 000001845C500810 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 186pipeprocessstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C500862
CreatePipe.KERNEL32 ref: 000001845C50088A
CloseHandle.KERNEL32 ref: 000001845C50089C
CloseHandle.KERNEL32 ref: 000001845C5008AE
VirtualFree.KERNEL32 ref: 000001845C5008C8
VirtualFree.KERNEL32 ref: 000001845C5008F2
CreatePipe.KERNEL32 ref: 000001845C500913
CloseHandle.KERNEL32 ref: 000001845C500926
CloseHandle.KERNEL32 ref: 000001845C50093D
GetStartupInfoW.KERNEL32 ref: 000001845C50097B
lstrcatW.KERNEL32 ref: 000001845C5009B7
VirtualFree.KERNEL32 ref: 000001845C5009CD
VirtualFree.KERNEL32 ref: 000001845C5009F7
CreateProcessW.KERNEL32 ref: 000001845C500A36
CloseHandle.KERNEL32 ref: 000001845C500A48
CloseHandle.KERNEL32 ref: 000001845C500A5A
CloseHandle.KERNEL32 ref: 000001845C500A6D
CloseHandle.KERNEL32 ref: 000001845C500A84
CreateThread.KERNEL32 ref: 000001845C500AC0

Strings

, xrefs: 000001845C500A26

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateFreeVirtual$Pipe$InfoProcessStartupThreadlstrcatmemset
String ID:
API String ID: 3234776578-3916222277
Opcode ID: 92ec81b901bfc6f2a5663ab9ca78efc14cc9e06966c3134a046e798205adb50d
Instruction ID: 195f69f3974edf19b06f0bc45a72e1ee0ede1bc6ee3f15c66d4f30e550075e30
Opcode Fuzzy Hash: 92ec81b901bfc6f2a5663ab9ca78efc14cc9e06966c3134a046e798205adb50d
Instruction Fuzzy Hash: 5A914F36601F55D7EB58CFA1E9503AEB3B4FBA8B48F448216DE4953A14DF38C2A4D348

Function 000001845C4EEFC0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 179fileprocessmemoryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4EEFED
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4EEFFA
GetLastError.KERNEL32 ref: 000001845C4EF004
lstrcatW.KERNEL32 ref: 000001845C4EF01D
CreateFileW.KERNEL32 ref: 000001845C4EF09C
GetLastError.KERNEL32 ref: 000001845C4EF0AB
WriteFile.KERNEL32 ref: 000001845C4EF0C8
GetLastError.KERNEL32 ref: 000001845C4EF0D2
CloseHandle.KERNEL32 ref: 000001845C4EF0E0
memset.NTDLL ref: 000001845C4EF108
memset.NTDLL ref: 000001845C4EF178
VirtualAlloc.KERNEL32 ref: 000001845C4EF1DF
wsprintfW.USER32 ref: 000001845C4EF209
CreateProcessW.KERNEL32 ref: 000001845C4EF285
CloseHandle.KERNEL32 ref: 000001845C4EF295
CloseHandle.KERNEL32 ref: 000001845C4EF2AA
VirtualFree.KERNEL32 ref: 000001845C4EF2C0

Strings

h, xrefs: 000001845C4EF274
\rar.exe, xrefs: 000001845C4EF00A
rar.exe x "%s" "%s", xrefs: 000001845C4EF202

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseErrorHandleLastmemset$CreateFileVirtual$AllocDirectoryFreeProcessWindowsWritelstrcatwsprintf
String ID: \rar.exe$h$rar.exe x "%s" "%s"
API String ID: 2158214755-1420003661
Opcode ID: fbf86ac99dbef88f820f1243c357f17008eabb307d09fe21cb03ae58ae84416a
Instruction ID: 13c4dae0dd69ffa497a5841518b047eb64ecbcdff837de447482d044286cd154
Opcode Fuzzy Hash: fbf86ac99dbef88f820f1243c357f17008eabb307d09fe21cb03ae58ae84416a
Instruction Fuzzy Hash: 8781AD36614BA287EB24CF71E8447DD73A2F789B88F409225CE4A47B58DF39C294CB04

Function 000001845C4E6F60 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 174memoryprocessstringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4E6C70: memcpy.NTDLL ref: 000001845C4E6C8E
Part of subcall function 000001845C4E6C70: memset.NTDLL ref: 000001845C4E6CA0
Part of subcall function 000001845C4E6C70: lstrcatA.KERNEL32 ref: 000001845C4E6CC0
Part of subcall function 000001845C4E6C70: lstrcatW.KERNEL32 ref: 000001845C4E6CF4

GetCurrentProcessId.KERNEL32 ref: 000001845C4E6FDB
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E6FEB
CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4E7014
GetProcessHeap.KERNEL32 ref: 000001845C4E7023
HeapAlloc.KERNEL32 ref: 000001845C4E7036
CloseHandle.KERNEL32 ref: 000001845C4E7047
WTSGetActiveConsoleSessionId.KERNEL32 ref: 000001845C4E7056
Process32FirstW.KERNEL32 ref: 000001845C4E7084
lstrcmpiW.KERNEL32 ref: 000001845C4E70AB
Process32NextW.KERNEL32 ref: 000001845C4E70BB
GetProcessHeap.KERNEL32 ref: 000001845C4E70D3
HeapFree.KERNEL32 ref: 000001845C4E70E1
CloseHandle.KERNEL32 ref: 000001845C4E70EA
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E7104
CreateThread.KERNEL32 ref: 000001845C4E7127
VirtualFree.KERNEL32 ref: 000001845C4E71B6
VirtualFree.KERNEL32 ref: 000001845C4E71E0
VirtualFree.KERNEL32 ref: 000001845C4E71FB
VirtualFree.KERNEL32 ref: 000001845C4E7225

Strings

explorer.exe, xrefs: 000001845C4E70A4

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$FreeProcess$Heap$EnterReadSession$CloseCreateHandleLeaveProcess32lstrcat$ActiveConsoleCurrentFirstInitializeNextSnapshotThreadToolhelp32lstrcmpimemcpymemset
String ID: explorer.exe
API String ID: 1072794995-3187896405
Opcode ID: 3a93d8f6808cd038349fc4e197abe7e334fd4ca4ae3e3deed15c5e30cb85c88f
Instruction ID: 74feacc48cbaeeab19b68baa34853f68fed8cc1be5774690d8eeb36d5c6b375f
Opcode Fuzzy Hash: 3a93d8f6808cd038349fc4e197abe7e334fd4ca4ae3e3deed15c5e30cb85c88f
Instruction Fuzzy Hash: 2071BF31304B96C3EB689F62EA447AEA3B1FB96F90F84C315DA4603B54DF38C2558749

Function 000001845C4FCE70 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 109stringCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001845C4FCE9E
OpenProcessToken.ADVAPI32 ref: 000001845C4FCEB1
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4FCED9
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4FCEFB
GetLastError.KERNEL32 ref: 000001845C4FCF01
CloseHandle.KERNEL32 ref: 000001845C4FCF17
GetCurrentProcess.KERNEL32 ref: 000001845C4FCF2D
OpenProcessToken.ADVAPI32 ref: 000001845C4FCF42
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4FCF6A
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4FCF8E
GetLastError.KERNEL32 ref: 000001845C4FCF94
CloseHandle.KERNEL32 ref: 000001845C4FCFAA
memset.NTDLL ref: 000001845C4FCFC2
OpenProcess.KERNEL32 ref: 000001845C4FCFD1
K32EnumProcessModules.KERNEL32 ref: 000001845C4FCFFB
K32GetProcessImageFileNameW.KERNEL32 ref: 000001845C4FD00F
lstrcpyW.KERNEL32 ref: 000001845C4FD023
CloseHandle.KERNEL32 ref: 000001845C4FD040

Strings

SeDebugPrivilege, xrefs: 000001845C4FCEC8
SeTcbPrivilege, xrefs: 000001845C4FCF59

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$Token$CloseHandleOpen$AdjustCurrentErrorLastLookupPrivilegePrivilegesValue$EnumFileImageModulesNamelstrcpymemset
String ID: SeDebugPrivilege$SeTcbPrivilege
API String ID: 4244359295-3171858176
Opcode ID: afd95e7b21561ac8f3792b67cd5ce759562a791877db9a9ce67460e1baa5020e
Instruction ID: ef2a62f2c0dc7dc60306aa5917bed49367f64281d3641bfd3baef2ff23772b63
Opcode Fuzzy Hash: afd95e7b21561ac8f3792b67cd5ce759562a791877db9a9ce67460e1baa5020e
Instruction Fuzzy Hash: 5F51C431214A5683E764CF61E8447DDA3A0F785BA4F80D316EA5A42AD4DF3CD249CB44

Function 000001845C517630 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 274networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001845C51776D
setsockopt.WS2_32 ref: 000001845C5177AF
setsockopt.WS2_32 ref: 000001845C5177CC
setsockopt.WS2_32 ref: 000001845C517913
WSAGetLastError.WS2_32 ref: 000001845C51791D
listen.WS2_32 ref: 000001845C51792F
closesocket.WS2_32 ref: 000001845C51799E
WSAGetLastError.WS2_32 ref: 000001845C517A71
closesocket.WS2_32 ref: 000001845C517AA0
closesocket.WS2_32 ref: 000001845C517AC8

Strings

listen failed with error %d, xrefs: 000001845C517A77
listen|%s|%s|%d, xrefs: 000001845C517982
%s: VH %s: iface %s port %d DOESN'T EXIST, xrefs: 000001845C5179D5
%s: VH %s: iface %s port %d NOT USABLE, xrefs: 000001845C517A2D
reuseaddr failed, xrefs: 000001845C517AB6
lws_create_vhost, xrefs: 000001845C517638
Out of mem, xrefs: 000001845C517AAD
_lws_vhost_init_server_af, xrefs: 000001845C5179CE, 000001845C517A26
ERROR opening socket, xrefs: 000001845C517AD5

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: closesocketsetsockopt$ErrorLast$listensocket
String ID: %s: VH %s: iface %s port %d DOESN'T EXIST$%s: VH %s: iface %s port %d NOT USABLE$ERROR opening socket$Out of mem$_lws_vhost_init_server_af$listen failed with error %d$listen|%s|%s|%d$lws_create_vhost$reuseaddr failed
API String ID: 3630065070-1684632830
Opcode ID: 3b880312eee11432debff261864d0151b6d610a403db296dabe4168ddc5b799d
Instruction ID: 1fe356cfc8e3046628649643bfdc6f4d08a531d808ad1cc9fc9d6c8218aff512
Opcode Fuzzy Hash: 3b880312eee11432debff261864d0151b6d610a403db296dabe4168ddc5b799d
Instruction Fuzzy Hash: 0DD18E36200AAA83EB54CFA9D4487DDB3B0F758B98F548322DA99477A0DF38C695C744

Function 000001845C4EC850 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 244filestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4EC895
lstrcatW.KERNEL32 ref: 000001845C4EC8A4
lstrcatW.KERNEL32 ref: 000001845C4EC8B8
memset.NTDLL ref: 000001845C4EC8CB
FindFirstFileW.KERNEL32 ref: 000001845C4EC8DC

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

FindNextFileW.KERNEL32 ref: 000001845C4EC935
FindNextFileW.KERNEL32 ref: 000001845C4EC999
VirtualFree.KERNEL32 ref: 000001845C4ECA54
VirtualFree.KERNEL32 ref: 000001845C4ECA7E
VirtualFree.KERNEL32 ref: 000001845C4ECA94
VirtualFree.KERNEL32 ref: 000001845C4ECABE
VirtualFree.KERNEL32 ref: 000001845C4ECAD9
VirtualFree.KERNEL32 ref: 000001845C4ECB03
FindClose.KERNEL32 ref: 000001845C4ECB0C
VirtualFree.KERNEL32 ref: 000001845C4ECB2C
VirtualFree.KERNEL32 ref: 000001845C4ECB56
VirtualFree.KERNEL32 ref: 000001845C4ECB71
VirtualFree.KERNEL32 ref: 000001845C4ECB9B

Strings

*.*, xrefs: 000001845C4EC8AA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$Find$EnterFileRead$LeaveNextlstrcatmemset$CloseFirstInitialize
String ID: *.*
API String ID: 3909642798-438819550
Opcode ID: 4ce18a9b90196395475cfb8a2b41f3e008fbd196779cbce07c17fbf59d62ab14
Instruction ID: 3f9a4970ea1f289258b1f4b0c7f2ff341f32a00732b0a7ea641c1a7004b2181e
Opcode Fuzzy Hash: 4ce18a9b90196395475cfb8a2b41f3e008fbd196779cbce07c17fbf59d62ab14
Instruction Fuzzy Hash: C1A1B036311B5283EB68DF62E854BAEA3A5FB8AF84F45C115CE4A43758DF38C644C748

Function 000001845C4F3BC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 197stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001845C4F3C12
malloc.MSVCRT ref: 000001845C4F3C2E
free.MSVCRT ref: 000001845C4F3C3F
memset.NTDLL ref: 000001845C4F3C77
GetCursorInfo.USER32 ref: 000001845C4F3C94
GetCursorPos.USER32 ref: 000001845C4F3C9E
GetForegroundWindow.USER32 ref: 000001845C4F3CAC
GetWindowTextW.USER32 ref: 000001845C4F3CC3
GetTickCount.KERNEL32 ref: 000001845C4F3CEE
GetTickCount.KERNEL32 ref: 000001845C4F3CFA
wsprintfW.USER32 ref: 000001845C4F3D3F
lstrlenW.KERNEL32 ref: 000001845C4F3D48

Strings

%s|%d, xrefs: 000001845C4F3D28

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CountCursorTickWindowmalloc$ForegroundInfoTextfreelstrlenmemsetwsprintf
String ID: %s|%d
API String ID: 14445030-1229896841
Opcode ID: 39f0c2668db1b372d72f0baae9c1b4d9b698ffe5f9ed2b9c4655611148b82a9b
Instruction ID: 68cb262b1037993cb3c3e5fc23ff143911679e90bce62d75625d6e050f55ea89
Opcode Fuzzy Hash: 39f0c2668db1b372d72f0baae9c1b4d9b698ffe5f9ed2b9c4655611148b82a9b
Instruction Fuzzy Hash: 1281AC32710A5687EB18CF76E8447AD63A1FB99F84F449225DE0A07B64EF38D684C744

Function 000001845C4F63C0 Relevance: 33.3, APIs: 15, Strings: 4, Instructions: 76servicestringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F63D9
lstrcatW.KERNEL32 ref: 000001845C4F63ED
memset.NTDLL ref: 000001845C4F6400
GetWindowsDirectoryW.KERNEL32 ref: 000001845C4F640F
GetLastError.KERNEL32 ref: 000001845C4F6419
lstrcatW.KERNEL32 ref: 000001845C4F642B
OpenSCManagerW.ADVAPI32 ref: 000001845C4F643B
GetLastError.KERNEL32 ref: 000001845C4F6449
CreateServiceW.ADVAPI32 ref: 000001845C4F64C0
GetLastError.KERNEL32 ref: 000001845C4F64CE
CloseServiceHandle.ADVAPI32 ref: 000001845C4F64D7
GetLastError.KERNEL32 ref: 000001845C4F64DD
StartServiceW.ADVAPI32 ref: 000001845C4F64FC
CloseServiceHandle.ADVAPI32 ref: 000001845C4F6505
CloseServiceHandle.ADVAPI32 ref: 000001845C4F650E

Strings

FSFilter Activity Monitor, xrefs: 000001845C4F648D
FltMgr, xrefs: 000001845C4F6467
tpdrivers, xrefs: 000001845C4F63DE
\system32\drivers\tpdrivers.sys, xrefs: 000001845C4F641F

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$lstrcatmemset$CreateDirectoryManagerOpenStartWindows
String ID: FSFilter Activity Monitor$FltMgr$\system32\drivers\tpdrivers.sys$tpdrivers
API String ID: 4233479461-606275738
Opcode ID: 38649f7966a210fa7a925492f7da8da3f08e55cc04dda45abaec5e3d19128508
Instruction ID: afc9beccba62291c4794b98bbba8851beb5f12e91fbf24996d92a5c66accc13d
Opcode Fuzzy Hash: 38649f7966a210fa7a925492f7da8da3f08e55cc04dda45abaec5e3d19128508
Instruction Fuzzy Hash: C031A875204B9693EB148F94F8443DEB3A1F799B54F848226DA8D42B65DF3CC249CB08

Function 000001845C4FFC54 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 233stringservicememoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 000001845C4FFC72
VirtualAlloc.KERNEL32 ref: 000001845C4FFCAF
QueryServiceConfigW.ADVAPI32 ref: 000001845C4FFCD4
lstrcpyW.KERNEL32 ref: 000001845C4FFD46
lstrlenW.KERNEL32 ref: 000001845C4FFD75
memcpy.NTDLL ref: 000001845C4FFE15
lstrlenW.KERNEL32 ref: 000001845C4FFE35
memcpy.NTDLL ref: 000001845C4FFE4D
lstrlenW.KERNEL32 ref: 000001845C4FFE56
memcpy.NTDLL ref: 000001845C4FFEDE
CloseServiceHandle.ADVAPI32 ref: 000001845C4FFEE6
VirtualFree.KERNEL32 ref: 000001845C4FFF08
VirtualFree.KERNEL32 ref: 000001845C4FFF19
CloseServiceHandle.ADVAPI32 ref: 000001845C4FFF40
LocalFree.KERNEL32 ref: 000001845C4FFF49
VirtualFree.KERNEL32 ref: 000001845C4FFFF5
VirtualFree.KERNEL32 ref: 000001845C50001F
VirtualFree.KERNEL32 ref: 000001845C500035
VirtualFree.KERNEL32 ref: 000001845C50005F

Strings

\Pbk-N, xrefs: 000001845C4FFC54

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$Servicelstrlenmemcpy$CloseHandlelstrcpy$AllocConfigLocalQuery
String ID: \Pbk-N
API String ID: 4179252731-2524875733
Opcode ID: 82f18bbc0a18429955e476fa0a77ada2723f752fa9759dfd5f0dbb3a5da31d8f
Instruction ID: cbbdcc0ece391bad5756ee4b93f075898759240370806e87fb59125d039adedc
Opcode Fuzzy Hash: 82f18bbc0a18429955e476fa0a77ada2723f752fa9759dfd5f0dbb3a5da31d8f
Instruction Fuzzy Hash: 2BC17D22B14B8683F715CF29D5587EC63A0FBA9B88F44E315CF4916A16EF35A2E4C300

Function 000001845C4FFC5D Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 233stringservicememoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32 ref: 000001845C4FFC72
VirtualAlloc.KERNEL32 ref: 000001845C4FFCAF
QueryServiceConfigW.ADVAPI32 ref: 000001845C4FFCD4
lstrcpyW.KERNEL32 ref: 000001845C4FFD46
lstrlenW.KERNEL32 ref: 000001845C4FFD75
memcpy.NTDLL ref: 000001845C4FFE15
lstrlenW.KERNEL32 ref: 000001845C4FFE35
memcpy.NTDLL ref: 000001845C4FFE4D
lstrlenW.KERNEL32 ref: 000001845C4FFE56
memcpy.NTDLL ref: 000001845C4FFEDE
CloseServiceHandle.ADVAPI32 ref: 000001845C4FFEE6
VirtualFree.KERNEL32 ref: 000001845C4FFF08
VirtualFree.KERNEL32 ref: 000001845C4FFF19
CloseServiceHandle.ADVAPI32 ref: 000001845C4FFF40
LocalFree.KERNEL32 ref: 000001845C4FFF49
VirtualFree.KERNEL32 ref: 000001845C4FFFF5
VirtualFree.KERNEL32 ref: 000001845C50001F
VirtualFree.KERNEL32 ref: 000001845C500035
VirtualFree.KERNEL32 ref: 000001845C50005F

Strings

\Pbk, xrefs: 000001845C4FFC5D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$Servicelstrlenmemcpy$CloseHandlelstrcpy$AllocConfigLocalQuery
String ID: \Pbk
API String ID: 4179252731-1099493443
Opcode ID: b803a67fb0a92bac57c844e0e1337c611d8afc5b20b177d59cb748982b703d55
Instruction ID: 605db8ae581a1236a0e08fbb6105d0cf91eea31da357b2ca2894ffba9b5ced2b
Opcode Fuzzy Hash: b803a67fb0a92bac57c844e0e1337c611d8afc5b20b177d59cb748982b703d55
Instruction Fuzzy Hash: 96C17D22B14B8683F715CF29D5587EC63A0FBA9B88F44E315CF4912A16EF35A2E4C300

Function 000001845C4F1F80 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 212filestringmemoryCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F1FB4

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

lstrcatW.KERNEL32 ref: 000001845C4F1FD0
lstrcatW.KERNEL32 ref: 000001845C4F1FE5
CreateFileW.KERNEL32 ref: 000001845C4F2014
GetFileSize.KERNEL32 ref: 000001845C4F202C
VirtualAlloc.KERNEL32 ref: 000001845C4F2042
CloseHandle.KERNEL32 ref: 000001845C4F2058
VirtualFree.KERNEL32 ref: 000001845C4F206E
ReadFile.KERNEL32 ref: 000001845C4F20AB
VirtualFree.KERNEL32 ref: 000001845C4F2191
CloseHandle.KERNEL32 ref: 000001845C4F219F
VirtualFree.KERNEL32 ref: 000001845C4F2243
VirtualFree.KERNEL32 ref: 000001845C4F226D
VirtualFree.KERNEL32 ref: 000001845C4F2283
VirtualFree.KERNEL32 ref: 000001845C4F22AD

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4F1FBE
\temp.key, xrefs: 000001845C4F1FD6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalFreeSection$Read$EnterFile$CloseHandleLeavelstrcat$CreateInitializeSizememset
String ID: C:\Program Files\Windows Mail$\temp.key
API String ID: 1994389154-229217837
Opcode ID: 92afef74a29b292eaf857ba6167df423d94299ef4b9599aef15cf14ad88bc85f
Instruction ID: 7b3e97f455680ae7be2a2fac6f15c66c2f91a79625991a5a31e327933ec5b062
Opcode Fuzzy Hash: 92afef74a29b292eaf857ba6167df423d94299ef4b9599aef15cf14ad88bc85f
Instruction Fuzzy Hash: 98917932611B9287EB24CF26E544B9EA7A1FBD9F80F40C315DA8A43B54DF38D654CB08

Function 000001845C4EA190 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 149filestringmemoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001845C4EA1AB
memset.NTDLL ref: 000001845C4EA1C4
lstrcatW.KERNEL32 ref: 000001845C4EA1D5
lstrcatW.KERNEL32 ref: 000001845C4EA1E7
CreateFileW.KERNEL32 ref: 000001845C4EA21E
CreateFileW.KERNEL32 ref: 000001845C4EA253
SetFilePointer.KERNEL32 ref: 000001845C4EA268
WriteFile.KERNEL32 ref: 000001845C4EA297
SetFileAttributesW.KERNEL32 ref: 000001845C4EA2A6
SetFilePointer.KERNEL32 ref: 000001845C4EA2BA
VirtualAlloc.KERNEL32 ref: 000001845C4EA2CF
WriteFile.KERNEL32 ref: 000001845C4EA3BA
VirtualFree.KERNEL32 ref: 000001845C4EA3CB
SetFileAttributesW.KERNEL32 ref: 000001845C4EA3DB
CloseHandle.KERNEL32 ref: 000001845C4EA3E9

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4EA1C9
\temp.key, xrefs: 000001845C4EA1DB

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: File$AttributesCreatePointerVirtualWritelstrcat$AllocCloseCountFreeHandleTickmemset
String ID: C:\Program Files\Windows Mail$\temp.key
API String ID: 573267298-229217837
Opcode ID: 56780571c3b5b24d83ae8df9fa4e23bd7118c424518018f72ede47bea234dd3e
Instruction ID: 42a4e0d55f450d341b4b49debcfe6feca0923fda33b38abcb32a41cf19e2a9fc
Opcode Fuzzy Hash: 56780571c3b5b24d83ae8df9fa4e23bd7118c424518018f72ede47bea234dd3e
Instruction Fuzzy Hash: D061B032614A9683EB248F25E448BDEBB60FB99B88F51C312DA8517B54EF3CC609C744

Function 000001845C4E97D0 Relevance: 28.7, APIs: 19, Instructions: 155clipboardstringmemoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001845C4E983F
LeaveCriticalSection.KERNEL32 ref: 000001845C4E986F
EnterCriticalSection.KERNEL32 ref: 000001845C4E988F
LeaveCriticalSection.KERNEL32 ref: 000001845C4E98C1
lstrlenW.KERNEL32 ref: 000001845C4E98F7
memcmp.MSVCRT ref: 000001845C4E9908
lstrlenW.KERNEL32 ref: 000001845C4E9934
lstrlenW.KERNEL32 ref: 000001845C4E993F
lstrlenW.KERNEL32 ref: 000001845C4E994F
memcpy.NTDLL ref: 000001845C4E9960
OpenClipboard.USER32 ref: 000001845C4E9967
CloseClipboard.USER32 ref: 000001845C4E9971
EmptyClipboard.USER32 ref: 000001845C4E9977
GlobalAlloc.KERNEL32 ref: 000001845C4E9985
GlobalLock.KERNEL32 ref: 000001845C4E9996
memcpy.NTDLL ref: 000001845C4E99AD
GlobalUnlock.KERNEL32 ref: 000001845C4E99B5
SetClipboardData.USER32 ref: 000001845C4E99C3
CloseClipboard.USER32 ref: 000001845C4E99C9

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Clipboard$CriticalSectionlstrlen$Global$CloseEnterLeavememcpy$AllocDataEmptyLockOpenUnlockmemcmp
String ID:
API String ID: 1993803941-0
Opcode ID: f9a916733851e6dc62f61d2f66a0daea919dc5e740a42f29a2d1ffc9bea0251b
Instruction ID: b1dc50c6f5c42930abd9b10db83d941278b09f74bdd57d3420d64db0702b670e
Opcode Fuzzy Hash: f9a916733851e6dc62f61d2f66a0daea919dc5e740a42f29a2d1ffc9bea0251b
Instruction Fuzzy Hash: 21517471201B16C3FE589F62DA447EDA3A1FB65F80F49CA218E0A177E5DF38D6408389

Function 000001845C4EF710 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 196memoryinjectionlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4EF560: VirtualAlloc.KERNEL32 ref: 000001845C4EF59E
Part of subcall function 000001845C4EF560: memcpy.NTDLL ref: 000001845C4EF5BA
Part of subcall function 000001845C4EF560: VirtualFree.KERNEL32 ref: 000001845C4EF6AF

VirtualAllocEx.KERNEL32 ref: 000001845C4EF764
GetLastError.KERNEL32 ref: 000001845C4EF772
WriteProcessMemory.KERNEL32 ref: 000001845C4EF793
VirtualAllocEx.KERNEL32 ref: 000001845C4EF7B3
WriteProcessMemory.KERNEL32 ref: 000001845C4EF7D6
VirtualAllocEx.KERNEL32 ref: 000001845C4EF7F7
WriteProcessMemory.KERNEL32 ref: 000001845C4EF8D7
VirtualProtectEx.KERNEL32 ref: 000001845C4EF900
VirtualProtectEx.KERNEL32 ref: 000001845C4EF91C
GetModuleHandleW.KERNEL32 ref: 000001845C4EF937
GetProcAddress.KERNEL32 ref: 000001845C4EF947

Strings

ntdll.dll, xrefs: 000001845C4EF928
h, xrefs: 000001845C4EF88F
ZwCreateThreadEx, xrefs: 000001845C4EF940
@, xrefs: 000001845C4EF7E2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$MemoryProcessWrite$Protect$AddressErrorFreeHandleLastModuleProcmemcpy
String ID: @$ZwCreateThreadEx$h$ntdll.dll
API String ID: 2541485474-1855171776
Opcode ID: 396edaa950aea8bb2834e9a8a087e273c859751424a80b509f85d4148d5affe0
Instruction ID: acaf1f331a665677eabe1d57eb906a87586180af2aa48ca7fab6b57cd37f8563
Opcode Fuzzy Hash: 396edaa950aea8bb2834e9a8a087e273c859751424a80b509f85d4148d5affe0
Instruction Fuzzy Hash: FA8103327147818BF724CFAAA9407AD6B60F756B88F444329DE9953B89CF38C305C799

Function 000001845C4E2B50 Relevance: 28.2, APIs: 4, Strings: 12, Instructions: 156comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000001845C4E2B6A
CLSIDFromString.OLE32 ref: 000001845C4E2E4D
IIDFromString.OLE32 ref: 000001845C4E2E5F
CoCreateInstance.OLE32 ref: 000001845C4E2E7C

Strings

X:[:, xrefs: 000001845C4E2CEC
^:G:, xrefs: 000001845C4E2C79
\:^:, xrefs: 000001845C4E2D94
:Y:, xrefs: 000001845C4E2D84
:, xrefs: 000001845C4E2DF0
:, xrefs: 000001845C4E2DC5
X:^:, xrefs: 000001845C4E2C15
\:[:, xrefs: 000001845C4E2CDD
A::, xrefs: 000001845C4E2B7E
Y::, xrefs: 000001845C4E2D8C
:_:, xrefs: 000001845C4E2C1D
Y:\:, xrefs: 000001845C4E2C05

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FromString$CreateInitializeInstance
String ID: :_:$:Y:$:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 511945936-736265694
Opcode ID: f4bb76e33d73f4eed76eb8cf699106e415e7ba4134a3637e02159dfe64d1d0e5
Instruction ID: 2f57e5c9e55b5071a815b71d82d623a73189434ff97481f36a55aa279e541026
Opcode Fuzzy Hash: f4bb76e33d73f4eed76eb8cf699106e415e7ba4134a3637e02159dfe64d1d0e5
Instruction Fuzzy Hash: 5491FC73918BD5CBE3118F79A4016AEBB60F7E5348F14A349EBC566919EB78E580CF00

Function 000001845C4EFF40 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 141processCOMMON

Download Yara Rule

APIs

WTSQueryUserToken.WTSAPI32 ref: 000001845C4EFFC6
GetLastError.KERNEL32 ref: 000001845C4EFFD0
DuplicateTokenEx.ADVAPI32 ref: 000001845C4F0000
ConvertStringSidToSidW.ADVAPI32 ref: 000001845C4F0015
GetLengthSid.ADVAPI32 ref: 000001845C4F002E
SetTokenInformation.ADVAPI32 ref: 000001845C4F0046
CreateEnvironmentBlock.USERENV ref: 000001845C4F0059
CreateProcessAsUserW.ADVAPI32 ref: 000001845C4F00A1
CreateProcessAsUserW.ADVAPI32 ref: 000001845C4F00EC
GetLastError.KERNEL32 ref: 000001845C4F00F6
CloseHandle.KERNEL32 ref: 000001845C4F0108
CloseHandle.KERNEL32 ref: 000001845C4F011C

Strings

S-1-16-12288, xrefs: 000001845C4F000E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CreateTokenUser$CloseErrorHandleLastProcess$BlockConvertDuplicateEnvironmentInformationLengthQueryString
String ID: S-1-16-12288
API String ID: 1141289200-1849704789
Opcode ID: caeb1a379e724c93c67c04a80382c5ed4d88f45cfcb5109627a83da083652068
Instruction ID: 416140f666058c452021d40870dd9c68003e6d40515f9707e28d2dd3b6a9b11b
Opcode Fuzzy Hash: caeb1a379e724c93c67c04a80382c5ed4d88f45cfcb5109627a83da083652068
Instruction Fuzzy Hash: 64614D36604B55C7EB108FA1E88079EB7B4F799B88F504215EE8953F28DF38D295CB44

Function 000001845C4EBFC0 Relevance: 28.0, APIs: 12, Strings: 4, Instructions: 50COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 000001845C4EBFCF
ClearEventLogW.ADVAPI32 ref: 000001845C4EBFE2
CloseEventLog.ADVAPI32 ref: 000001845C4EBFEB
OpenEventLogW.ADVAPI32 ref: 000001845C4EBFFA
ClearEventLogW.ADVAPI32 ref: 000001845C4EC00D
CloseEventLog.ADVAPI32 ref: 000001845C4EC016
OpenEventLogW.ADVAPI32 ref: 000001845C4EC025
ClearEventLogW.ADVAPI32 ref: 000001845C4EC038
CloseEventLog.ADVAPI32 ref: 000001845C4EC041
OpenEventLogW.ADVAPI32 ref: 000001845C4EC050
ClearEventLogW.ADVAPI32 ref: 000001845C4EC063
CloseEventLog.ADVAPI32 ref: 000001845C4EC06C

Strings

Application, xrefs: 000001845C4EBFC6
Security, xrefs: 000001845C4EBFF1
System, xrefs: 000001845C4EC01C
Setup, xrefs: 000001845C4EC047

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$Setup$System
API String ID: 1391105993-476969907
Opcode ID: 5021a1d87680e35f003e85da53eefad997846ad59c3c35a2b55918231f5bdb21
Instruction ID: eb4902bacb9716d8a145958cfeb9317bf8f19d3fd096ca1d6c3070a3bf0b52cc
Opcode Fuzzy Hash: 5021a1d87680e35f003e85da53eefad997846ad59c3c35a2b55918231f5bdb21
Instruction Fuzzy Hash: 4B11C174601F27C3FE1D9FB6B95839D92916F5DF41F88C725880A86350EE3CC2498348

Function 000001845C4FAD30 Relevance: 27.3, APIs: 18, Instructions: 252networkthreadCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 000001845C4FADCC
WSACreateEvent.WS2_32 ref: 000001845C4FADDA
WSAEventSelect.WS2_32 ref: 000001845C4FADFE
WSAEventSelect.WS2_32 ref: 000001845C4FAE17
WSAWaitForMultipleEvents.WS2_32 ref: 000001845C4FAE56
WSAEnumNetworkEvents.WS2_32 ref: 000001845C4FAE82
WSAEnumNetworkEvents.WS2_32 ref: 000001845C4FAF10
WSAWaitForMultipleEvents.WS2_32 ref: 000001845C4FAF96
VirtualFree.KERNEL32 ref: 000001845C4FAFDD
VirtualFree.KERNEL32 ref: 000001845C4FB007
VirtualFree.KERNEL32 ref: 000001845C4FB022
VirtualFree.KERNEL32 ref: 000001845C4FB04C
VirtualFree.KERNEL32 ref: 000001845C4FB062
GetCurrentThreadId.KERNEL32 ref: 000001845C4FB06D
IsBadReadPtr.KERNEL32 ref: 000001845C4FB07D
EnterCriticalSection.KERNEL32 ref: 000001845C4FB08C
VirtualFree.KERNEL32 ref: 000001845C4FB0D2
LeaveCriticalSection.KERNEL32 ref: 000001845C4FB0DD

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$EventEvents$CreateCriticalEnumMultipleNetworkSectionSelectWait$CurrentEnterLeaveReadThread
String ID:
API String ID: 4074094491-0
Opcode ID: 0f0ffae681726fcd768551af21c48319e4c13f85f93b30996a74dbc28cd3cd94
Instruction ID: bf414f5f577f3c91212c2572975033aaa3508c88342c5e267bcccb2187cf9eef
Opcode Fuzzy Hash: 0f0ffae681726fcd768551af21c48319e4c13f85f93b30996a74dbc28cd3cd94
Instruction Fuzzy Hash: E4B1BC32301B4687EB64DF56E444BAEB3A4FB8AF90F44C211DE9A47B94DF38C6458748

Function 000001845C4F4FC0 Relevance: 25.7, APIs: 17, Instructions: 224memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F500E
VirtualFree.KERNEL32 ref: 000001845C4F5038
VirtualAlloc.KERNEL32 ref: 000001845C4F504F
VirtualAlloc.KERNEL32 ref: 000001845C4F50EF
InitializeCriticalSection.KERNEL32 ref: 000001845C4F5109
CreateEventW.KERNEL32 ref: 000001845C4F5126
VirtualFree.KERNEL32 ref: 000001845C4F518D
VirtualFree.KERNEL32 ref: 000001845C4F51B7
CloseHandle.KERNEL32 ref: 000001845C4F51D8
IsBadReadPtr.KERNEL32 ref: 000001845C4F51EE
IsBadReadPtr.KERNEL32 ref: 000001845C4F5215
WaitForMultipleObjects.KERNEL32 ref: 000001845C4F5256
CloseHandle.KERNEL32 ref: 000001845C4F5269
IsBadReadPtr.KERNEL32 ref: 000001845C4F5288
VirtualFree.KERNEL32 ref: 000001845C4F52D6
VirtualFree.KERNEL32 ref: 000001845C4F5300
VirtualFree.KERNEL32 ref: 000001845C4F532D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalFreeSection$Read$Enter$CloseHandleInitializeLeave$CreateEventMultipleObjectsWait
String ID:
API String ID: 1725847572-0
Opcode ID: 876fc3b34448328f9269e67c67e9409e61e97c701b227af607bf82faa45f4fcb
Instruction ID: 8f6bb53bc42ec199e4724ec7b564416bd44402f651e95579e9cb261f1b04432c
Opcode Fuzzy Hash: 876fc3b34448328f9269e67c67e9409e61e97c701b227af607bf82faa45f4fcb
Instruction Fuzzy Hash: 49A14536201B4187EB58CF62E494BAD73A4FB99F84F45C225CE4A43B58DF38D664C788

Function 000001845C503760 Relevance: 25.7, APIs: 17, Instructions: 183filememoryCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001845C5037A7
memcpy.NTDLL ref: 000001845C5037B9
CreateFileW.KERNEL32 ref: 000001845C5037F8
GetFileSize.KERNEL32 ref: 000001845C503821
SetFilePointer.KERNEL32 ref: 000001845C50383D
VirtualAlloc.KERNEL32 ref: 000001845C503854
GetLastError.KERNEL32 ref: 000001845C503862
free.MSVCRT ref: 000001845C503876
ReadFile.KERNEL32 ref: 000001845C5038BC
VirtualFree.KERNEL32 ref: 000001845C503988
VirtualFree.KERNEL32 ref: 000001845C5039B2
VirtualFree.KERNEL32 ref: 000001845C5039C8
VirtualFree.KERNEL32 ref: 000001845C5039F2
GetLastError.KERNEL32 ref: 000001845C5039FA
VirtualFree.KERNEL32 ref: 000001845C503A16

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

GetLastError.KERNEL32 ref: 000001845C503A21
free.MSVCRT ref: 000001845C503A35

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Free$FileRead$EnterErrorLast$Leavefree$CreateInitializePointerSizemallocmemcpy
String ID:
API String ID: 1128571104-0
Opcode ID: af9bb7d1b2c8ca7110cb3b755bcb326d2b0b0e4f4ea9e483cf88b5d16ac75476
Instruction ID: 56ecf1c5cd5917ef1a6a3e50233193b740224f56fd51ad1ba04a06ec013d7fe3
Opcode Fuzzy Hash: af9bb7d1b2c8ca7110cb3b755bcb326d2b0b0e4f4ea9e483cf88b5d16ac75476
Instruction Fuzzy Hash: DD71AB36305B9187EB64CFA2E95479EB3A1FB99F94F408215CE8A43B54DF38C249CB44

Function 000001845C4F1A10 Relevance: 25.7, APIs: 17, Instructions: 178networkCOMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4F1A2A
memset.NTDLL ref: 000001845C4F1A74
WSACreateEvent.WS2_32 ref: 000001845C4F1A79
WSACreateEvent.WS2_32 ref: 000001845C4F1A82
WSAEventSelect.WS2_32 ref: 000001845C4F1A97
WSAEventSelect.WS2_32 ref: 000001845C4F1AA9
WSAWaitForMultipleEvents.WS2_32 ref: 000001845C4F1AE0
WSAEnumNetworkEvents.WS2_32 ref: 000001845C4F1B0A
memset.NTDLL ref: 000001845C4F1B31
recv.WS2_32 ref: 000001845C4F1B4A
WSAEnumNetworkEvents.WS2_32 ref: 000001845C4F1B92
WSAWaitForMultipleEvents.WS2_32 ref: 000001845C4F1BF9
CancelIo.KERNEL32 ref: 000001845C4F1C26
closesocket.WS2_32 ref: 000001845C4F1C2F
VirtualFree.KERNEL32 ref: 000001845C4F1C4A
VirtualFree.KERNEL32 ref: 000001845C4F1C7A
VirtualFree.KERNEL32 ref: 000001845C4F1C8B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: EventEvents$FreeVirtual$CreateEnumMultipleNetworkSelectWaitmemset$Cancel__chkstkclosesocketrecv
String ID:
API String ID: 3006828577-0
Opcode ID: 755613185204baf14ea6cb944d7e5b8ba692d085ee73819a7632e4f2f8082908
Instruction ID: 504ac75545cdacc18b651341fdd4bd4d027158b93bafea95c5984a6e3951eabc
Opcode Fuzzy Hash: 755613185204baf14ea6cb944d7e5b8ba692d085ee73819a7632e4f2f8082908
Instruction Fuzzy Hash: E0710532300B9283EB648F66E454BDEA7A1F796F90F54C211DE5A837A4DF38D645CB08

Function 000001845C4FE010 Relevance: 25.7, APIs: 17, Instructions: 170keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 000001845C4FE024
BlockInput.USER32 ref: 000001845C4FE061
GetDC.USER32 ref: 000001845C4FE0A4
GetDeviceCaps.GDI32 ref: 000001845C4FE10C
GetDeviceCaps.GDI32 ref: 000001845C4FE11A
GetDeviceCaps.GDI32 ref: 000001845C4FE128
GetDeviceCaps.GDI32 ref: 000001845C4FE156
MapVirtualKeyW.USER32 ref: 000001845C4FE1BC
keybd_event.USER32 ref: 000001845C4FE1D0
BlockInput.USER32 ref: 000001845C4FE355

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CapsDevice$BlockInput$Virtualkeybd_event
String ID:
API String ID: 4019288356-0
Opcode ID: 80f6854fd55cfec3db650c4c49a6fd06f20ce82fbc0cb067e63b0ba8c2a67ee0
Instruction ID: 918ee9a51b7a60b8374d9d6ebde108e903eec850dbd254bbaf804c873493088e
Opcode Fuzzy Hash: 80f6854fd55cfec3db650c4c49a6fd06f20ce82fbc0cb067e63b0ba8c2a67ee0
Instruction Fuzzy Hash: 1461353261469583E3698F31E848BEEB3A1FB9AB41F54D712DE4A02764DF39E684C704

Function 000001845C526670 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 258stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 000001845C52669A

Strings

lws_parse_numeric_address, xrefs: 000001845C52693B, 000001845C526985
%s: ended on e %d, xrefs: 000001845C526942
lws_create_vhost, xrefs: 000001845C52667D
%s: malformed ip address, xrefs: 000001845C526991

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: strchr
String ID: %s: ended on e %d$%s: malformed ip address$lws_create_vhost$lws_parse_numeric_address
API String ID: 2830005266-2525933588
Opcode ID: 70010e423fb3755efd61014bceaeae7baf17920ebf1afdbeec04516e640b8e02
Instruction ID: eb042f112b405d42970fb4d10b27aaa805432e48b5306107ca279fd786b04090
Opcode Fuzzy Hash: 70010e423fb3755efd61014bceaeae7baf17920ebf1afdbeec04516e640b8e02
Instruction Fuzzy Hash: 52A139323045AE87FB258AA994043EEE6D1E7627A4F54C311EAA747AD5CF34C74DC309

Function 000001845C4E73D0 Relevance: 24.2, APIs: 16, Instructions: 212pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E7423

Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34EB
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E34FD
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3510
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3527
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3556
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3568
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E357B
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3592
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35C1
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E35D3
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35E6
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35FD
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E362C
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E363E
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3654

Part of subcall function 000001845C4E6C70: memcpy.NTDLL ref: 000001845C4E6C8E
Part of subcall function 000001845C4E6C70: memset.NTDLL ref: 000001845C4E6CA0
Part of subcall function 000001845C4E6C70: lstrcatA.KERNEL32 ref: 000001845C4E6CC0
Part of subcall function 000001845C4E6C70: lstrcatW.KERNEL32 ref: 000001845C4E6CF4

VirtualFree.KERNEL32 ref: 000001845C4E744D
VirtualFree.KERNEL32 ref: 000001845C4E749D
VirtualFree.KERNEL32 ref: 000001845C4E74C7
VirtualFree.KERNEL32 ref: 000001845C4E74EF
VirtualFree.KERNEL32 ref: 000001845C4E7519
DisconnectNamedPipe.KERNEL32 ref: 000001845C4E7546
CloseHandle.KERNEL32 ref: 000001845C4E7555
DeleteCriticalSection.KERNEL32 ref: 000001845C4E7563
VirtualFree.KERNEL32 ref: 000001845C4E7574
VirtualFree.KERNEL32 ref: 000001845C4E7615
VirtualFree.KERNEL32 ref: 000001845C4E763F
VirtualFree.KERNEL32 ref: 000001845C4E7655
VirtualFree.KERNEL32 ref: 000001845C4E767F
VirtualFree.KERNEL32 ref: 000001845C4E7695

Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3678
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3691
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36A7
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36CB
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E36E4
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36FA
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3726
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E373F
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3755
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3779
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3792
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E37A8

Part of subcall function 000001845C4E6BC0: IsBadReadPtr.KERNEL32 ref: 000001845C4E6BE3
Part of subcall function 000001845C4E6BC0: EnterCriticalSection.KERNEL32(?,?,00000038,000001845C4E71A6), ref: 000001845C4E6BFE
Part of subcall function 000001845C4E6BC0: LeaveCriticalSection.KERNEL32(?,?,00000038,000001845C4E71A6), ref: 000001845C4E6C21

VirtualFree.KERNEL32 ref: 000001845C4E76BF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Free$EnterRead$Leave$Alloc$lstrcat$CloseDeleteDisconnectHandleInitializeNamedPipememcpymemset
String ID:
API String ID: 4255235403-0
Opcode ID: 487ab0318e1d18530209ff1e23f5e332d75461c33a839119e161c17338c97bb7
Instruction ID: f12f24a3b97196902c1d0985fc12125309b61ddd7cbe1a596d1e71558d831d69
Opcode Fuzzy Hash: 487ab0318e1d18530209ff1e23f5e332d75461c33a839119e161c17338c97bb7
Instruction Fuzzy Hash: E5917A32705F4187EB68CF66E5507AEB3A0FB9AF94F49C214CA8A03B55DF38D2508749

Function 000001845C4F1520 Relevance: 24.1, APIs: 16, Instructions: 140networkmemorythreadCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F1548
VirtualFree.KERNEL32 ref: 000001845C4F15AF
VirtualFree.KERNEL32 ref: 000001845C4F15D9
socket.WS2_32 ref: 000001845C4F15ED
setsockopt.WS2_32 ref: 000001845C4F161F
htons.WS2_32 ref: 000001845C4F163A
inet_addr.WS2_32 ref: 000001845C4F164F
htonl.WS2_32 ref: 000001845C4F1659
bind.WS2_32 ref: 000001845C4F1672
WSAGetLastError.WS2_32 ref: 000001845C4F167C
listen.WS2_32 ref: 000001845C4F1696
CreateThread.KERNEL32 ref: 000001845C4F16C4
IsBadReadPtr.KERNEL32 ref: 000001845C4F16DD
EnterCriticalSection.KERNEL32 ref: 000001845C4F16F0
VirtualAlloc.KERNEL32 ref: 000001845C4F1707
LeaveCriticalSection.KERNEL32 ref: 000001845C4F172B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalFreeSection$AllocCreateEnterErrorLastLeaveReadThreadbindhtonlhtonsinet_addrlistenmemsetsetsockoptsocket
String ID:
API String ID: 1206800484-0
Opcode ID: 3b4ce19dcc75c1c8cdbd46baa2501b7c779ff89514a24e43775d64ba7dc00e07
Instruction ID: 146eac22565008005cee9a6c6ad73e16a5ea5b03e05acc432e8544318c3dd6da
Opcode Fuzzy Hash: 3b4ce19dcc75c1c8cdbd46baa2501b7c779ff89514a24e43775d64ba7dc00e07
Instruction Fuzzy Hash: 89517E32304B5183E7298F61E8447DDB3B0FB99F85F848226DA4A43B94DF38D655CB48

Function 000001845C526B30 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 180networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 000001845C526C07
_unlink.MSVCRT ref: 000001845C526D10
bind.WS2_32 ref: 000001845C526D2C
WSAGetLastError.WS2_32 ref: 000001845C526D3D
getsockname.WS2_32 ref: 000001845C526DEA
htons.WS2_32 ref: 000001845C526DFB

Strings

ERROR on binding fd %d to port %d (%d %d), xrefs: 000001845C526DA8
lws_create_vhost, xrefs: 000001845C526B3C
lws_socket_bind, xrefs: 000001845C526C89, 000001845C526D57
@, xrefs: 000001845C526CFE
"%s" too long for UNIX domain socket, xrefs: 000001845C526C7F
ERROR on binding fd %d to "%s" (%d %d), xrefs: 000001845C526D77

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: htons$ErrorLast_unlinkbindgetsockname
String ID: "%s" too long for UNIX domain socket$@$ERROR on binding fd %d to "%s" (%d %d)$ERROR on binding fd %d to port %d (%d %d)$lws_create_vhost$lws_socket_bind
API String ID: 4073785539-2597659182
Opcode ID: 24bc8069ff57ac113c3f7b0f3bc0ec0c4e81cfd8a2103457d748139057c3f398
Instruction ID: 5b109913580056e519705c049536e0366c555592e13b575a3602be014df4b7ab
Opcode Fuzzy Hash: 24bc8069ff57ac113c3f7b0f3bc0ec0c4e81cfd8a2103457d748139057c3f398
Instruction Fuzzy Hash: E6819172614B9587EB24DFA1E8403EDB3A0F3A5794F409316EE8957A59DF38C788C704

Function 000001845C4F30FE Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150sleepCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 000001845C4F6AC8
VirtualFree.KERNEL32 ref: 000001845C4F6AF2
malloc.MSVCRT ref: 000001845C4F6B7D
malloc.MSVCRT ref: 000001845C4F6B89
VirtualFree.KERNEL32 ref: 000001845C4F6BE2
VirtualFree.KERNEL32 ref: 000001845C4F6C0C
NetUserAdd.NETAPI32 ref: 000001845C4F6C46
Sleep.KERNEL32 ref: 000001845C4F6C51
NetLocalGroupAddMembers.NETAPI32 ref: 000001845C4F6C76
free.MSVCRT ref: 000001845C4F6C89
free.MSVCRT ref: 000001845C4F6C92

Strings

Administrators, xrefs: 000001845C4F6C6D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$freemalloc$GroupLocalMembersSleepUser
String ID: Administrators
API String ID: 2980277588-3395160503
Opcode ID: da3a28424a5a67998ed531bb1b5f40b6d27e172e32b39df16f7556483a8c1416
Instruction ID: 7f0eb42ef3a2b1dc8275282ab70d489c33b33ec921b62a8b32e3714893444961
Opcode Fuzzy Hash: da3a28424a5a67998ed531bb1b5f40b6d27e172e32b39df16f7556483a8c1416
Instruction Fuzzy Hash: 18517C32B00B118BEB148F76D8547EC73A5FB9AF88F54C225DE0A06B58DE38D645C748

Function 000001845C4E1AE0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103memorynativesynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 000001845C4E1B02
VirtualAlloc.KERNEL32 ref: 000001845C4E1B29

Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32(?,?,?,?,?,?,00100000,000001845C4E1B37), ref: 000001845C4F0697
Part of subcall function 000001845C4F0680: GetCurrentProcess.KERNEL32 ref: 000001845C4F06C8
Part of subcall function 000001845C4F0680: OpenProcessToken.ADVAPI32 ref: 000001845C4F06D9
Part of subcall function 000001845C4F0680: LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4F0701
Part of subcall function 000001845C4F0680: AdjustTokenPrivileges.KERNELBASE ref: 000001845C4F0721
Part of subcall function 000001845C4F0680: GetLastError.KERNEL32 ref: 000001845C4F0727
Part of subcall function 000001845C4F0680: CloseHandle.KERNEL32 ref: 000001845C4F073B
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F0752
Part of subcall function 000001845C4F0680: InitializeCriticalSection.KERNEL32 ref: 000001845C4F0764
Part of subcall function 000001845C4F0680: IsBadReadPtr.KERNEL32 ref: 000001845C4F077D
Part of subcall function 000001845C4F0680: EnterCriticalSection.KERNEL32 ref: 000001845C4F0790
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F07A7
Part of subcall function 000001845C4F0680: LeaveCriticalSection.KERNEL32 ref: 000001845C4F07D6
Part of subcall function 000001845C4F0680: IsBadReadPtr.KERNEL32 ref: 000001845C4F07E8
Part of subcall function 000001845C4F0680: EnterCriticalSection.KERNEL32 ref: 000001845C4F07FB
Part of subcall function 000001845C4F0680: VirtualAlloc.KERNEL32 ref: 000001845C4F0812

WaitForSingleObject.KERNEL32 ref: 000001845C4E1B4D
NtQuerySystemInformation.NTDLL ref: 000001845C4E1B6B
VirtualFree.KERNEL32 ref: 000001845C4E1B89
VirtualAlloc.KERNEL32 ref: 000001845C4E1B9D
memset.NTDLL ref: 000001845C4E1BB9
NtQuerySystemInformation.NTDLL ref: 000001845C4E1BD2
lstrcmpiW.KERNEL32 ref: 000001845C4E1BF3
WaitForSingleObject.KERNEL32 ref: 000001845C4E1C40
CloseHandle.KERNEL32 ref: 000001845C4E1C54

Strings

taskmgr.exe, xrefs: 000001845C4E1BEC

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalSection$CloseEnterHandleInformationObjectProcessQueryReadSingleSystemTokenWait$AdjustCreateCurrentErrorEventFreeInitializeLastLeaveLookupOpenPrivilegePrivilegesValuelstrcmpimemset
String ID: taskmgr.exe
API String ID: 441768363-4156271273
Opcode ID: 0621dc44498ae919b7e903597f6a72dc258cdebb099c8e8026c95ccd3122d783
Instruction ID: 1b7a588056662e0521b71279a17d26c24fa119c3df4650cc48e6eba33a4f8c63
Opcode Fuzzy Hash: 0621dc44498ae919b7e903597f6a72dc258cdebb099c8e8026c95ccd3122d783
Instruction Fuzzy Hash: A641D13170565A87EB249F52E910BEEFB61BB95FC0F41C219DE0647AA4EF38CA04C749

Function 000001845C4EAAD0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001845C4EAB23
RegisterClassW.USER32 ref: 000001845C4EAB46
CreateWindowExW.USER32 ref: 000001845C4EAB9C
SetWindowLongPtrW.USER32 ref: 000001845C4EABB9
WTSRegisterSessionNotification.WTSAPI32 ref: 000001845C4EABC7
ShowWindow.USER32 ref: 000001845C4EABD6
GetMessageW.USER32 ref: 000001845C4EAC01
TranslateMessage.USER32 ref: 000001845C4EAC15
DispatchMessageW.USER32 ref: 000001845C4EAC20
GetMessageW.USER32 ref: 000001845C4EAC33
WTSUnRegisterSessionNotification.WTSAPI32 ref: 000001845C4EAC40

Strings

Session Logon, xrefs: 000001845C4EAB54

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Message$RegisterWindow$NotificationSession$ClassCreateDispatchHandleLongModuleShowTranslate
String ID: Session Logon
API String ID: 1979525249-2950959013
Opcode ID: 0d96d5dafa15c8008ce9f0b536f309e21048c116557f430f552321169d452b8d
Instruction ID: 3b39acc451c527ce0e4eb6d3d9a15779dd2be55a3b5eaaad88078396fc7016a3
Opcode Fuzzy Hash: 0d96d5dafa15c8008ce9f0b536f309e21048c116557f430f552321169d452b8d
Instruction Fuzzy Hash: 4041B732608B9683E714CF65F8447AEF3A1F799B40F55C325EA8943A24DF78C184CB44

Function 000001845C4E7FA0 Relevance: 19.7, APIs: 13, Instructions: 166memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E7FF4
VirtualFree.KERNEL32 ref: 000001845C4E801E
VirtualAlloc.KERNEL32 ref: 000001845C4E8035
VirtualAlloc.KERNEL32 ref: 000001845C4E80D2
InitializeCriticalSection.KERNEL32 ref: 000001845C4E80E4
CreateEventW.KERNEL32 ref: 000001845C4E8104
VirtualFree.KERNEL32 ref: 000001845C4E816E
VirtualFree.KERNEL32 ref: 000001845C4E8198
GetCurrentThreadId.KERNEL32 ref: 000001845C4E819E
IsBadReadPtr.KERNEL32 ref: 000001845C4E81B5
EnterCriticalSection.KERNEL32 ref: 000001845C4E81C8
VirtualAlloc.KERNEL32 ref: 000001845C4E81DF
LeaveCriticalSection.KERNEL32 ref: 000001845C4E8203

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterFreeRead$Leave$Initialize$CreateCurrentEventThread
String ID:
API String ID: 3016386783-0
Opcode ID: 1454743fbe7efa11aabd04cc1c8ed9c14f50533e4e827fb8bae3627dc7ceb715
Instruction ID: af61751120165cb8fc783ca81390772a6040e8cdca490891c873c0b323573639
Opcode Fuzzy Hash: 1454743fbe7efa11aabd04cc1c8ed9c14f50533e4e827fb8bae3627dc7ceb715
Instruction Fuzzy Hash: DE717E32301F4187EB24CF62E844A9EB3A4FB59B80F45C225DB8A43B64DF38D654C748

Function 000001845C4EAE40 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80windowclipboardregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001845C4EAE78
RegisterClassW.USER32 ref: 000001845C4EAE9D
CreateWindowExW.USER32 ref: 000001845C4EAEFB
SetClipboardViewer.USER32 ref: 000001845C4EAF10
ShowWindow.USER32 ref: 000001845C4EAF22
GetMessageW.USER32 ref: 000001845C4EAF4A
TranslateMessage.USER32 ref: 000001845C4EAF59
DispatchMessageW.USER32 ref: 000001845C4EAF64
GetMessageW.USER32 ref: 000001845C4EAF77
ChangeClipboardChain.USER32 ref: 000001845C4EAF8B

Strings

CutActive, xrefs: 000001845C4EAE7E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Message$ClipboardWindow$ChainChangeClassCreateDispatchHandleModuleRegisterShowTranslateViewer
String ID: CutActive
API String ID: 3542119435-15800375
Opcode ID: 0d714c67f3cfe865919fbe5d08e246d9116574fc16b8d6ae8ab858ff4aa2f78f
Instruction ID: 3663677eddb6b03fe7759d6a36ba088d49a2a577da9a65aefe9821815b669846
Opcode Fuzzy Hash: 0d714c67f3cfe865919fbe5d08e246d9116574fc16b8d6ae8ab858ff4aa2f78f
Instruction Fuzzy Hash: 58418532618BD683EB24CF61F85479EB3A1F799B80F558225DA8D42A14EF3DC184C744

Function 000001845C4FAA30 Relevance: 18.2, APIs: 12, Instructions: 204memorythreadnetworkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 000001845C4FAAA4
VirtualFree.KERNEL32 ref: 000001845C4FAAC9
htons.WS2_32 ref: 000001845C4FAADD

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34EB
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E34FD
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3510
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3527
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3556
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3568
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E357B
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3592
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35C1
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E35D3
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35E6
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35FD
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E362C
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E363E
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3654

VirtualFree.KERNEL32 ref: 000001845C4FAC00
VirtualFree.KERNEL32 ref: 000001845C4FAC30
VirtualFree.KERNEL32 ref: 000001845C4FAC46
VirtualFree.KERNEL32 ref: 000001845C4FAC70
CreateThread.KERNEL32 ref: 000001845C4FAC9B
IsBadReadPtr.KERNEL32 ref: 000001845C4FACB0
EnterCriticalSection.KERNEL32 ref: 000001845C4FACC3
VirtualAlloc.KERNEL32 ref: 000001845C4FACDA
LeaveCriticalSection.KERNEL32 ref: 000001845C4FACFE

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterRead$Leave$Free$CreateInitializeThreadgetaddrinfohtons
String ID:
API String ID: 900205276-0
Opcode ID: 8c129793120a5eaf90c5e420acc84c96ddf636ddc2a4fcd7ddec8e6b6a481413
Instruction ID: 1c931d47df7b336cd53fdfb48b850c2f16fbd119a9977fbbd793ccb245af656c
Opcode Fuzzy Hash: 8c129793120a5eaf90c5e420acc84c96ddf636ddc2a4fcd7ddec8e6b6a481413
Instruction Fuzzy Hash: EB918B72710B418BEB14DF62E418BAD73A5FB89F88F45822ADE4A43B58DF38C245C344

Function 000001845C4E3E10 Relevance: 16.8, APIs: 10, Strings: 1, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualAlloc.KERNEL32 ref: 000001845C4E3E86
VirtualAlloc.KERNEL32 ref: 000001845C4E3FAD
VirtualFree.KERNEL32 ref: 000001845C4E3FC6
VirtualFree.KERNEL32 ref: 000001845C4E3FDC
VirtualFree.KERNEL32 ref: 000001845C4E40E0
VirtualFree.KERNEL32 ref: 000001845C4E410A
VirtualFree.KERNEL32 ref: 000001845C4E411B
VirtualFree.KERNEL32 ref: 000001845C4E4006

Part of subcall function 000001845C4E5070: _time64.MSVCRT ref: 000001845C4E50E0
Part of subcall function 000001845C4E5070: srand.MSVCRT ref: 000001845C4E50E9
Part of subcall function 000001845C4E5070: rand.MSVCRT ref: 000001845C4E5100

VirtualFree.KERNEL32 ref: 000001845C4E41CF
VirtualFree.KERNEL32 ref: 000001845C4E41F9

Strings

:, xrefs: 000001845C4E4180

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$CriticalSection$EnterRead$Leave$Initialize_time64randsrand
String ID: :
API String ID: 3336294232-336475711
Opcode ID: 320fe126eff4e4079a3c9b3cb6761e39752f23555b150b95cbf71f8c5b9ac005
Instruction ID: 685fc38c0d911349fd87c2835b13a67a1a30148a648e8f90b231413cccf58c4b
Opcode Fuzzy Hash: 320fe126eff4e4079a3c9b3cb6761e39752f23555b150b95cbf71f8c5b9ac005
Instruction Fuzzy Hash: 0EB1AC32710B9283EB258F2AE4147ADA7A0FBDAF84F15E325DE8A43745DF38C6458744

Function 000001845C4EFD10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001845C4EFD41
OpenProcessToken.ADVAPI32 ref: 000001845C4EFD54
LookupPrivilegeValueW.ADVAPI32 ref: 000001845C4EFD7C
AdjustTokenPrivileges.ADVAPI32 ref: 000001845C4EFDA6
GetLastError.KERNEL32 ref: 000001845C4EFDAC
CloseHandle.KERNEL32 ref: 000001845C4EFDC0
OpenProcess.KERNEL32 ref: 000001845C4EFDD0
GetLastError.KERNEL32 ref: 000001845C4EFDF8

Strings

SeDebugPrivilege, xrefs: 000001845C4EFD6B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$ErrorLastOpenToken$AdjustCloseCurrentHandleLookupPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3627867324-2896544425
Opcode ID: 6f061aaa7941448df92f5fc4232100a70558b149b3d13a2c200e355258010a89
Instruction ID: b85d37961887c7cb03bc1cb507477426d49222c58eefdbd40bc23f47aed86f2c
Opcode Fuzzy Hash: 6f061aaa7941448df92f5fc4232100a70558b149b3d13a2c200e355258010a89
Instruction Fuzzy Hash: 5A21B135214B5283E7548F51F40478EB7A1E785FB4F448316AAAA43BD4CF3CC1448B84

Function 000001845C4F6200 Relevance: 15.1, APIs: 10, Instructions: 118clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F624A
VirtualFree.KERNEL32 ref: 000001845C4F6274
OpenClipboard.USER32 ref: 000001845C4F6302
GlobalAlloc.KERNEL32 ref: 000001845C4F631A
GlobalLock.KERNEL32 ref: 000001845C4F632B
GlobalUnlock.KERNEL32 ref: 000001845C4F6349
SetClipboardData.USER32 ref: 000001845C4F6357
CloseClipboard.USER32 ref: 000001845C4F635D
VirtualFree.KERNEL32 ref: 000001845C4F6373
VirtualFree.KERNEL32 ref: 000001845C4F639D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Free$ClipboardEnterGlobalRead$Leave$CloseDataInitializeLockOpenUnlock
String ID:
API String ID: 1362927461-0
Opcode ID: 14aff5e7281eb0515db2efaaa05bc0cffdcae11165ae12660c773d397ca1b196
Instruction ID: 6a1cd5239c2ca24f3ee405dbb46f653f7c433c00ab210cdc760d75b636c36316
Opcode Fuzzy Hash: 14aff5e7281eb0515db2efaaa05bc0cffdcae11165ae12660c773d397ca1b196
Instruction Fuzzy Hash: FD419D32714B5187EB689F62E5447ADA3A1FB99F80F44C215CF8A43F54DF38E1648744

Function 000001845C4FD060 Relevance: 15.1, APIs: 10, Instructions: 61serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 000001845C4FD077
OpenServiceW.ADVAPI32 ref: 000001845C4FD0A7
GetLastError.KERNEL32 ref: 000001845C4FD0B5
CloseServiceHandle.ADVAPI32 ref: 000001845C4FD0C0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: OpenService$CloseErrorHandleLastManager
String ID:
API String ID: 2659350385-0
Opcode ID: d1f9e974718dfdc27abd3533510aa15af3a5deb6cf2be6aac275e286971032ce
Instruction ID: 3dc81cdd53c4f2a7e888584ed1a38093cc0198b60a4a9c54028e2269cf17ae15
Opcode Fuzzy Hash: d1f9e974718dfdc27abd3533510aa15af3a5deb6cf2be6aac275e286971032ce
Instruction Fuzzy Hash: 39218735714A6583EB488FA6F98466D93A0FB9CFD4F449121EE0A43B15DF3CD5858B08

Function 000001845BF30E10 Relevance: 13.9, Strings: 11, Instructions: 162COMMON

Download Yara Rule

Strings

Y:\:, xrefs: 000001845BF30ED8
:Y:, xrefs: 000001845BF3103F
\:[:, xrefs: 000001845BF30F9B
A::, xrefs: 000001845BF30E4F
\:^:, xrefs: 000001845BF3104D
:_:, xrefs: 000001845BF30EF0
^:G:, xrefs: 000001845BF30F44
Y::, xrefs: 000001845BF31046
X:[:, xrefs: 000001845BF30FAA
:, xrefs: 000001845BF310A0
X:^:, xrefs: 000001845BF30EE8

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: :_:$:Y:$:$A::$X:[:$X:^:$Y::$Y:\:$\:[:$\:^:$^:G:
API String ID: 0-2205580742
Opcode ID: d90148109c58263767cfb54190a6e54a75e0a48cc10efb8014eb7dc9dcd99103
Instruction ID: dcab3b9f2db7d9d944fb45beb8de10387a31829edead7d99da5042bcf1608516
Opcode Fuzzy Hash: d90148109c58263767cfb54190a6e54a75e0a48cc10efb8014eb7dc9dcd99103
Instruction Fuzzy Hash: 9791EE73D18BD58BE311CF7994016AEBB70F795348F14A349EA846691AEF78E680CF00

Function 000001845C4FA7F0 Relevance: 13.7, APIs: 9, Instructions: 171COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 000001845C4FA865
VirtualFree.KERNEL32 ref: 000001845C4FA88F
VirtualFree.KERNEL32 ref: 000001845C4FA9EB
VirtualFree.KERNEL32 ref: 000001845C4FAA15

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7fc2db687d2db18f914aee26642cc12e023eef4ef06861d8de73db2aff1532c5
Instruction ID: f6eb2573d363cded6fe95f836757bdf273038e96beced32d72862337af752f53
Opcode Fuzzy Hash: 7fc2db687d2db18f914aee26642cc12e023eef4ef06861d8de73db2aff1532c5
Instruction Fuzzy Hash: D8518D76301B1197EB18DF62E654BAD63A1FB8AF81F048125CF4A43F54DF38D2668718

Function 000001845C4F6810 Relevance: 13.7, APIs: 9, Instructions: 162stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

NetUserEnum.NETAPI32 ref: 000001845C4F688C
lstrlenW.KERNEL32 ref: 000001845C4F68CE
NetApiBufferFree.NETAPI32 ref: 000001845C4F6929
malloc.MSVCRT ref: 000001845C4F6945
VirtualFree.KERNEL32 ref: 000001845C4F69F7
VirtualFree.KERNEL32 ref: 000001845C4F6A21
free.MSVCRT ref: 000001845C4F6A2A
VirtualFree.KERNEL32 ref: 000001845C4F6A54
VirtualFree.KERNEL32 ref: 000001845C4F6A7E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocFree$EnterRead$Leave$BufferEnumInitializeUserfreelstrlenmalloc
String ID:
API String ID: 1638303497-0
Opcode ID: 65d04138dd441912b688736d00cc8846464790f10e23658900d22c822e7612d9
Instruction ID: dd10ea7b3c2bba1f027ea9623fac76b984904199cfbfb28225e1ccd5fe8b74d0
Opcode Fuzzy Hash: 65d04138dd441912b688736d00cc8846464790f10e23658900d22c822e7612d9
Instruction Fuzzy Hash: C3617C32715B9187EB64CF22E4447AEB3A4FB8AF80F449225DE8A43B58DF38D544CB44

Function 000001845C4F5A10 Relevance: 12.7, APIs: 10, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F5A64
VirtualFree.KERNEL32 ref: 000001845C4F5A8E
VirtualAlloc.KERNEL32 ref: 000001845C4F5AA5
VirtualFree.KERNEL32 ref: 000001845C4F5B6E
VirtualFree.KERNEL32 ref: 000001845C4F5B98
VirtualFree.KERNEL32 ref: 000001845C4F5BBD
VirtualFree.KERNEL32 ref: 000001845C4F5BE7
VirtualFree.KERNEL32 ref: 000001845C4F5C0A
VirtualFree.KERNEL32 ref: 000001845C4F5C34
VirtualFree.KERNEL32 ref: 000001845C4F5C6C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$AllocCriticalSection$EnterRead$Leave$Initialize
String ID:
API String ID: 529218107-0
Opcode ID: 9fb0c0ea2ccca51140455bb48a2ce0fc2871494495097355718dc06f0b780af2
Instruction ID: d77c795bbfeee55b1c1bad1db8ddf330eba1108143439f03d8c12ca37df1a829
Opcode Fuzzy Hash: 9fb0c0ea2ccca51140455bb48a2ce0fc2871494495097355718dc06f0b780af2
Instruction Fuzzy Hash: 9C714031311F4187EB68DF62E494A9EB3A4FB99F80F48C225CE8A43B14DF39D6518748

Function 000001845C51A830 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001845C51A85D
socket.WS2_32 ref: 000001845C51A87B
htonl.WS2_32 ref: 000001845C51A89A
bind.WS2_32 ref: 000001845C51A8C1
getsockname.WS2_32 ref: 000001845C51A8E6

Strings

%s: failed, xrefs: 000001845C51A90C
lws_plat_pipe_create, xrefs: 000001845C51A900

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: socket$bindgetsocknamehtonl
String ID: %s: failed$lws_plat_pipe_create
API String ID: 858234250-3012564250
Opcode ID: 3e06797931bfed255cca20481481bcc32daeca8df7cbd3f6bce5922f777b38ac
Instruction ID: e56d15a3d0c2a346d4f0be43648e63a54c82e87047881d79e2e76e20361681b2
Opcode Fuzzy Hash: 3e06797931bfed255cca20481481bcc32daeca8df7cbd3f6bce5922f777b38ac
Instruction Fuzzy Hash: 25216232710AA583E7448F64E4483CE7364E754FA8F585336EAA9477E8DF38C681C745

Function 000001845C502660 Relevance: 12.2, APIs: 8, Instructions: 180commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000001845C50267C
CoInitializeSecurity.OLE32 ref: 000001845C5026B5
CoCreateInstance.OLE32 ref: 000001845C5026EF
VariantInit.OLEAUT32 ref: 000001845C502706
SysAllocString.OLEAUT32 ref: 000001845C5027DA
SysFreeString.OLEAUT32 ref: 000001845C5027FA
VirtualFree.KERNEL32 ref: 000001845C5028CD
VirtualFree.KERNEL32 ref: 000001845C5028F7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Free$InitializeStringVirtual$AllocCreateInitInstanceSecurityVariant
String ID:
API String ID: 1458724981-0
Opcode ID: a98515b45f30c999fd584888f1fb30ce494dfbb6bf43997bf48997d6c69b94f9
Instruction ID: 836725aef252814901cf1f9262082927fa5013ba6106a535212241d80c907915
Opcode Fuzzy Hash: a98515b45f30c999fd584888f1fb30ce494dfbb6bf43997bf48997d6c69b94f9
Instruction Fuzzy Hash: 3481B032604BA5C7EB14CFA6E84869DB3B5FB98F85F418216EE4947B18DF38C245CB40

Function 000001845C503E20 Relevance: 12.1, APIs: 8, Instructions: 73networkCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C503E51
CreateEventW.KERNEL32 ref: 000001845C503E82
WSARecv.WS2_32 ref: 000001845C503EB9
WSAGetLastError.WS2_32 ref: 000001845C503EBF
WaitForMultipleObjects.KERNEL32 ref: 000001845C503EDD
WSAGetOverlappedResult.WS2_32 ref: 000001845C503F0C
WSAGetLastError.WS2_32 ref: 000001845C503F12
CloseHandle.KERNEL32 ref: 000001845C503F24

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandleMultipleObjectsOverlappedRecvResultWaitmemset
String ID:
API String ID: 3426673637-0
Opcode ID: b8b262f54c82b47c603efcc098acbee309593ccfe0400ca3453b4a2416fff10a
Instruction ID: b8f4fa9600df94259bd9694fa8f0a63cf0eb0a838cd8379cb399b7518a8b0793
Opcode Fuzzy Hash: b8b262f54c82b47c603efcc098acbee309593ccfe0400ca3453b4a2416fff10a
Instruction Fuzzy Hash: 8E319032204B9687EB20CFA1F440BCEB7A4F798784F509226EB8853A24DF78C655CB44

Function 000001845C4FF1B0 Relevance: 12.1, APIs: 8, Instructions: 68clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 000001845C4FF209
Sleep.KERNEL32 ref: 000001845C4FF216
GetLastError.KERNEL32 ref: 000001845C4FF223
GlobalAlloc.KERNEL32 ref: 000001845C4FF244
GlobalLock.KERNEL32 ref: 000001845C4FF255
GlobalUnlock.KERNEL32 ref: 000001845C4FF26C
SetClipboardData.USER32 ref: 000001845C4FF27A
CloseClipboard.USER32 ref: 000001845C4FF280

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataErrorLastLockOpenSleepUnlock
String ID:
API String ID: 3499886738-0
Opcode ID: 4b723c17ec104936dfe9111a579a009fbd450c761b1b8f465c76b1695d4f4b3d
Instruction ID: c7834fdd0390849f527c64f4636d572cb6a35cbe4a999f0225b72d893020673c
Opcode Fuzzy Hash: 4b723c17ec104936dfe9111a579a009fbd450c761b1b8f465c76b1695d4f4b3d
Instruction Fuzzy Hash: 3621C43632469183EB58DF61F48465DA3A0F789F80F849225EE4743B58DF3CD995CB44

Function 000001845C4F4080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95librarymemoryloaderCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F4097
LoadLibraryW.KERNEL32 ref: 000001845C4F40B5
GetProcAddress.KERNEL32 ref: 000001845C4F40CD
FreeLibrary.KERNEL32 ref: 000001845C4F40DD

Strings

SetProcessDPIAware, xrefs: 000001845C4F40C3
user32.dll, xrefs: 000001845C4F40A9

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Library$AddressAllocFreeLoadProcVirtual
String ID: SetProcessDPIAware$user32.dll
API String ID: 3041263384-1137607222
Opcode ID: 2d5c190feabc2370d29f15f15ffb36fb6660cf0171777757c6844a959bed01c6
Instruction ID: 79675da56a16de244377e4484ae897b5aca5542dcc9b181d62b1d0baeac49688
Opcode Fuzzy Hash: 2d5c190feabc2370d29f15f15ffb36fb6660cf0171777757c6844a959bed01c6
Instruction Fuzzy Hash: 43515435212F8697EB459F60E880BDD33E9FB09B45F989736C94D06364EF389258C368

Function 000001845C4FCD30 Relevance: 10.6, APIs: 7, Instructions: 70stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000001845C4FCD70
QueryDosDeviceW.KERNEL32 ref: 000001845C4FCDCF
lstrlenW.KERNEL32 ref: 000001845C4FCDDE
wcsncmp.NTDLL ref: 000001845C4FCDF2
lstrcpyW.KERNEL32 ref: 000001845C4FCE17
lstrcpyW.KERNEL32 ref: 000001845C4FCE47
lstrcatW.KERNEL32 ref: 000001845C4FCE54

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlenwcsncmp
String ID:
API String ID: 1240803607-0
Opcode ID: f5144d0f8da87860272a3bab1dd78902ada191ba324fd56ce968b0d5fe92846b
Instruction ID: 685312c43e9ecb441297793f1e00e2db0b6edeae11e4694d384c66e6bdf61e0a
Opcode Fuzzy Hash: f5144d0f8da87860272a3bab1dd78902ada191ba324fd56ce968b0d5fe92846b
Instruction Fuzzy Hash: F2319376214A9293EA748F11E8007EE7361FB84FC5F848226DE8947B58EF3CC655CB44

Function 000001845C4F05A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000001845C4F05FA
memset.NTDLL ref: 000001845C4F0615
lstrlenA.KERNEL32 ref: 000001845C4F061F
DeviceIoControl.KERNEL32 ref: 000001845C4F065A
CloseHandle.KERNEL32 ref: 000001845C4F0663

Strings

\\.\{F8284233-48F4-4680-ADDD-F8284233}, xrefs: 000001845C4F05D8

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandlelstrlenmemset
String ID: \\.\{F8284233-48F4-4680-ADDD-F8284233}
API String ID: 2589617790-329358119
Opcode ID: a3b02f37b284e632ff8c0487233c56c7f58dd63dbc29904f1061be0df106d2bb
Instruction ID: 428480ea852dab226c5e4595e6cff94183beb8e87ffc1a5379930d7a05a665a3
Opcode Fuzzy Hash: a3b02f37b284e632ff8c0487233c56c7f58dd63dbc29904f1061be0df106d2bb
Instruction Fuzzy Hash: 0E112636218A9183E7618B90F8447CAB3A0F7D9744F948226EA8943B58DF7DC248CB44

Function 000001845C4F57C0 Relevance: 10.2, APIs: 8, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F5814
VirtualFree.KERNEL32 ref: 000001845C4F583E
VirtualAlloc.KERNEL32 ref: 000001845C4F5855
VirtualFree.KERNEL32 ref: 000001845C4F594C
VirtualFree.KERNEL32 ref: 000001845C4F5976
VirtualFree.KERNEL32 ref: 000001845C4F599B
VirtualFree.KERNEL32 ref: 000001845C4F59C5
VirtualFree.KERNEL32 ref: 000001845C4F59EA

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 2398d3e56b10dcafaaf99b981a30711067a2213169235feba3d334b158cf1ca3
Instruction ID: bb393b75247a710a1a8de15f26fa3ebb08409bfb7f5e40095d8d8476c63545f3
Opcode Fuzzy Hash: 2398d3e56b10dcafaaf99b981a30711067a2213169235feba3d334b158cf1ca3
Instruction Fuzzy Hash: B9613B36301F5187EB68DF62E494A9EB3A5FB99B80F45C225CE8A43B14DF38D254C748

Function 000001845C4F5340 Relevance: 10.1, APIs: 8, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F5394
VirtualFree.KERNEL32 ref: 000001845C4F53BE
VirtualAlloc.KERNEL32 ref: 000001845C4F53D5
VirtualFree.KERNEL32 ref: 000001845C4F54C1
VirtualFree.KERNEL32 ref: 000001845C4F54EB
VirtualFree.KERNEL32 ref: 000001845C4F5510
VirtualFree.KERNEL32 ref: 000001845C4F553A
VirtualFree.KERNEL32 ref: 000001845C4F555F

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: a2f3d28db6f5c7a542f089183b464a35e1dffb07d7f729c69724856baa88be71
Instruction ID: 7c1ca102a37f1e6b7ba3e6a967b8e7008370b7aeb40131eb1da9629f46fb4d08
Opcode Fuzzy Hash: a2f3d28db6f5c7a542f089183b464a35e1dffb07d7f729c69724856baa88be71
Instruction Fuzzy Hash: 4A614D36311F4187EB64DF62E494A9EB3A5FB99B80F45C225CE8A43B14DF38E254C748

Function 000001845C4F4D90 Relevance: 10.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F4DE4
VirtualFree.KERNEL32 ref: 000001845C4F4E0E
VirtualAlloc.KERNEL32 ref: 000001845C4F4E25
VirtualFree.KERNEL32 ref: 000001845C4F4EFB
VirtualFree.KERNEL32 ref: 000001845C4F4F25
VirtualFree.KERNEL32 ref: 000001845C4F4F4A
VirtualFree.KERNEL32 ref: 000001845C4F4F74
VirtualFree.KERNEL32 ref: 000001845C4F4F99

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: f7de3ef79a839558e92453357d372ecf487bd6df2e347dd270595c6328062898
Instruction ID: 4b46c0b862d2478ee9667a801caf52cbfe3f92598fb15ed89ebf88f1d39863b9
Opcode Fuzzy Hash: f7de3ef79a839558e92453357d372ecf487bd6df2e347dd270595c6328062898
Instruction Fuzzy Hash: 82513936311F4187EB64CF62E454A9EB3A5FB99B80F45C225DE8A43B14DF39E2508748

Function 000001845C4F5590 Relevance: 10.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F55E4
VirtualFree.KERNEL32 ref: 000001845C4F560E
VirtualAlloc.KERNEL32 ref: 000001845C4F5625
VirtualFree.KERNEL32 ref: 000001845C4F56FB
VirtualFree.KERNEL32 ref: 000001845C4F5725
VirtualFree.KERNEL32 ref: 000001845C4F574A
VirtualFree.KERNEL32 ref: 000001845C4F5774
VirtualFree.KERNEL32 ref: 000001845C4F5799

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: c4c301c77432ef5703f60f68f188faa43b288a4f8a8c10df986e60a82f244a90
Instruction ID: 807de75ceb3c72c2e28623555a95dc77b249acc624efcd4a7de5c9c38e7d0a85
Opcode Fuzzy Hash: c4c301c77432ef5703f60f68f188faa43b288a4f8a8c10df986e60a82f244a90
Instruction Fuzzy Hash: 66515A32711F4287EB64DF62E494A9EB3A5FB89B80F45C225DE8A43B14DF38D254C748

Function 000001845C4F4700 Relevance: 10.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F4754
VirtualFree.KERNEL32 ref: 000001845C4F477E
VirtualAlloc.KERNEL32 ref: 000001845C4F4795
VirtualFree.KERNEL32 ref: 000001845C4F486B
VirtualFree.KERNEL32 ref: 000001845C4F4895
VirtualFree.KERNEL32 ref: 000001845C4F48BA
VirtualFree.KERNEL32 ref: 000001845C4F48E4
VirtualFree.KERNEL32 ref: 000001845C4F4909

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 80f34942a8f8c4bc9a5d5aa5a2718efda92b851cc4559cc26846c331e5552837
Instruction ID: a345856d8bdf946714216f5c05df4beef8978860a06d23c120fadd271a3137e3
Opcode Fuzzy Hash: 80f34942a8f8c4bc9a5d5aa5a2718efda92b851cc4559cc26846c331e5552837
Instruction Fuzzy Hash: 7F514B36311F4187EB64DF62E454A9EB3A5FB99B80F45C225CE8A43B14DF38E254C748

Function 000001845C4F4930 Relevance: 10.1, APIs: 8, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F4984

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

VirtualFree.KERNEL32 ref: 000001845C4F49AE
VirtualAlloc.KERNEL32 ref: 000001845C4F49C5
VirtualFree.KERNEL32 ref: 000001845C4F4A90
VirtualFree.KERNEL32 ref: 000001845C4F4ABA
VirtualFree.KERNEL32 ref: 000001845C4F4ADF
VirtualFree.KERNEL32 ref: 000001845C4F4B09
VirtualFree.KERNEL32 ref: 000001845C4F4B2E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: d577543977fa0da55da5beeaf9c154f68529e181afdaea789ff489f112afd6f9
Instruction ID: 198f30afb120615c013f4b2ddeceb5fbcc42efe3d3a757dbe664e20affcfaa7f
Opcode Fuzzy Hash: d577543977fa0da55da5beeaf9c154f68529e181afdaea789ff489f112afd6f9
Instruction Fuzzy Hash: 04516932701F4187EB68CF62E454A9EB3A4FB89B80F45C225DE8A03B14DF38E2508748

Function 000001845C4F4B60 Relevance: 10.1, APIs: 8, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F4BB4

Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D3D
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D50
Part of subcall function 000001845C4E4D20: CloseHandle.KERNEL32 ref: 000001845C4E4D66
Part of subcall function 000001845C4E4D20: DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
Part of subcall function 000001845C4E4D20: VirtualFree.KERNEL32 ref: 000001845C4E4DBA

VirtualFree.KERNEL32 ref: 000001845C4F4BDE
VirtualAlloc.KERNEL32 ref: 000001845C4F4BF5
VirtualFree.KERNEL32 ref: 000001845C4F4CC0
VirtualFree.KERNEL32 ref: 000001845C4F4CEA
VirtualFree.KERNEL32 ref: 000001845C4F4D0F
VirtualFree.KERNEL32 ref: 000001845C4F4D39
VirtualFree.KERNEL32 ref: 000001845C4F4D5E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$CriticalSection$Alloc$CloseEnterHandleRead$Leave$DeleteInitialize
String ID:
API String ID: 948184506-0
Opcode ID: 2bfe56d21f156cdcea5c1fa0c3f246f0bbc4458051a62838ba9f3e51130bed6a
Instruction ID: d6893d842b8d5dbebf201952d41a42409f80e8b7f9aca544400a0b7bbc53e884
Opcode Fuzzy Hash: 2bfe56d21f156cdcea5c1fa0c3f246f0bbc4458051a62838ba9f3e51130bed6a
Instruction Fuzzy Hash: 00515B32311F4187EB64CF62E454A9EB3A4FB99B80F45D225DF8A43B14DF38E2508748

Function 000001845C4E2830 Relevance: 7.6, APIs: 5, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,00001000,000001845C4E228E), ref: 000001845C4E284A
GetModuleHandleW.KERNEL32(?,?,00001000,000001845C4E228E), ref: 000001845C4E285D
GetModuleHandleW.KERNEL32(?,?,00001000,000001845C4E228E), ref: 000001845C4E2888
VirtualProtect.KERNEL32(?,?,00001000,000001845C4E228E), ref: 000001845C4E28BC
VirtualProtect.KERNEL32(?,?,00001000,000001845C4E228E), ref: 000001845C4E28D7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: HandleModule$ProtectVirtual
String ID:
API String ID: 3544755384-0
Opcode ID: f336a93fce01c34d2cdd8dc85c5afcd615c05bd6414b2de0b853565f956b5444
Instruction ID: 7bffd8782f61dc45d7f2c37fbeda79c48e64136402236ab625615e33cd4500db
Opcode Fuzzy Hash: f336a93fce01c34d2cdd8dc85c5afcd615c05bd6414b2de0b853565f956b5444
Instruction Fuzzy Hash: 2521C03261274AC3EB688F54F94479DB3A0F759B89F458226DA4A03754DF3CD690C784

Function 000001845C4EDDD0 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001845C4EDE1C
memset.NTDLL ref: 000001845C4EDE63
FindFirstFileW.KERNEL32 ref: 000001845C4EDE74
free.MSVCRT ref: 000001845C4EDE96

Part of subcall function 000001845C4EDC50: VirtualFree.KERNEL32 ref: 000001845C4EDCEA
Part of subcall function 000001845C4EDC50: VirtualFree.KERNEL32 ref: 000001845C4EDD14
Part of subcall function 000001845C4EDC50: CreateThread.KERNEL32 ref: 000001845C4EDD40
Part of subcall function 000001845C4EDC50: IsBadReadPtr.KERNEL32 ref: 000001845C4EDD64
Part of subcall function 000001845C4EDC50: EnterCriticalSection.KERNEL32 ref: 000001845C4EDD77
Part of subcall function 000001845C4EDC50: VirtualAlloc.KERNEL32 ref: 000001845C4EDD8E
Part of subcall function 000001845C4EDC50: LeaveCriticalSection.KERNEL32 ref: 000001845C4EDDB2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalFreeSection$AllocCreateEnterFileFindFirstLeaveReadThreadfreemallocmemset
String ID:
API String ID: 4255097067-0
Opcode ID: 93b94569c2330fb7e55a1628781f64fdf0fd3d0c7a61c3191a88b0bb3e2625d6
Instruction ID: d569cb462e09c56cbb76818401c7c7dc9f4f1452740e2df1616fdfe809ce6b03
Opcode Fuzzy Hash: 93b94569c2330fb7e55a1628781f64fdf0fd3d0c7a61c3191a88b0bb3e2625d6
Instruction Fuzzy Hash: FF219F36301A8583EB609F22D94879D63A4F799FC4F558232CE9A47748DF3DCA49CB40

Function 0000000180023B98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180023BFC

Strings

gfffffff, xrefs: 0000000180023E99

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: 7c5b9028af6473dd728daef05391e74bafcea77e80a4e195b251d3550d854208
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: 869145767057CC86EF97CB2AE4013EDABA5A758BC4F06C022EA5947395DE3DC60AC701

Function 000001845BF52F98 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF52FFC

Strings

gfffffff, xrefs: 000001845BF53299

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction ID: bbbae7935abc3b7bee493bde96c9e43f93909778a7fcba09dae96741df72da8d
Opcode Fuzzy Hash: 2520fe7bf4aaf198221899a8f6838957eb71f23a71b26e0d8cd2dd751d59c1b4
Instruction Fuzzy Hash: BC912373B057C987EB15CB2EA4103EDBBA5A755B84F05C022CA9A877D5EF39C606CB01

Function 000001845C4E38D0 Relevance: 5.2, APIs: 4, Instructions: 215memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4E3A07
VirtualAlloc.KERNEL32 ref: 000001845C4E3A27
VirtualFree.KERNEL32 ref: 000001845C4E3A63
VirtualFree.KERNEL32 ref: 000001845C4E3B36

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 04065c5e2a1c05127fb750dc6d994f61d80097cc70ac26d1f1ef4872fede59b7
Instruction ID: 832a3f2e7a29a9836b83f5af69bbcdbb0820ccca9b864b8a6bee79e322215e6f
Opcode Fuzzy Hash: 04065c5e2a1c05127fb750dc6d994f61d80097cc70ac26d1f1ef4872fede59b7
Instruction Fuzzy Hash: 13810432710B8183EB15DF36D6446AEA791FBDAB80F01E715DE8A53B41EF38D2868705

Function 000001845C4F7E20 Relevance: 4.5, APIs: 3, Instructions: 36pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32 ref: 000001845C4F7E5B
ConnectNamedPipe.KERNEL32 ref: 000001845C4F7E81
GetLastError.KERNEL32 ref: 000001845C4F7E8B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: NamedPipe$ConnectCreateErrorLast
String ID:
API String ID: 3851520242-0
Opcode ID: 5202d77b4504b343c25026c585eb62c568917b05fbb34b8c84aa117687ab1fdd
Instruction ID: d9c12c89d9cff51a6c4af6bfd7129be2dfa45d5945386ed6c289375d7cf0e034
Opcode Fuzzy Hash: 5202d77b4504b343c25026c585eb62c568917b05fbb34b8c84aa117687ab1fdd
Instruction Fuzzy Hash: 2901D432204A4183D710CF56F90029DF2A4EB98BF4F448322EA69437A4DF78C9548B08

Function 000001845C4E3330 Relevance: 64.1, APIs: 51, Instructions: 358memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34EB
IsBadReadPtr.KERNEL32 ref: 000001845C4E34FD
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3510
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3527
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3556
IsBadReadPtr.KERNEL32 ref: 000001845C4E3568
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E357B
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3592
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35C1
IsBadReadPtr.KERNEL32 ref: 000001845C4E35D3
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35E6
VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35FD
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E362C
IsBadReadPtr.KERNEL32 ref: 000001845C4E363E
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3654
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3678
IsBadReadPtr.KERNEL32 ref: 000001845C4E3691
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36A7
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36CB
IsBadReadPtr.KERNEL32 ref: 000001845C4E36E4
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E36FA
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3726
IsBadReadPtr.KERNEL32 ref: 000001845C4E373F
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3755
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3779
IsBadReadPtr.KERNEL32 ref: 000001845C4E3792
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E37A8
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E37CC
IsBadReadPtr.KERNEL32 ref: 000001845C4E37E5
EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E37FB
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3826
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E384B
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E385D
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E386F
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3881
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3893
LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E38A5

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead$AllocVirtual$Initialize
String ID:
API String ID: 3051317124-0
Opcode ID: 6ebc8dea4b0ea736fefb6cc6a4b904e09ee724be14cbd8c2d79b4aff0744f4dc
Instruction ID: 7fcc51e74507427d558d06e0d646cb2ec922c2a7f3a1789315711da78935eff0
Opcode Fuzzy Hash: 6ebc8dea4b0ea736fefb6cc6a4b904e09ee724be14cbd8c2d79b4aff0744f4dc
Instruction Fuzzy Hash: A7F13C31200B41C7EB5A8F22E9107AD73A4FB59F84F89D626DE4A47794DF38C654C349

Function 000001845C4F0FA0 Relevance: 45.6, APIs: 25, Strings: 1, Instructions: 113filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4F0E40: lstrlenW.KERNEL32 ref: 000001845C4F0E50
Part of subcall function 000001845C4F0E40: WideCharToMultiByte.KERNEL32 ref: 000001845C4F0E7A
Part of subcall function 000001845C4F0E40: VirtualAlloc.KERNEL32 ref: 000001845C4F0E95
Part of subcall function 000001845C4F0E40: lstrlenW.KERNEL32 ref: 000001845C4F0EA6
Part of subcall function 000001845C4F0E40: memset.NTDLL ref: 000001845C4F0ECB
Part of subcall function 000001845C4F0E40: lstrlenA.KERNEL32 ref: 000001845C4F0ED3
Part of subcall function 000001845C4F0E40: VirtualFree.KERNEL32 ref: 000001845C4F0EE9

memset.NTDLL ref: 000001845C4F0FE4
wsprintfW.USER32 ref: 000001845C4F1005
memset.NTDLL ref: 000001845C4F101A
wsprintfW.USER32 ref: 000001845C4F103B
memset.NTDLL ref: 000001845C4F1050
wsprintfW.USER32 ref: 000001845C4F1071
memset.NTDLL ref: 000001845C4F1084
lstrcpyW.KERNEL32 ref: 000001845C4F1091
memset.NTDLL ref: 000001845C4F10A6
lstrcpyW.KERNEL32 ref: 000001845C4F10B7
PathRemoveFileSpecW.SHLWAPI ref: 000001845C4F10C2
memset.NTDLL ref: 000001845C4F10D7
wsprintfW.USER32 ref: 000001845C4F10F6
memset.NTDLL ref: 000001845C4F110B
wsprintfW.USER32 ref: 000001845C4F112A
MoveFileW.KERNEL32 ref: 000001845C4F113E
DeleteFileW.KERNEL32 ref: 000001845C4F114B
SetFileAttributesW.KERNEL32 ref: 000001845C4F115D
MoveFileW.KERNEL32 ref: 000001845C4F117B
DeleteFileW.KERNEL32 ref: 000001845C4F1188
SetFileAttributesW.KERNEL32 ref: 000001845C4F119A
CopyFileW.KERNEL32 ref: 000001845C4F11B1
MoveFileW.KERNEL32 ref: 000001845C4F11C5
DeleteFileW.KERNEL32 ref: 000001845C4F11D2
SetFileAttributesW.KERNEL32 ref: 000001845C4F11E4

Strings

%s\%s, xrefs: 000001845C4F0FF7, 000001845C4F102D, 000001845C4F1063, 000001845C4F10E8, 000001845C4F111C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: File$memset$wsprintf$AttributesDeleteMovelstrlen$Virtuallstrcpy$AllocByteCharCopyFreeMultiPathRemoveSpecWide
String ID: %s\%s
API String ID: 467509054-4073750446
Opcode ID: 5c9f1cf80f21698ae4ba0fa0fdced245dadeac4cbc76957ae87b01c586a556f9
Instruction ID: 0557462e2511f5fdd9916bff3470d00ad16a0ddd7caf4ebb016a5b5eb61b28a1
Opcode Fuzzy Hash: 5c9f1cf80f21698ae4ba0fa0fdced245dadeac4cbc76957ae87b01c586a556f9
Instruction Fuzzy Hash: B4512A32210AABA7EB24DFA4DC547DD6361F7A5B48FC19213D50D8B969EE38C309C780

Function 000001845C4E7BF0 Relevance: 37.7, APIs: 25, Instructions: 177sleepsynchronizationpipeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 000001845C4E7C12
IsBadReadPtr.KERNEL32 ref: 000001845C4E7C27
EnterCriticalSection.KERNEL32 ref: 000001845C4E7C3F
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7C62
IsBadReadPtr.KERNEL32 ref: 000001845C4E7C80
EnterCriticalSection.KERNEL32 ref: 000001845C4E7C93
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7CC0
VirtualFree.KERNEL32 ref: 000001845C4E7CE5
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7CEF
IsBadReadPtr.KERNEL32 ref: 000001845C4E7D0E
EnterCriticalSection.KERNEL32 ref: 000001845C4E7D24
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7D45
IsBadReadPtr.KERNEL32 ref: 000001845C4E7D5A
EnterCriticalSection.KERNEL32 ref: 000001845C4E7D75
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7DA9
DisconnectNamedPipe.KERNEL32 ref: 000001845C4E7DC1
CloseHandle.KERNEL32 ref: 000001845C4E7DD0
DeleteCriticalSection.KERNEL32 ref: 000001845C4E7DDE
VirtualFree.KERNEL32 ref: 000001845C4E7DEF
VirtualFree.KERNEL32 ref: 000001845C4E7E14
LeaveCriticalSection.KERNEL32 ref: 000001845C4E7E1E
CloseHandle.KERNEL32 ref: 000001845C4E7E3B
SetEvent.KERNEL32 ref: 000001845C4E7E56
Sleep.KERNEL32 ref: 000001845C4E7E61
ResetEvent.KERNEL32 ref: 000001845C4E7E72

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead$FreeVirtual$CloseEventHandle$DeleteDisconnectNamedObjectPipeResetSingleSleepWait
String ID:
API String ID: 2612321180-0
Opcode ID: b7046ff1c3375c6ec0fd28ec1e10e6abf8100b599efa27a31810fd02cf3c44bb
Instruction ID: f761906ddb1ac6851d552c32c3823211b47dd4ff946f0acfe5dba6f29782422b
Opcode Fuzzy Hash: b7046ff1c3375c6ec0fd28ec1e10e6abf8100b599efa27a31810fd02cf3c44bb
Instruction Fuzzy Hash: C4818E31301A16C3EB598F61E9507AE63B4FB66F94F89C622CE0A47754DF38CA46C349

Function 000001845C4E4D20 Relevance: 31.7, APIs: 21, Instructions: 168COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000001845C4E4D3D
CloseHandle.KERNEL32 ref: 000001845C4E4D50
CloseHandle.KERNEL32 ref: 000001845C4E4D66
DeleteCriticalSection.KERNEL32 ref: 000001845C4E4D8D
VirtualFree.KERNEL32 ref: 000001845C4E4DBA
SetEvent.KERNEL32 ref: 000001845C4E4DED
CloseHandle.KERNEL32 ref: 000001845C4E4DFC
DeleteCriticalSection.KERNEL32 ref: 000001845C4E4E21
VirtualFree.KERNEL32 ref: 000001845C4E4E32
CloseHandle.KERNEL32 ref: 000001845C4E4E61
CloseHandle.KERNEL32 ref: 000001845C4E4E74
DeleteCriticalSection.KERNEL32 ref: 000001845C4E4E87
VirtualFree.KERNEL32 ref: 000001845C4E4E98
SetEvent.KERNEL32 ref: 000001845C4E4EE3
CloseHandle.KERNEL32 ref: 000001845C4E4EF2
CloseHandle.KERNEL32 ref: 000001845C4E4F05
CloseHandle.KERNEL32 ref: 000001845C4E4F18
VirtualFree.KERNEL32 ref: 000001845C4E4F45
VirtualFree.KERNEL32 ref: 000001845C4E4F6F
DeleteCriticalSection.KERNEL32 ref: 000001845C4E4F80
VirtualFree.KERNEL32 ref: 000001845C4E4F91

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$FreeVirtual$CriticalDeleteSection$Event
String ID:
API String ID: 10935847-0
Opcode ID: 27ff84aaf12ebd0a39dbd24038505bf2bb04301d1514b24ab1ddd3ff12eebcae
Instruction ID: 878d955f54ccf8eb58f1fe1b9ac43e9657c8cbf8da68984dc8bc3e2cc9aeeafa
Opcode Fuzzy Hash: 27ff84aaf12ebd0a39dbd24038505bf2bb04301d1514b24ab1ddd3ff12eebcae
Instruction Fuzzy Hash: 3A817C35302A12C7EB68CFA2E550BADB3A0FB95F44F49D615CB4A43A54CF38D650C399

Function 000001845C502DE0 Relevance: 30.1, APIs: 20, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502DF7
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502E26
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502E38
CreateEventW.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502E5C
IsBadReadPtr.KERNEL32 ref: 000001845C502E72
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502E85
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502E9C
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502ECB
IsBadReadPtr.KERNEL32 ref: 000001845C502EDD
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502EF0
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502F07
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502F36
IsBadReadPtr.KERNEL32 ref: 000001845C502F48
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502F5B
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502F72
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502FA1
IsBadReadPtr.KERNEL32 ref: 000001845C502FB3
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502FC6
VirtualAlloc.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C502FDD
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C4E48F0), ref: 000001845C50300C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocVirtual$EnterLeaveRead$CreateEventInitialize
String ID:
API String ID: 3948381741-0
Opcode ID: 0c97ca10ba80cdc1344fd5c304f31d40c1b2c9626c21ca69a6339e3747ea0fdc
Instruction ID: e710c07821e30283075fa70c01753ab7e82c8e3fa00fb2e101763f28d25c6838
Opcode Fuzzy Hash: 0c97ca10ba80cdc1344fd5c304f31d40c1b2c9626c21ca69a6339e3747ea0fdc
Instruction Fuzzy Hash: 5B615A31311F5583EB498F61E9103ADB3A4F768F80F84C626DA5A93B94DF38DA65C348

Function 000001845C50D3D0 Relevance: 27.5, APIs: 1, Strings: 17, Instructions: 460COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C51A990: WSAStartup.WS2_32 ref: 000001845C51A9A1

memset.NTDLL ref: 000001845C50D7E4

Strings

lws_free, xrefs: 000001845C50DC0D
context, xrefs: 000001845C50D46F
wsi, xrefs: 000001845C50D55A
system, xrefs: 000001845C50D9E4
Failed to create default vhost, xrefs: 000001845C50DA5F
wsicli, xrefs: 000001845C50D592
prot_init, xrefs: 000001845C50DA00
NSC, xrefs: 000001845C50DAC1
unknown, xrefs: 000001845C50D9D2
fds table, xrefs: 000001845C50D863
info->ka_interval can't be 0 if ka_time used, xrefs: 000001845C50D831
wsisrv, xrefs: 000001845C50D576
OOM allocating %d fds, xrefs: 000001845C50DBDD
Failed to init cookiejar, xrefs: 000001845C50DB69
lws_create_context, xrefs: 000001845C50D844, 000001845C50DA7C, 000001845C50DBE9
mux, xrefs: 000001845C50D584
OOM, xrefs: 000001845C50DC20

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Startupmemset
String ID: Failed to create default vhost$Failed to init cookiejar$NSC$OOM$OOM allocating %d fds$context$fds table$info->ka_interval can't be 0 if ka_time used$lws_create_context$lws_free$mux$prot_init$system$unknown$wsi$wsicli$wsisrv
API String ID: 1873301828-3289243303
Opcode ID: 16ff8c9513e61e8d05d3a42471cc09235c13313f4bf578ebfff565fe686a6f90
Instruction ID: 3f79a68e88060897263dd54d553de9dc202d2e5a0ee8d8bcdd5beb3f16316af1
Opcode Fuzzy Hash: 16ff8c9513e61e8d05d3a42471cc09235c13313f4bf578ebfff565fe686a6f90
Instruction Fuzzy Hash: C0325D36201B9A87EB548F65E4403DEB3A4F754B88F448236DE9D9B394EF38D250C758

Function 000001845C4FD5A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 124memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000001845C4FD62F
CoCreateInstance.OLE32 ref: 000001845C4FD654
CoCreateInstance.OLE32 ref: 000001845C4FD68A
CoUninitialize.OLE32 ref: 000001845C4FD6A8
SysAllocString.OLEAUT32 ref: 000001845C4FD6D0
SysAllocString.OLEAUT32 ref: 000001845C4FD6E0
SysAllocString.OLEAUT32 ref: 000001845C4FD6F0
SysFreeString.OLEAUT32 ref: 000001845C4FD76A
SysFreeString.OLEAUT32 ref: 000001845C4FD773
SysFreeString.OLEAUT32 ref: 000001845C4FD77C
CoUninitialize.OLE32 ref: 000001845C4FD7A0

Strings

i33L, xrefs: 000001845C4FD5B7
Block All Outbound, xrefs: 000001845C4FD6BF
Block all outbound traffic, xrefs: 000001845C4FD6D6
BlockAllGroup, xrefs: 000001845C4FD6E6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: String$AllocFree$CreateInstanceUninitialize$Initialize
String ID: Block All Outbound$Block all outbound traffic$BlockAllGroup$i33L
API String ID: 2562062002-1644180588
Opcode ID: 8deb0ea224b165b1f84c5336fa06fe8aa485b50349956e7146a47af700a7992b
Instruction ID: 67b64ffcbd2fd57c0f05b0eb1cf820b9490b20c5a33cf506ac8011a674157a0f
Opcode Fuzzy Hash: 8deb0ea224b165b1f84c5336fa06fe8aa485b50349956e7146a47af700a7992b
Instruction Fuzzy Hash: F251DF76700B558BEB00DF66E88429C77B0F798F88F508626DA5A47B28DF38C619CB45

Function 000001845C4F36D0 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4F36F4
ProcessIdToSessionId.KERNEL32 ref: 000001845C4F3704
memset.NTDLL ref: 000001845C4F3717
wsprintfW.USER32 ref: 000001845C4F3734
GetCurrentProcess.KERNEL32 ref: 000001845C4F3748
TerminateProcess.KERNEL32 ref: 000001845C4F3753
memset.NTDLL ref: 000001845C4F3769
wsprintfW.USER32 ref: 000001845C4F3789
GetCurrentProcess.KERNEL32 ref: 000001845C4F37A8
TerminateProcess.KERNEL32 ref: 000001845C4F37B3
WaitForSingleObject.KERNEL32 ref: 000001845C4F37CA
GetCurrentProcess.KERNEL32 ref: 000001845C4F37D4
TerminateProcess.KERNEL32 ref: 000001845C4F37DF

Strings

\\.\Pipe\%d_Local_%d, xrefs: 000001845C4F3776
\\.\Pipe\%d_pipe%d, xrefs: 000001845C4F3724

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$Current$Terminate$memsetwsprintf$ObjectSessionSingleWait
String ID: \\.\Pipe\%d_Local_%d$\\.\Pipe\%d_pipe%d
API String ID: 1631145905-82101934
Opcode ID: ab10d55d452ab6b41233c7c6c5d6ad339ec73cd5f29839cb69e3900e23e60465
Instruction ID: 855e2c70c8fcbaaf044d8c01572b3bbabff9e8fd249cbb87d63b95a198d7cec9
Opcode Fuzzy Hash: ab10d55d452ab6b41233c7c6c5d6ad339ec73cd5f29839cb69e3900e23e60465
Instruction Fuzzy Hash: 4131D372300A9683EB249F62EC447DEA3A1F7A5F88F44C221C94A43769DF3CC649CB54

Function 000001845C4F1760 Relevance: 25.7, APIs: 17, Instructions: 151networkmemorysleepCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 000001845C4F1780
setsockopt.WS2_32 ref: 000001845C4F17DC
setsockopt.WS2_32 ref: 000001845C4F1800
setsockopt.WS2_32 ref: 000001845C4F182B
WSAIoctl.WS2_32 ref: 000001845C4F1881
setsockopt.WS2_32 ref: 000001845C4F18B0

Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E442D
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E445F
Part of subcall function 000001845C4E4410: InitializeCriticalSection.KERNEL32 ref: 000001845C4E4474
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E4490
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E44A3
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E44BA
Part of subcall function 000001845C4E4410: LeaveCriticalSection.KERNEL32 ref: 000001845C4E44E9
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E44FE
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E4511
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E4528
Part of subcall function 000001845C4E4410: LeaveCriticalSection.KERNEL32 ref: 000001845C4E4557
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E456C
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E457F
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E4596

VirtualAlloc.KERNEL32 ref: 000001845C4F18D5
CreateThread.KERNEL32 ref: 000001845C4F1927
IsBadReadPtr.KERNEL32 ref: 000001845C4F193F
EnterCriticalSection.KERNEL32 ref: 000001845C4F1952
VirtualAlloc.KERNEL32 ref: 000001845C4F1968
LeaveCriticalSection.KERNEL32 ref: 000001845C4F198C
CancelIo.KERNEL32 ref: 000001845C4F199F
closesocket.WS2_32 ref: 000001845C4F19A8
VirtualFree.KERNEL32 ref: 000001845C4F19B9
Sleep.KERNEL32 ref: 000001845C4F19C2
accept.WS2_32 ref: 000001845C4F19D1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterReadsetsockopt$Leave$accept$CancelCreateFreeInitializeIoctlSleepThreadclosesocket
String ID:
API String ID: 241427152-0
Opcode ID: 8054d77f63a71bffb60c6de152fa376652fa5a9bac917f7a9e8e23a3707f0d6a
Instruction ID: 6cd1a3acc32c5b153c1e9818a603772dd601a56ec0a2500606ee99b1b1986fee
Opcode Fuzzy Hash: 8054d77f63a71bffb60c6de152fa376652fa5a9bac917f7a9e8e23a3707f0d6a
Instruction Fuzzy Hash: 49619072204B9287E7248F51E404B9EB7B4F789B84F448225DF8A07B54CF3DD659CB48

Function 000001845C504DA0 Relevance: 25.6, APIs: 17, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504DB7
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504DEF
CreateEventW.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504E01
VirtualAlloc.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504E1C
InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504E2E
IsBadReadPtr.KERNEL32 ref: 000001845C504E49
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504E5C
VirtualAlloc.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504E73
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504EA2
IsBadReadPtr.KERNEL32 ref: 000001845C504EB4
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504EC7
VirtualAlloc.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504EDE
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504F0D
IsBadReadPtr.KERNEL32 ref: 000001845C504F1F
EnterCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504F32
VirtualAlloc.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504F49
LeaveCriticalSection.KERNEL32(?,?,00000000,000001845C505130,?,?,00000000,000001845C4E4AAC), ref: 000001845C504F78

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocVirtual$EnterLeaveRead$Initialize$CreateEvent
String ID:
API String ID: 3934889794-0
Opcode ID: d745ae7875c7a808b0e5a312b163fd60a6495f42bc51f35149f49f448c640802
Instruction ID: 6696c874fd5983120837ab6dd2d448884f2ea31bdb7d655246a8b214461c05c5
Opcode Fuzzy Hash: d745ae7875c7a808b0e5a312b163fd60a6495f42bc51f35149f49f448c640802
Instruction Fuzzy Hash: E3516332310F5583EB498F61E9003ADB3A4F768F84F84C626DA5983B94DF38D664C344

Function 000001845C500F20 Relevance: 25.6, APIs: 17, Instructions: 104pipethreadCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500F36
TerminateThread.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500F47
TerminateProcess.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500F53
TerminateThread.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500F5F
VirtualFree.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500F80
VirtualFree.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FAA
DisconnectNamedPipe.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FBC
DisconnectNamedPipe.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FCB
DisconnectNamedPipe.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FDA
DisconnectNamedPipe.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FE9
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C500FF7
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C501009
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C50101C
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C50102F
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C501042
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C501055
CloseHandle.KERNEL32(?,?,?,000001845C4F4485), ref: 000001845C501068

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipe$Terminate$FreeThreadVirtual$CriticalDeleteProcessSection
String ID:
API String ID: 2021643575-0
Opcode ID: e1219eb5096a696673c920ee8a3caf4302f5afb9c9ade7e8d0e7ee9dfdca1525
Instruction ID: 7e1a62af1d704765280f64b6cb085d0335ad0aaffd0a6fc60902fa5da5ef2e7a
Opcode Fuzzy Hash: e1219eb5096a696673c920ee8a3caf4302f5afb9c9ade7e8d0e7ee9dfdca1525
Instruction Fuzzy Hash: 8F412B35202A6683FF58CFA2D56036DA364FFA4F88F08C616DE4A42A54CF38C551D399

Function 000001845C512B20 Relevance: 24.3, APIs: 2, Strings: 14, Instructions: 347COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 000001845C512BD7
memcpy.NTDLL ref: 000001845C512F44

Strings

lws_free, xrefs: 000001845C512EAA
same vh list, xrefs: 000001845C512F4F
lws_create_vhost, xrefs: 000001845C512B79
|%u, xrefs: 000001845C512C6D
ener), xrefs: 000001845C512FDD
port %u, xrefs: 000001845C512FA0
|%s, xrefs: 000001845C512C3B
default, xrefs: 000001845C512B46
lws_protocol_init failed, xrefs: 000001845C5130D8
init server failed, xrefs: 000001845C513094
http_proxy, xrefs: 000001845C513030
OOM, xrefs: 000001845C512E88
%s|%s|%d, xrefs: 000001845C512CB3
vh plugin table, xrefs: 000001845C512E48

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memcpy
String ID: %s|%s|%d$OOM$default$ener)$http_proxy$init server failed$lws_create_vhost$lws_free$lws_protocol_init failed$port %u$same vh list$vh plugin table$|%s$|%u
API String ID: 3510742995-1324429581
Opcode ID: 379c9d18fd57c2ae79b8b94559fee726fe2e35d7262676346e3f36fa73a1b13f
Instruction ID: 5e00151059da1ab7c5e5c270476b7771a355b4ad3b78c73f18ed2614c4a0ab7d
Opcode Fuzzy Hash: 379c9d18fd57c2ae79b8b94559fee726fe2e35d7262676346e3f36fa73a1b13f
Instruction Fuzzy Hash: 05025932201B9A97EB54CF65D8843EDB3A0F768B88F948226DE8D47795EF38D651C304

Function 000001845C4FF3F0 Relevance: 24.1, APIs: 16, Instructions: 95keyboardsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF40B
WaitForSingleObject.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF421
CloseHandle.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF430
VirtualFree.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF463
VirtualFree.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF48D
BlockInput.USER32(?,?,?,000001845C4F4297), ref: 000001845C4FF49C
CloseHandle.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF4AB
ReleaseDC.USER32 ref: 000001845C4FF4C0
SelectObject.GDI32 ref: 000001845C4FF4D1
SelectObject.GDI32 ref: 000001845C4FF4EC
DeleteObject.GDI32 ref: 000001845C4FF4FD
DeleteObject.GDI32 ref: 000001845C4FF50A
DeleteDC.GDI32 ref: 000001845C4FF514
DeleteDC.GDI32 ref: 000001845C4FF521
VirtualFree.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF538
VirtualFree.KERNEL32(?,?,?,000001845C4F4297), ref: 000001845C4FF556

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Object$DeleteFreeVirtual$CloseHandleSelect$BlockEventInputReleaseSingleWait
String ID:
API String ID: 3967251967-0
Opcode ID: 3a07132e1f9d7ba23aabf59264424579120ae970d8e9deebab850e7ccb55037e
Instruction ID: bee56aa08563063c21f669bd23eb384e6bdae049206e8000b5a48ef468f450fe
Opcode Fuzzy Hash: 3a07132e1f9d7ba23aabf59264424579120ae970d8e9deebab850e7ccb55037e
Instruction Fuzzy Hash: 0141063A301F6583FB48CFA2E8547AD63A5FB95F84F448226CE8A43B58CF38C5558359

Function 000001845C4E7240 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 96synchronizationpipeCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C4E725A

Part of subcall function 000001845C4F8120: VirtualAlloc.KERNEL32(?,?,00000000,000001845C4F6D58), ref: 000001845C4F8137
Part of subcall function 000001845C4F8120: InitializeCriticalSection.KERNEL32(?,?,00000000,000001845C4F6D58), ref: 000001845C4F8165

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

memset.NTDLL ref: 000001845C4E7295
GetCurrentProcessId.KERNEL32 ref: 000001845C4E729A
wsprintfW.USER32 ref: 000001845C4E72B6
WaitForSingleObject.KERNEL32 ref: 000001845C4E72D3
WaitForSingleObject.KERNEL32 ref: 000001845C4E731B
VirtualFree.KERNEL32 ref: 000001845C4E733A
VirtualFree.KERNEL32 ref: 000001845C4E7364
DisconnectNamedPipe.KERNEL32 ref: 000001845C4E737B
CloseHandle.KERNEL32 ref: 000001845C4E738A
DeleteCriticalSection.KERNEL32 ref: 000001845C4E7398
VirtualFree.KERNEL32 ref: 000001845C4E73A9

Strings

\\.\Pipe\%d_Local_%d, xrefs: 000001845C4E72A7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Read$EnterFree$InitializeLeaveObjectSingleWait$CloseCurrentDeleteDisconnectHandleNamedPipeProcessmemsetwsprintf
String ID: \\.\Pipe\%d_Local_%d
API String ID: 2297721380-251893267
Opcode ID: 36990aca3978a3dea961cae16a781325bd347a7ac9c8a3c5f6a009e8abbcbd45
Instruction ID: c5ac6a36f550d9636fa504cc26cb0c70735a4b6d3f0ac769dc8172948c9a9ddd
Opcode Fuzzy Hash: 36990aca3978a3dea961cae16a781325bd347a7ac9c8a3c5f6a009e8abbcbd45
Instruction Fuzzy Hash: A9417F31300A52C3EBA89F62E5547AEA3A1FB95F94F44C221CE4A47A94DF3CC685C349

Function 000001845C510950 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 000001845C510992
WSAGetLastError.WS2_32 ref: 000001845C51099C
WSAIoctl.WS2_32 ref: 000001845C510A1D
WSAGetLastError.WS2_32 ref: 000001845C510A27
getprotobyname.WS2_32 ref: 000001845C510A75
setsockopt.WS2_32 ref: 000001845C510AA2
ioctlsocket.WS2_32 ref: 000001845C510AC3
WSAGetLastError.WS2_32 ref: 000001845C510AD2

Strings

WSAIoctl SIO_KEEPALIVE_VALS 1 %lu %lu failed with error %d, xrefs: 000001845C510A32
setsockopt SO_KEEPALIVE 1 failed with error %d, xrefs: 000001845C5109A5
TCP, xrefs: 000001845C510A63
ioctlsocket FIONBIO 1 failed with error %d, xrefs: 000001845C510AD8

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$setsockopt$Ioctlgetprotobynameioctlsocket
String ID: TCP$WSAIoctl SIO_KEEPALIVE_VALS 1 %lu %lu failed with error %d$ioctlsocket FIONBIO 1 failed with error %d$setsockopt SO_KEEPALIVE 1 failed with error %d
API String ID: 689193069-3784515845
Opcode ID: 8a574de51de2f7b9e0da6b50ddb537149f76536c045387673f248ec90f46c37e
Instruction ID: 6d809c91e39f023ebf6ce9a52cce65c7296deccf03c5775e8562dc9700bc4213
Opcode Fuzzy Hash: 8a574de51de2f7b9e0da6b50ddb537149f76536c045387673f248ec90f46c37e
Instruction Fuzzy Hash: AA41A33260479A87E710CFA1E4447CDB7A4F398B94F948226DE8843754DF7DDA49CB84

Function 000001845C4F0E40 Relevance: 21.1, APIs: 14, Instructions: 87stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 000001845C4F0E50
WideCharToMultiByte.KERNEL32 ref: 000001845C4F0E7A
VirtualAlloc.KERNEL32 ref: 000001845C4F0E95
lstrlenW.KERNEL32 ref: 000001845C4F0EA6

Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC907
Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC92F

memset.NTDLL ref: 000001845C4F0ECB
lstrlenA.KERNEL32 ref: 000001845C4F0ED3
VirtualFree.KERNEL32 ref: 000001845C4F0EE9
lstrlenA.KERNEL32 ref: 000001845C4F0F0A
memset.NTDLL ref: 000001845C4F0F32
memcpy.NTDLL ref: 000001845C4F0F42
CreateDirectoryA.KERNEL32 ref: 000001845C4F0F4E
lstrlenA.KERNEL32 ref: 000001845C4F0F5C
CreateDirectoryA.KERNEL32 ref: 000001845C4F0F73
VirtualFree.KERNEL32 ref: 000001845C4F0F84

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiVirtualWide$CreateDirectoryFreememset$Allocmemcpy
String ID:
API String ID: 2091574596-0
Opcode ID: 1b4b82f0b7e4c8ea5fbd9bd08a66728b17502ecdaec804405791d5810d399e2d
Instruction ID: ff2a2f3fec7bd8073ca490bb3b5af2cc68b85054965affe223272a6ee54c39d8
Opcode Fuzzy Hash: 1b4b82f0b7e4c8ea5fbd9bd08a66728b17502ecdaec804405791d5810d399e2d
Instruction Fuzzy Hash: DB31F231304A9143E764CF66F9403EDA3A1EB9AFC5F448225DB4A83B95DF3CD6458708

Function 000001845C4E5070 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 46COMMON

Download Yara Rule

APIs

_time64.MSVCRT ref: 000001845C4E50E0
srand.MSVCRT ref: 000001845C4E50E9
rand.MSVCRT ref: 000001845C4E5100

Strings

()*+, xrefs: 000001845C4E50B6
$%&', xrefs: 000001845C4E50AF
!"#, xrefs: 000001845C4E50A8
4567, xrefs: 000001845C4E50CB
,-./, xrefs: 000001845C4E50BD
0123, xrefs: 000001845C4E50C4
<=>?, xrefs: 000001845C4E50D9
89:;, xrefs: 000001845C4E50D2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: _time64randsrand
String ID: !"#$$%&'$()*+$,-./$0123$4567$89:;$<=>?
API String ID: 1363323005-2655883160
Opcode ID: 495eb2bc3968464ad3b4467f9e3bb0dc08ae24cb2b23406463a58bd7f9b74657
Instruction ID: e7bb334ec8f8dd59bd997d665c30ff9287afab48d4810f77c595541bf5deefc9
Opcode Fuzzy Hash: 495eb2bc3968464ad3b4467f9e3bb0dc08ae24cb2b23406463a58bd7f9b74657
Instruction Fuzzy Hash: 29114FB6B117A48FEB04CFA1A88409D7BB0F349B88B945629DA5A67B08CB34D241CF55

Function 000001845C502930 Relevance: 18.1, APIs: 12, Instructions: 114networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 000001845C50298C
GetLastError.KERNEL32 ref: 000001845C50299B
getaddrinfo.WS2_32 ref: 000001845C5029CA
WSAGetLastError.WS2_32 ref: 000001845C5029D0
WSAGetLastError.WS2_32 ref: 000001845C5029DA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$Socketgetaddrinfo
String ID:
API String ID: 1420131935-0
Opcode ID: 588b49dada4d53f0dea3a9a8b5e910038bbe1c700624a725d7562d88239a8e1e
Instruction ID: 34a5965bd840560312aa75ad6a39f3d29034b6f120860fd1fbf506b28fe4d1c5
Opcode Fuzzy Hash: 588b49dada4d53f0dea3a9a8b5e910038bbe1c700624a725d7562d88239a8e1e
Instruction Fuzzy Hash: 1851AA72610B958BE720CFA1E4047DD77B4F758B98F408226EE4963B98CF39C659CB48

Function 000001845C503BB0 Relevance: 18.1, APIs: 12, Instructions: 108networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001845C503BF3
GetLastError.KERNEL32 ref: 000001845C503C02
getaddrinfo.WS2_32 ref: 000001845C503C31
WSAGetLastError.WS2_32 ref: 000001845C503C37
WSAGetLastError.WS2_32 ref: 000001845C503C41

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$getaddrinfosocket
String ID:
API String ID: 2350576183-0
Opcode ID: 183dd14ccb18c69825c5ef14be7dfcbe68b6ff15fd6c6c6db8b03a0aaa48b992
Instruction ID: f259361e2cbbdb2bf38f36df0632e4b11c684a811899461e3628724b526ef453
Opcode Fuzzy Hash: 183dd14ccb18c69825c5ef14be7dfcbe68b6ff15fd6c6c6db8b03a0aaa48b992
Instruction Fuzzy Hash: 60515873610A959BE720CFA0E4043DD77B1F758B58F008226EF5963A98CF38C658CB49

Function 000001845C4E4220 Relevance: 18.1, APIs: 12, Instructions: 93sleepsynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 000001845C4E4237
Sleep.KERNEL32 ref: 000001845C4E424C
IsBadReadPtr.KERNEL32 ref: 000001845C4E426B
EnterCriticalSection.KERNEL32 ref: 000001845C4E4281
LeaveCriticalSection.KERNEL32 ref: 000001845C4E42A2
LeaveCriticalSection.KERNEL32 ref: 000001845C4E42AF
SetEvent.KERNEL32 ref: 000001845C4E431E
WaitForSingleObject.KERNEL32 ref: 000001845C4E433F
CloseHandle.KERNEL32 ref: 000001845C4E4351

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$EventLeave$CloseEnterHandleObjectReadSingleSleepWait
String ID:
API String ID: 1497552152-0
Opcode ID: 3e701f299464fa1840a3c59915c173aa47d40fd4326d99a42f10eb8f84c94787
Instruction ID: 30d4f9ba48e0e04d64343985af919b576cc3f06bed5ca7a08c9fea9a20231a29
Opcode Fuzzy Hash: 3e701f299464fa1840a3c59915c173aa47d40fd4326d99a42f10eb8f84c94787
Instruction Fuzzy Hash: 40415D31300A52C7EB588FA1E9407EC73A0FB9AF88F499621DF5A47755CF38C6558349

Function 000001845C4FEB30 Relevance: 18.1, APIs: 12, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000001845C4FEB56
GetDC.USER32 ref: 000001845C4FEB66
GetSystemMetrics.USER32 ref: 000001845C4FEB7E
GetSystemMetrics.USER32 ref: 000001845C4FEB8A
CreateCompatibleDC.GDI32 ref: 000001845C4FEB97
CreateCompatibleDC.GDI32 ref: 000001845C4FEBA5
CreateDIBSection.GDI32 ref: 000001845C4FEBE0
CreateDIBSection.GDI32 ref: 000001845C4FEC02
SelectObject.GDI32 ref: 000001845C4FEC17
SelectObject.GDI32 ref: 000001845C4FEC32
CreateEventW.KERNEL32 ref: 000001845C4FEC56
VirtualAlloc.KERNEL32 ref: 000001845C4FEC76

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Create$CompatibleMetricsObjectSectionSelectSystem$AllocDesktopEventVirtualWindow
String ID:
API String ID: 623393097-0
Opcode ID: d4d23b9cfb9482bdb896885728d8e23ede41b5937629a3350251762cf16a0030
Instruction ID: 9ec0aa94372e5666acb642bdd4242b29b18dae0fb38c2b26442917d1c64ca7da
Opcode Fuzzy Hash: d4d23b9cfb9482bdb896885728d8e23ede41b5937629a3350251762cf16a0030
Instruction Fuzzy Hash: 3F411336200B65E7D718CF65E64868EB3B0F349B80F40861ADB8943B10DF38E176CB84

Function 000001845C4FB990 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4FB9B9
memcpy.NTDLL ref: 000001845C4FB9DD
VirtualAlloc.KERNEL32 ref: 000001845C4FBA08
memcpy.NTDLL ref: 000001845C4FBA3D
memcpy.NTDLL ref: 000001845C4FBA73
memset.NTDLL ref: 000001845C4FBB0C
ExpandEnvironmentStringsW.KERNEL32 ref: 000001845C4FBB23
memset.NTDLL ref: 000001845C4FBB38

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4FBB1C, 000001845C4FBB2B
18.139.89.40, xrefs: 000001845C4FBA48

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memcpy$AllocVirtualmemset$EnvironmentExpandStrings
String ID: 18.139.89.40$C:\Program Files\Windows Mail
API String ID: 791498746-2261422552
Opcode ID: 2b26ddc07f84ee4290e8d8fcb28feba32ce194d0abf94b4343b1801c1ea13578
Instruction ID: 74fc471dae3d6dc65b53cfe62ee9ae27f82a002a617cbe515a34c5a375ad073d
Opcode Fuzzy Hash: 2b26ddc07f84ee4290e8d8fcb28feba32ce194d0abf94b4343b1801c1ea13578
Instruction Fuzzy Hash: 6871A572A15B8683E711CB28D5417ED7B60F7AAB88F14D315CE4953722FF28A285C704

Function 000001845C4F5F60 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F5FAF
VirtualFree.KERNEL32 ref: 000001845C4F5FD9
VirtualFree.KERNEL32 ref: 000001845C4F6036
VirtualFree.KERNEL32 ref: 000001845C4F6060
VirtualFree.KERNEL32 ref: 000001845C4F60A2
CreateFileW.KERNEL32 ref: 000001845C4F60CE
DeviceIoControl.KERNEL32 ref: 000001845C4F6115
CloseHandle.KERNEL32 ref: 000001845C4F6123

Strings

D", xrefs: 000001845C4F6101
\\.\TrueSight, xrefs: 000001845C4F60B8

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$AllocFree$EnterRead$Leave$CloseControlCreateDeviceFileHandleInitialize
String ID: D"$\\.\TrueSight
API String ID: 655973622-2684836731
Opcode ID: 27a08fb4fa4a8848856c421baff81ff9c7be46c9889b924c32ca9501aac5b7be
Instruction ID: db24b36c7235ecd245bc8b8b5bd7a0bf9b011b9328e1d36dfd6faa44b60d45db
Opcode Fuzzy Hash: 27a08fb4fa4a8848856c421baff81ff9c7be46c9889b924c32ca9501aac5b7be
Instruction Fuzzy Hash: C1517F32714B9187EB64DF62E55479EB3A1FB99B80F44C215DB8A03B94DF38D2548B04

Function 000001845C4F3920 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78stringthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4F3941
ProcessIdToSessionId.KERNEL32 ref: 000001845C4F3951
memset.NTDLL ref: 000001845C4F39A9
lstrcmpiW.KERNEL32 ref: 000001845C4F39CE
lstrcmpiW.KERNEL32 ref: 000001845C4F39F3
CreateThread.KERNEL32 ref: 000001845C4F3A61

Strings

TCP, xrefs: 000001845C4F39BF
UDP, xrefs: 000001845C4F39E4
HTTP, xrefs: 000001845C4F3A05

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Processlstrcmpi$CreateCurrentSessionThreadmemset
String ID: HTTP$TCP$UDP
API String ID: 1333632082-3864057669
Opcode ID: 79ca34c42b3aab9032cd5f6da8ec8d408d609f69abcf2edea33bd93b63b32bf1
Instruction ID: 50a599c4fc0382cdef9a70babf022e4a1813171d334cbf6fefcfa4f29feb3cfa
Opcode Fuzzy Hash: 79ca34c42b3aab9032cd5f6da8ec8d408d609f69abcf2edea33bd93b63b32bf1
Instruction Fuzzy Hash: 4231C472614B9693E724CF61E8507DEB3B1F798B44F80D226D94A83654EF3CC685C744

Function 000001845C4F3ED0 Relevance: 16.6, APIs: 11, Instructions: 118synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F3F23
VirtualFree.KERNEL32 ref: 000001845C4F3F4D
SetEvent.KERNEL32 ref: 000001845C4F3F7D
WaitForSingleObject.KERNEL32 ref: 000001845C4F3F8F
TerminateThread.KERNEL32 ref: 000001845C4F3F9A
CloseHandle.KERNEL32 ref: 000001845C4F3FA8
VirtualFree.KERNEL32 ref: 000001845C4F3FE0
WaitForSingleObject.KERNEL32 ref: 000001845C4F4011
TerminateThread.KERNEL32 ref: 000001845C4F401C
CloseHandle.KERNEL32 ref: 000001845C4F402A
VirtualFree.KERNEL32 ref: 000001845C4F4057

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$CloseHandleLeaveObjectSingleTerminateThreadWait$EventInitialize
String ID:
API String ID: 3987515053-0
Opcode ID: 28e91978891c492b1cbaac380f24f71bf40da3fb043633dbee495f36113eb4af
Instruction ID: ca93fae89915665d842f889c69bc192a4c065d4c82c2ad38e9731d2e6606e19b
Opcode Fuzzy Hash: 28e91978891c492b1cbaac380f24f71bf40da3fb043633dbee495f36113eb4af
Instruction Fuzzy Hash: 13414931306A0283FB58DF62E5547AEA3A1FB9AFC0F48D215CE4A07B59CF38D6518358

Function 000001845C500260 Relevance: 16.6, APIs: 11, Instructions: 101servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 000001845C5002AB
OpenServiceW.ADVAPI32 ref: 000001845C5002C8
QueryServiceStatus.ADVAPI32 ref: 000001845C5002D9
LockServiceDatabase.ADVAPI32 ref: 000001845C5002E2
ChangeServiceConfigW.ADVAPI32 ref: 000001845C500340
UnlockServiceDatabase.ADVAPI32 ref: 000001845C50034E
CloseServiceHandle.ADVAPI32 ref: 000001845C500357
CloseServiceHandle.ADVAPI32 ref: 000001845C500360
Sleep.KERNEL32 ref: 000001845C50036B
VirtualFree.KERNEL32 ref: 000001845C500381
VirtualFree.KERNEL32 ref: 000001845C5003AB

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Service$CloseDatabaseFreeHandleOpenVirtual$ChangeConfigLockManagerQuerySleepStatusUnlock
String ID:
API String ID: 3731607402-0
Opcode ID: a9eb4e77f0189a9487206b475b1535da776a34eb102c6930cb2e8e0098df8897
Instruction ID: 7ef48e071a7823fc2dd2c2895498d5f754f6f85ea59f69e77aa34da865041dc5
Opcode Fuzzy Hash: a9eb4e77f0189a9487206b475b1535da776a34eb102c6930cb2e8e0098df8897
Instruction Fuzzy Hash: B041AE36300B5583EB68DF52A854B9EB3A5FB98F90F94C219CE9A43B14DF38C545C744

Function 000001845C4FCB60 Relevance: 16.6, APIs: 11, Instructions: 71stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4FCB84
malloc.MSVCRT ref: 000001845C4FCB92
Process32FirstW.KERNEL32 ref: 000001845C4FCBB0
lstrcmpiW.KERNEL32(?,?,?,000001845C4E2AC7), ref: 000001845C4FCBC1
free.MSVCRT ref: 000001845C4FCBD6
CloseHandle.KERNEL32(?,?,?,000001845C4E2AC7), ref: 000001845C4FCBE4
Process32NextW.KERNEL32 ref: 000001845C4FCBF4
lstrcmpiW.KERNEL32(?,?,?,000001845C4E2AC7), ref: 000001845C4FCC07
Process32NextW.KERNEL32 ref: 000001845C4FCC1C
free.MSVCRT ref: 000001845C4FCC29
CloseHandle.KERNEL32(?,?,?,000001845C4E2AC7), ref: 000001845C4FCC37

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process32$CloseHandleNextfreelstrcmpi$CreateFirstSnapshotToolhelp32malloc
String ID:
API String ID: 2997854644-0
Opcode ID: fbb00ed28ea78f619fe1ddfcfc2a1448f07964961530676492a00d6974b8df58
Instruction ID: 9db34ad6e6b4e5e7408b8770385eb6d4f3c5a65b3f4beec7d8d521f84c67f2fe
Opcode Fuzzy Hash: fbb00ed28ea78f619fe1ddfcfc2a1448f07964961530676492a00d6974b8df58
Instruction Fuzzy Hash: 8621F131300A4683EB688F66E9543ADA3A1F799FC0F89C325DD468B754DF3CDA408388

Function 000001845C4FF590 Relevance: 16.6, APIs: 11, Instructions: 55threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001845C4FF5A4
GetThreadDesktop.USER32 ref: 000001845C4FF5AC
memset.NTDLL ref: 000001845C4FF5C2
GetUserObjectInformationW.USER32 ref: 000001845C4FF5E5
OpenInputDesktop.USER32 ref: 000001845C4FF5F5
memset.NTDLL ref: 000001845C4FF60E
GetUserObjectInformationW.USER32 ref: 000001845C4FF634
lstrcmpiW.KERNEL32 ref: 000001845C4FF647
SetThreadDesktop.USER32 ref: 000001845C4FF654
CloseDesktop.USER32 ref: 000001845C4FF662
CloseDesktop.USER32 ref: 000001845C4FF66B

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUsermemset$CurrentInputOpenlstrcmpi
String ID:
API String ID: 2480204736-0
Opcode ID: a7e5f87c476b32af149d3a23a836e4c12a9df15ddd786ef6baeaf1639c8a2ace
Instruction ID: 9c5ee9bb365f09d7e9d1001a9134c019b478b925d5d226d5b96fb8a0a86163eb
Opcode Fuzzy Hash: a7e5f87c476b32af149d3a23a836e4c12a9df15ddd786ef6baeaf1639c8a2ace
Instruction Fuzzy Hash: 86213935214B9693EB289F51E8587CEA3A1F799F84F848626DA4A43B54DF3CC309C784

Function 000001845C4F8DC0 Relevance: 16.4, APIs: 13, Instructions: 122COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C4F8E0A
EnterCriticalSection.KERNEL32 ref: 000001845C4F8E20
LeaveCriticalSection.KERNEL32 ref: 000001845C4F8E45
IsBadReadPtr.KERNEL32 ref: 000001845C4F8E5E
VirtualFree.KERNEL32 ref: 000001845C4F8E77
VirtualFree.KERNEL32 ref: 000001845C4F8E8D
IsBadReadPtr.KERNEL32 ref: 000001845C4F8EA2
EnterCriticalSection.KERNEL32 ref: 000001845C4F8EB5
LeaveCriticalSection.KERNEL32 ref: 000001845C4F8EDE
VirtualFree.KERNEL32 ref: 000001845C4F8F07
LeaveCriticalSection.KERNEL32 ref: 000001845C4F8F11
VirtualFree.KERNEL32 ref: 000001845C4F8F2F
VirtualFree.KERNEL32 ref: 000001845C4F8F65

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalFreeSectionVirtual$LeaveRead$Enter
String ID:
API String ID: 3895189749-0
Opcode ID: 5b659170a3c5bc0ddeb54f8c31c300c9ac37a021183c1e4ae1f509fd982aa9e7
Instruction ID: 85350888a5917fb9c70af8f152ee6b948ec715a433e70898b9c3038d39623a7b
Opcode Fuzzy Hash: 5b659170a3c5bc0ddeb54f8c31c300c9ac37a021183c1e4ae1f509fd982aa9e7
Instruction Fuzzy Hash: 67515F31301E4287FB588F62E4507AEA3A5FB9AF84F48C621DE4A4BB54DF3DD6458348

Function 000001845C504090 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 138timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000001845C5040C2
malloc.MSVCRT ref: 000001845C5040E5
malloc.MSVCRT ref: 000001845C50415B
free.MSVCRT ref: 000001845C5041A2
malloc.MSVCRT ref: 000001845C5042B3
free.MSVCRT ref: 000001845C5042E6

Strings

d, xrefs: 000001845C504225
d, xrefs: 000001845C504267
<, xrefs: 000001845C50426E

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: malloc$free$Timetime
String ID: <$d$d
API String ID: 3424428123-2034941416
Opcode ID: 67633af4dfc8252cf45609dabaea5b26b53f42197f8e2474752b99a928027a60
Instruction ID: 21c789ed9db910fc780f7758afc7ed7f4a9892df7f0cd282373aea83643fa2cb
Opcode Fuzzy Hash: 67633af4dfc8252cf45609dabaea5b26b53f42197f8e2474752b99a928027a60
Instruction Fuzzy Hash: 83714972202B95C7EB45CF61E58038D77A8F758B88F08C629CB882B764DF78C164DB54

Function 000001845C4FE392 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 77processstringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4FE3D9
GetSystemDirectoryW.KERNEL32 ref: 000001845C4FE3EB
lstrcatW.KERNEL32 ref: 000001845C4FE400
CreateProcessW.KERNEL32 ref: 000001845C4FE493
CloseHandle.KERNEL32 ref: 000001845C4FE4A3
CloseHandle.KERNEL32 ref: 000001845C4FE4B8

Strings

WinSta0\Winlogon, xrefs: 000001845C4FE420
h, xrefs: 000001845C4FE473
\cmd.exe, xrefs: 000001845C4FE3F1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateDirectoryProcessSystemlstrcatmemset
String ID: WinSta0\Winlogon$\cmd.exe$h
API String ID: 3110162951-1128999311
Opcode ID: 377d92c3c3f7588309b3223c4e866e91415498e2d0b57ba55e9f7e9773e501a6
Instruction ID: e45182b831c40154c96572bb6793f8743822333237036b797da9d07c219b3ef1
Opcode Fuzzy Hash: 377d92c3c3f7588309b3223c4e866e91415498e2d0b57ba55e9f7e9773e501a6
Instruction Fuzzy Hash: 16316033918BC283E7208F50E8447DEB7A0F7A6704F94D326D6C942A65EF78D294CB44

Function 000001845C4E3BD0 Relevance: 15.2, APIs: 10, Instructions: 150networkthreadCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 000001845C4E3C23
SetThreadExecutionState.KERNEL32 ref: 000001845C4E3C65
SystemParametersInfoW.USER32 ref: 000001845C4E3C76
SystemParametersInfoW.USER32 ref: 000001845C4E3C87
WSAWaitForMultipleEvents.WS2_32 ref: 000001845C4E3CB2
WSAEnumNetworkEvents.WS2_32 ref: 000001845C4E3CF2
SetEvent.KERNEL32 ref: 000001845C4E3D6B
WSAGetLastError.WS2_32 ref: 000001845C4E3D7B
VirtualFree.KERNEL32 ref: 000001845C4E3D98
VirtualFree.KERNEL32 ref: 000001845C4E3DC2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: EventEventsFreeInfoParametersSystemVirtual$EnumErrorExecutionLastMultipleNetworkSelectStateThreadWait
String ID:
API String ID: 705661956-0
Opcode ID: b3306e8e6be995fbad07b710c8ebb45c85d78bfb96534e55b13d4da9fa6293f6
Instruction ID: 4aa50c79c6e2bf43b2cdf44526f9116fe201c4d99986ac0420a298b4b0ed4455
Opcode Fuzzy Hash: b3306e8e6be995fbad07b710c8ebb45c85d78bfb96534e55b13d4da9fa6293f6
Instruction Fuzzy Hash: E051F136300A42C3EB658F26DA84FAD73A1FB56F84F159621CE0A43B94CF34CA51C745

Function 000001845C5045A0 Relevance: 15.1, APIs: 10, Instructions: 100memorytimethreadCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000001845C5045C5
VirtualAlloc.KERNEL32 ref: 000001845C504647
IsBadReadPtr.KERNEL32 ref: 000001845C504677
EnterCriticalSection.KERNEL32 ref: 000001845C50468E
send.WS2_32 ref: 000001845C5046A1
GetLastError.KERNEL32 ref: 000001845C5046A7
IsBadReadPtr.KERNEL32 ref: 000001845C5046B7
ExitThread.KERNEL32 ref: 000001845C5046C3
LeaveCriticalSection.KERNEL32 ref: 000001845C5046CE
VirtualFree.KERNEL32 ref: 000001845C5046E4

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalReadSectionVirtual$AllocEnterErrorExitFreeLastLeaveThreadTimesendtime
String ID:
API String ID: 3122330297-0
Opcode ID: 51404108585b7ff1db373e89b646bf7e8d42d759f0de1be0177d3c4d76274544
Instruction ID: 218727d5fe54140df3eaf73241a1a5794b388b0d1b5b19f86b01f85af616d780
Opcode Fuzzy Hash: 51404108585b7ff1db373e89b646bf7e8d42d759f0de1be0177d3c4d76274544
Instruction Fuzzy Hash: 0141AF32300A5587E7598FA2E44039DB3A0F768F88F54C22ACB4A83794EF39DA55CB44

Function 000000018001A7E8 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000018001A7F7

Part of subcall function 0000000180019CF8: __vcrt_initialize.LIBVCRUNTIME ref: 0000000180019D1A

__scrt_release_startup_lock.LIBCMT ref: 000000018001A87A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A890
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018001A8BC
__scrt_get_show_window_mode.LIBCMT ref: 000000018001A8CD
__scrt_is_managed_app.LIBCMT ref: 000000018001A8F0
__scrt_uninitialize_crt.LIBCMT ref: 000000018001A907
__scrt_fastfail.LIBCMT ref: 000000018001A939
__scrt_fastfail.LIBCMT ref: 000000018001A944
__security_init_cookie.LIBCMT ref: 000000018001A960

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 20208a98ab850ec38ed8325cc0af7ea2ed5af357558f35f83d8d5c5aa49ef683
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: C631923160994C86FBE7BBA5D4523EA2391AB4E3C4F45C425B94A473D7DE28CB4E8350

Function 000001845BF49BE8 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000001845BF49BF7

Part of subcall function 000001845BF490F8: __vcrt_initialize.LIBVCRUNTIME ref: 000001845BF4911A

__scrt_release_startup_lock.LIBCMT ref: 000001845BF49C7A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000001845BF49C90
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000001845BF49CBC
__scrt_get_show_window_mode.LIBCMT ref: 000001845BF49CCD
__scrt_is_managed_app.LIBCMT ref: 000001845BF49CF0
__scrt_uninitialize_crt.LIBCMT ref: 000001845BF49D07
__scrt_fastfail.LIBCMT ref: 000001845BF49D39
__scrt_fastfail.LIBCMT ref: 000001845BF49D44
__security_init_cookie.LIBCMT ref: 000001845BF49D60

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1326835672-0
Opcode ID: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction ID: 649731ae198dc1f129116bc9484d2e52d335e8c361f54c9094adad0cce7e989a
Opcode Fuzzy Hash: 428f1bac40111efcf19b2a06b83d8cc5b337c87ddf82bc9150455d955b8395b0
Instruction Fuzzy Hash: 423141337012038BFB64EB68D4563ED2391AB55344F44C429AACACB6D7DF298745CF15

Function 000001845C4EAFC0 Relevance: 15.1, APIs: 10, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EAFD7
CreateEventW.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB061
VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB086
InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB098
VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0BD
InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0CF
VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB0F4
InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB106
VirtualAlloc.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB12B
InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E1E17), ref: 000001845C4EB13D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: AllocVirtual$CriticalInitializeSection$CreateEvent
String ID:
API String ID: 469433356-0
Opcode ID: ea69eefc2d230828b900866a37b3cbd0fa8e3a0e552ff7279e715e0694118ad8
Instruction ID: bd2f9ccb69790b6cc1e53a166607b61beb278af286b810f6bbaa32b0cf4f2736
Opcode Fuzzy Hash: ea69eefc2d230828b900866a37b3cbd0fa8e3a0e552ff7279e715e0694118ad8
Instruction Fuzzy Hash: 2D415E32211F56C3EB158F51F9406CD77B8F719B80F81862ADA4943BA4EF38D668C359

Function 000001845C4E1E90 Relevance: 15.1, APIs: 10, Instructions: 91threadmemoryCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000001845C4E1EBF
IsBadReadPtr.KERNEL32 ref: 000001845C4E1EF4
EnterCriticalSection.KERNEL32 ref: 000001845C4E1F0F
VirtualAlloc.KERNEL32 ref: 000001845C4E1F25
LeaveCriticalSection.KERNEL32 ref: 000001845C4E1F49
GetNativeSystemInfo.KERNEL32 ref: 000001845C4E1F7B
CreateThread.KERNEL32 ref: 000001845C4E1FB2
CloseHandle.KERNEL32 ref: 000001845C4E1FC0
CreateThread.KERNEL32 ref: 000001845C4E1FDE
CloseHandle.KERNEL32 ref: 000001845C4E1FEC

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CreateThread$CloseCriticalHandleSection$AllocEnterInfoLeaveNativeReadSystemVirtual
String ID:
API String ID: 3571750651-0
Opcode ID: 1363fd4b51c054286b4f9f0578cb1f11da93afc1d0dca13003e3c5ae9259af37
Instruction ID: 009a87c8347c997fb02751a64ac19451764fc84d4b3b58f3e8c039372517d1b8
Opcode Fuzzy Hash: 1363fd4b51c054286b4f9f0578cb1f11da93afc1d0dca13003e3c5ae9259af37
Instruction Fuzzy Hash: FE416C32604B92C3DB24CF61E90079DB3A4F799B84F85C62ADE8907755EF38C695C748

Function 000001845C5003E0 Relevance: 15.1, APIs: 10, Instructions: 74servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 000001845C500405
OpenServiceW.ADVAPI32 ref: 000001845C500422
QueryServiceStatus.ADVAPI32 ref: 000001845C500433
ControlService.ADVAPI32 ref: 000001845C50045E
ControlService.ADVAPI32 ref: 000001845C50047A
ControlService.ADVAPI32 ref: 000001845C500496
StartServiceW.ADVAPI32 ref: 000001845C5004AD
CloseServiceHandle.ADVAPI32 ref: 000001845C5004B6
CloseServiceHandle.ADVAPI32 ref: 000001845C5004BF
Sleep.KERNEL32 ref: 000001845C5004CA

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Service$Control$CloseHandleOpen$ManagerQuerySleepStartStatus
String ID:
API String ID: 2453229493-0
Opcode ID: 2273a004fea410f7597165bb23289446dcc16b9a87cf60cf92e4a93607a0279b
Instruction ID: c7939069333c4b482208236bfe8f4efb37c799630df03980cceba95c4922445e
Opcode Fuzzy Hash: 2273a004fea410f7597165bb23289446dcc16b9a87cf60cf92e4a93607a0279b
Instruction Fuzzy Hash: 9331D431600B6A83EA28DF92E51429EF3A1F7D8F81F44C221DA4A53B54DE3DC748CB48

Function 000001845C4F23B0 Relevance: 15.1, APIs: 10, Instructions: 74stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4F23C2
malloc.MSVCRT ref: 000001845C4F23DE
Process32FirstW.KERNEL32 ref: 000001845C4F2404
lstrlenW.KERNEL32 ref: 000001845C4F241B
lstrlenW.KERNEL32 ref: 000001845C4F2429
Process32NextW.KERNEL32 ref: 000001845C4F2460
lstrlenW.KERNEL32 ref: 000001845C4F2474
Process32NextW.KERNEL32 ref: 000001845C4F24AB
free.MSVCRT ref: 000001845C4F24BD
CloseHandle.KERNEL32 ref: 000001845C4F24C6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process32lstrlen$Next$CloseCreateFirstHandleSnapshotToolhelp32freemalloc
String ID:
API String ID: 4027670598-0
Opcode ID: 439f8d2e972513238416a548221f462a94073303e1c60fa0b93f47d4e757f503
Instruction ID: ecd9b2f4e0795a8e77f20034a3d7720f6c78264c0d1dd18c808482fef59634e8
Opcode Fuzzy Hash: 439f8d2e972513238416a548221f462a94073303e1c60fa0b93f47d4e757f503
Instruction Fuzzy Hash: 8E318D71204A1683EB649F26E84479DB7B0F789FD0F849221EE4A47B68DF3CC249CB04

Function 000001845C4FB8E0 Relevance: 15.0, APIs: 5, Strings: 5, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001845C4FB8F9
lstrcmpiW.KERNEL32 ref: 000001845C4FB916
lstrcmpiW.KERNEL32 ref: 000001845C4FB933
lstrcmpiW.KERNEL32 ref: 000001845C4FB950
lstrcmpiW.KERNEL32 ref: 000001845C4FB96D

Strings

HKEY_CURRENT_CONFIG, xrefs: 000001845C4FB940
HKEY_USERS, xrefs: 000001845C4FB923
HKEY_CURRENT_USER, xrefs: 000001845C4FB8F2
HKEY_LOCAL_MACHINE, xrefs: 000001845C4FB906
HKEY_CLASSES_ROOT, xrefs: 000001845C4FB95D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 1586166983-3507829934
Opcode ID: 92d67e1772ed5d27b35ffe2b6b4ab96e07dede8ed643a73d65189ae7ffbca217
Instruction ID: 3f42149666f47bb0da145e7a4754c7f3fd0beef24bda6f077dbad3abfd55e07e
Opcode Fuzzy Hash: 92d67e1772ed5d27b35ffe2b6b4ab96e07dede8ed643a73d65189ae7ffbca217
Instruction Fuzzy Hash: 7B011220300B1967EA049BB6AD99399B2519F58FF5F849325AD2A837F8DF68C244C348

Function 0000000180019F69 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000000018001A062
__scrt_fastfail.LIBCMT ref: 000000018001A0B1
__scrt_fastfail.LIBCMT ref: 000000018001A0BC
__scrt_fastfail.LIBCMT ref: 000000018001A0C7

Strings

onstructor closure', xrefs: 0000000180019FF4
`eh vector vbase constructor iterator', xrefs: 0000000180019F9C
`local vftable', xrefs: 0000000180019FE0
`udt returning', xrefs: 0000000180019FCC

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 430d6e6a62d8c94c9c04e7e52013dca82c213aedb955d9ad44379b1780147ad5
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: FF416D35206B4C82FBA79B20E9503EA2361AB4EBD0F54D525E90E477A4DF3CC68E8304

Function 000001845BF49369 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 000001845BF49462
__scrt_fastfail.LIBCMT ref: 000001845BF494B1
__scrt_fastfail.LIBCMT ref: 000001845BF494BC
__scrt_fastfail.LIBCMT ref: 000001845BF494C7

Strings

`local vftable', xrefs: 000001845BF493E0
`udt returning', xrefs: 000001845BF493CC
onstructor closure', xrefs: 000001845BF493F4
`eh vector vbase constructor iterator', xrefs: 000001845BF4939C

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __scrt_fastfail$__scrt_initialize_onexit_tables
String ID: `eh vector vbase constructor iterator'$`local vftable'$`udt returning'$onstructor closure'
API String ID: 2273495996-2419032777
Opcode ID: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction ID: 9136cc2e46e2b1c2881ad59cf5e40b820321d34a5dd54a28c1c77466e197d6bf
Opcode Fuzzy Hash: 371735c951b6f4861318f081dd214222249cf913f5a589c2fbc766e687f75775
Instruction Fuzzy Hash: EE415B37302B0287FA14DB64E8117DD2361AB8AB90F44D925C98E877E4DF2DD645CB18

Function 000001845C4F3A80 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70stringthreadCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F3AE5
lstrcmpiW.KERNEL32 ref: 000001845C4F3B0A
lstrcmpiW.KERNEL32 ref: 000001845C4F3B31
CreateThread.KERNEL32 ref: 000001845C4F3B9F

Strings

TCP, xrefs: 000001845C4F3AFB
UDP, xrefs: 000001845C4F3B22
HTTP, xrefs: 000001845C4F3B43

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcmpi$CreateThreadmemset
String ID: HTTP$TCP$UDP
API String ID: 1278753810-3864057669
Opcode ID: 4f3725c6e9a3c20e9ab6cee16e493342bd08e11a55dedb5a078407a7875efed0
Instruction ID: c474d4ceb27a87ecdecd1f6193620bcb41dde75bfe1726beba3fd062ff0c023f
Opcode Fuzzy Hash: 4f3725c6e9a3c20e9ab6cee16e493342bd08e11a55dedb5a078407a7875efed0
Instruction Fuzzy Hash: A9312571608B5697EB10CF61E8903DEB7B1F799B84F80D226DA4A83665EF3CC284C704

Function 000001845C502180 Relevance: 13.8, APIs: 9, Instructions: 260COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 000001845C50223A

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 948343c06ea8565a1ec3a8f72c563dc0c748cdd4bbb0149151ad3a0c17d1f3f7
Instruction ID: cfef962aad1478f284c253564928919d0486e7ce92c05e60f903897ac17f242a
Opcode Fuzzy Hash: 948343c06ea8565a1ec3a8f72c563dc0c748cdd4bbb0149151ad3a0c17d1f3f7
Instruction Fuzzy Hash: B6C11536700A558BEB24CFB9D4846AC63B0F798F88F418616DE0E67B28DF38D649C744

Function 000001845C4E2000 Relevance: 13.6, APIs: 9, Instructions: 73memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

GetCurrentProcessId.KERNEL32 ref: 000001845C4E2020
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E2030

Part of subcall function 000001845C4F6CA0: VirtualAlloc.KERNEL32 ref: 000001845C4F6CBE
Part of subcall function 000001845C4F6CA0: GetCurrentProcessId.KERNEL32 ref: 000001845C4F6D39

VirtualAlloc.KERNEL32 ref: 000001845C4E2096
InitializeCriticalSection.KERNEL32 ref: 000001845C4E20A8
VirtualAlloc.KERNEL32 ref: 000001845C4E20CD
InitializeCriticalSection.KERNEL32 ref: 000001845C4E20DF
CreateThread.KERNEL32 ref: 000001845C4E2117
WaitForSingleObject.KERNEL32 ref: 000001845C4E212D
CloseHandle.KERNEL32 ref: 000001845C4E2136

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: AllocCriticalSectionVirtual$EnterInitializeProcessRead$CurrentLeave$CloseCreateHandleObjectSessionSingleThreadWait
String ID:
API String ID: 1571644542-0
Opcode ID: dcf58f8bd94f4b4f5eefa7d45e8e40f62b7c11d8478bf447f9b59908b2d98ac2
Instruction ID: 4df4d8f33240ec1b1b7cb588baf364732cf0a12ffc068a83b303e3cc2f0fcd38
Opcode Fuzzy Hash: dcf58f8bd94f4b4f5eefa7d45e8e40f62b7c11d8478bf447f9b59908b2d98ac2
Instruction Fuzzy Hash: 03315D32214B92C3EB24CF61F8006DEB7A4F799F80F55821AEA8647B94DF38D644C794

Function 000001845C500180 Relevance: 13.6, APIs: 9, Instructions: 60serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 000001845C5001A8
GetLastError.KERNEL32 ref: 000001845C5001B6

Part of subcall function 000001845C4E2760: VirtualFree.KERNEL32 ref: 000001845C4E27E5
Part of subcall function 000001845C4E2760: VirtualFree.KERNEL32 ref: 000001845C4E280F

OpenServiceW.ADVAPI32 ref: 000001845C5001E1
GetLastError.KERNEL32 ref: 000001845C5001EF
CloseServiceHandle.ADVAPI32 ref: 000001845C500205

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorFreeLastOpenServiceVirtual$CloseHandleManager
String ID:
API String ID: 3563172158-0
Opcode ID: ce12c43ad3cf74fd47867ee24130c725be5bd76402bb544879ce041abdb63390
Instruction ID: 0e2abc5761eda03967a58eb413654bce1e5e600fc441ab25313f7312285530e5
Opcode Fuzzy Hash: ce12c43ad3cf74fd47867ee24130c725be5bd76402bb544879ce041abdb63390
Instruction Fuzzy Hash: F4217234700B6B83EB58EFA2A95439D9391AB9DFD0F0481259D0B83B55EE3CC6458748

Function 000001845C4F8630 Relevance: 12.6, APIs: 10, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualAlloc.KERNEL32 ref: 000001845C4F8683
VirtualAlloc.KERNEL32 ref: 000001845C4F86CF
IsBadReadPtr.KERNEL32 ref: 000001845C4F8711
EnterCriticalSection.KERNEL32 ref: 000001845C4F8729
VirtualAlloc.KERNEL32 ref: 000001845C4F8740
LeaveCriticalSection.KERNEL32 ref: 000001845C4F8764
VirtualFree.KERNEL32 ref: 000001845C4F8789
VirtualFree.KERNEL32 ref: 000001845C4F87B3
VirtualFree.KERNEL32 ref: 000001845C4F87C9
VirtualFree.KERNEL32 ref: 000001845C4F87F3

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 46fff95910c23406eb469c503979ea30ae88de5af3fad95f670b18fa206ae6df
Instruction ID: bc956895820e8cdc15aa1e2a88058796b379983124b8132f059bffd5b217af63
Opcode Fuzzy Hash: 46fff95910c23406eb469c503979ea30ae88de5af3fad95f670b18fa206ae6df
Instruction Fuzzy Hash: D1518E32311A5183EB18DF62E9547AEA3A0FB8AF80F44C125CF4A47B54DF38E6558748

Function 000001845C529B40 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 183networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000001845C529CD2

Strings

proxy write failed, xrefs: 000001845C529CDC
Proxy-authorization: basic %s, xrefs: 000001845C529C40
first service failed, xrefs: 000001845C529D9F
client_connect4, xrefs: 000001845C529E14
CONNECT %s:%u HTTP/1.1Host: %s:%uUser-agent: lws, xrefs: 000001845C529C05
RAW, xrefs: 000001845C529B9C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: send
String ID: CONNECT %s:%u HTTP/1.1Host: %s:%uUser-agent: lws$Proxy-authorization: basic %s$RAW$client_connect4$first service failed$proxy write failed
API String ID: 2809346765-3983456341
Opcode ID: 11d3f37dd95c02476e6052aa96ec3df33aad2b63795300cda34447b6fc21c926
Instruction ID: 74518b624b0ec49d1f1b5eaa2f24e0aae8417b7eafb79fc4b3e1a59dcc865aaf
Opcode Fuzzy Hash: 11d3f37dd95c02476e6052aa96ec3df33aad2b63795300cda34447b6fc21c926
Instruction Fuzzy Hash: C081B1722106AA83EB548FA2D4547EDB3E4F764B88F84C236DE4957794DF38C641C788

Function 000001845C4FC760 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

WTSEnumerateSessionsW.WTSAPI32 ref: 000001845C4FC79F
WTSQuerySessionInformationW.WTSAPI32 ref: 000001845C4FC7FB
lstrlenW.KERNEL32 ref: 000001845C4FC813
WTSFreeMemory.WTSAPI32 ref: 000001845C4FC892
WTSFreeMemory.WTSAPI32 ref: 000001845C4FC8AC

Strings

system, xrefs: 000001845C4FC839, 000001845C4FC860

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeMemory$EnumerateInformationQuerySessionSessionslstrlen
String ID: system
API String ID: 3618899143-3377271179
Opcode ID: b32c9ff873edc57c0f6f3c7361fb97fa384e6bee228724bcac05ea03c1df1bf5
Instruction ID: f1451d5a3b79ab1c642746d8d911cbfcf37fd4f889546922965e675a635cbc28
Opcode Fuzzy Hash: b32c9ff873edc57c0f6f3c7361fb97fa384e6bee228724bcac05ea03c1df1bf5
Instruction Fuzzy Hash: B04167B6B10A619BEB10CF65E8846DD37B4F348B98F405A16EF0A43B58DF34C694CB44

Function 000001845C4F22F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39stringfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4F230D
lstrcatW.KERNEL32 ref: 000001845C4F231E
lstrcatW.KERNEL32 ref: 000001845C4F2330
DeleteFileW.KERNEL32 ref: 000001845C4F2369
GetLastError.KERNEL32 ref: 000001845C4F2379

Strings

C:\Program Files\Windows Mail, xrefs: 000001845C4F2312
\temp.key, xrefs: 000001845C4F2324

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcat$DeleteErrorFileLastmemset
String ID: C:\Program Files\Windows Mail$\temp.key
API String ID: 3002015462-229217837
Opcode ID: 75718442f7fc29e2b7bc083eea7b4b405c17fcc48b4aa1abb5b1d73d3bcafe19
Instruction ID: bfd22213e7e813b4eb6d1a94106f1a3266467c681bb58b5400363f3a04db7e2d
Opcode Fuzzy Hash: 75718442f7fc29e2b7bc083eea7b4b405c17fcc48b4aa1abb5b1d73d3bcafe19
Instruction Fuzzy Hash: 8A119132608B86C3D7208F65F44439EF3A0F7D9B84F508216E68942A68DF7CC248CB44

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000000018000194B
GetModuleFileNameW.KERNEL32 ref: 000000018000195D
wcsstr.NTDLL ref: 000000018000196F
IsUserAnAdmin.SHELL32 ref: 000000018000197A
ExitProcess.KERNEL32 ref: 00000001800019A1

Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800015E5
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 0000000180001609
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 0000000180001613
Part of subcall function 00000001800015B0: memset.NTDLL ref: 0000000180001648
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016A8
Part of subcall function 00000001800015B0: GetModuleFileNameW.KERNEL32 ref: 00000001800016BA
Part of subcall function 00000001800015B0: malloc.MSVCRT ref: 00000001800016CD
Part of subcall function 00000001800015B0: memset.NTDLL ref: 00000001800016E7
Part of subcall function 00000001800015B0: memcpy.NTDLL ref: 00000001800016F5
Part of subcall function 00000001800015B0: OpenSCManagerW.ADVAPI32 ref: 0000000180001789

ExitProcess.KERNEL32 ref: 000000018000198E

Strings

svchost.exe, xrefs: 0000000180001963

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: memset$malloc$ExitFileModuleNameProcessmemcpy$AdminManagerOpenUserwcsstr
String ID: svchost.exe
API String ID: 2075570005-3106260013
Opcode ID: 58df4dc3bab4f7dd2091c0286527b5df24bc2997b8bd963c05bea4cdd90a2c72
Instruction ID: a7e4a02683164cc51efae999f71ec939c82b81573c8ef5df0e77f5c8c66af7f8
Opcode Fuzzy Hash: 58df4dc3bab4f7dd2091c0286527b5df24bc2997b8bd963c05bea4cdd90a2c72
Instruction Fuzzy Hash: 7E015231311A4D81FBAAEB21E8A93DA6360BB8D795F449125A99E46295DF3CC34CC740

Function 000001845C4F01A0 Relevance: 12.1, APIs: 8, Instructions: 109processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001845C4F0207
OpenProcessToken.ADVAPI32 ref: 000001845C4F0219
GetLastError.KERNEL32 ref: 000001845C4F0223
DuplicateTokenEx.ADVAPI32 ref: 000001845C4F0251
SetTokenInformation.ADVAPI32 ref: 000001845C4F026D
CreateEnvironmentBlock.USERENV ref: 000001845C4F0282
CreateProcessAsUserW.ADVAPI32 ref: 000001845C4F02CA
CreateProcessAsUserW.ADVAPI32 ref: 000001845C4F0313

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$CreateToken$User$BlockCurrentDuplicateEnvironmentErrorInformationLastOpen
String ID:
API String ID: 2924300727-0
Opcode ID: 16c3d07ec9acde65d2acdc43e71b5766c09dd73d369f4e5c742e79ed460f77ea
Instruction ID: df9b6c6ae7bc7adae67e1b8baa30e10d9bae824d6b4eea8d8d5d19a8ef8addb3
Opcode Fuzzy Hash: 16c3d07ec9acde65d2acdc43e71b5766c09dd73d369f4e5c742e79ed460f77ea
Instruction Fuzzy Hash: 88515A32B04B928BE750CFA1E48079D73B5F399788F409215AE8C67B18DF38C659C744

Function 000001845C504900 Relevance: 12.1, APIs: 8, Instructions: 108memorytimenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C503BB0: socket.WS2_32 ref: 000001845C503BF3
Part of subcall function 000001845C503BB0: GetLastError.KERNEL32 ref: 000001845C503C02

send.WS2_32 ref: 000001845C50495E
timeGetTime.WINMM ref: 000001845C504964
VirtualAlloc.KERNEL32 ref: 000001845C504994
VirtualFree.KERNEL32 ref: 000001845C5049E6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocErrorFreeLastTimesendsockettime
String ID:
API String ID: 675528727-0
Opcode ID: ffa402f768c8f16eaddf7cabb92685b8e3fc598e86ccd357d1f3be0cf34130b3
Instruction ID: 8bd8b166faa03308d004f32ce7480bc75e961102b2c0e3e418abec95e65868a9
Opcode Fuzzy Hash: ffa402f768c8f16eaddf7cabb92685b8e3fc598e86ccd357d1f3be0cf34130b3
Instruction Fuzzy Hash: FA419332310A6543EB58CF66E90479EA7A1F7A9FC0F08C125DF4A93B94DF39C6518748

Function 000001845C4EDEC0 Relevance: 12.1, APIs: 8, Instructions: 92memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4EDF24
VirtualFree.KERNEL32 ref: 000001845C4EDF4E
CreateEventW.KERNEL32 ref: 000001845C4EDF64
CreateThread.KERNEL32 ref: 000001845C4EDF89
IsBadReadPtr.KERNEL32 ref: 000001845C4EDF9E
EnterCriticalSection.KERNEL32 ref: 000001845C4EDFB1
VirtualAlloc.KERNEL32 ref: 000001845C4EDFC8
LeaveCriticalSection.KERNEL32 ref: 000001845C4EDFEC

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$Leave$CreateFree$EventInitializeThread
String ID:
API String ID: 1715669518-0
Opcode ID: 063af28826c257ba34dd61794c6217d4116b079e187d054435bfcbad311f18e1
Instruction ID: e012d9e19184dfc97fca072228b6f15f9e3bd5ba62c438d8048b3efc9925037c
Opcode Fuzzy Hash: 063af28826c257ba34dd61794c6217d4116b079e187d054435bfcbad311f18e1
Instruction Fuzzy Hash: 4F316732300B5183EB18CF62E944B9EB3A5FB88F84F89C1269E4A43B54DF38C625C744

Function 000001845C503F80 Relevance: 12.1, APIs: 8, Instructions: 56synchronizationthreadnetworkCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C503FB8
EnterCriticalSection.KERNEL32 ref: 000001845C503FC6
send.WS2_32 ref: 000001845C503FD8
GetLastError.KERNEL32 ref: 000001845C503FDE
IsBadReadPtr.KERNEL32 ref: 000001845C503FEE
LeaveCriticalSection.KERNEL32 ref: 000001845C503FFC
WaitForSingleObject.KERNEL32 ref: 000001845C50400F
ExitThread.KERNEL32 ref: 000001845C50401D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalReadSection$EnterErrorExitLastLeaveObjectSingleThreadWaitsend
String ID:
API String ID: 152332814-0
Opcode ID: 2d099a332ae138d2403c0ed02e9701855ee02b40e3ab162302b3085763c8ad70
Instruction ID: 215ba962076c0f09c678edfc98659a27f66b38365946d9656aedf69916a4184a
Opcode Fuzzy Hash: 2d099a332ae138d2403c0ed02e9701855ee02b40e3ab162302b3085763c8ad70
Instruction Fuzzy Hash: 53118632304A1683E7059FA2E8103AEE3A4FBB9F85F94D126DE0997794DF3DC9458348

Function 000001845C4EE010 Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

__chkstk.NTDLL ref: 000001845C4EE01D
memset.NTDLL ref: 000001845C4EE048
memset.NTDLL ref: 000001845C4EE05A

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4EE09B
VirtualFree.KERNEL32 ref: 000001845C4EE0C5
VirtualFree.KERNEL32 ref: 000001845C4EE197
VirtualFree.KERNEL32 ref: 000001845C4EE1C1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leavememset$Initialize__chkstk
String ID:
API String ID: 2598321309-0
Opcode ID: 19803d78e17f30e281bc56e6a6dc2545e298c1294dfc20e4aef617dcccde76fa
Instruction ID: ae09837805870a807dcab99305070d58126795035682a10905eaa0bc1a878618
Opcode Fuzzy Hash: 19803d78e17f30e281bc56e6a6dc2545e298c1294dfc20e4aef617dcccde76fa
Instruction Fuzzy Hash: EF516E72318A9187EB34DF62E6446ADB361FBCAB80F858214DB8A43F44CF38D155CB09

Function 000001845C4E6DC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 000001845C4E6E6D
VirtualFree.KERNEL32 ref: 000001845C4E6F01
VirtualFree.KERNEL32 ref: 000001845C4E6F2B

Strings

TCP, xrefs: 000001845C4E6E4D
UDP, xrefs: 000001845C4E6E56
HTTP, xrefs: 000001845C4E6E61

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$lstrcat
String ID: HTTP$TCP$UDP
API String ID: 1793027038-3864057669
Opcode ID: fb63e8a4699bb45600396c4e6aee975bb247977ebe0e889c0a84493701b80b76
Instruction ID: bc33ac4ffd80350598a44109708e29d05622421dac7b34481fd40e6baeff6208
Opcode Fuzzy Hash: fb63e8a4699bb45600396c4e6aee975bb247977ebe0e889c0a84493701b80b76
Instruction Fuzzy Hash: D741AF32314B5583EB64CF26E5447AEA3A1FB89F80F409215DA8A83F54DF38D255CB04

Function 000001845C4ED6F0 Relevance: 10.6, APIs: 7, Instructions: 103memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4ED790
VirtualFree.KERNEL32 ref: 000001845C4ED7BA
CreateThread.KERNEL32 ref: 000001845C4ED7E8
IsBadReadPtr.KERNEL32 ref: 000001845C4ED80C
EnterCriticalSection.KERNEL32 ref: 000001845C4ED81F
VirtualAlloc.KERNEL32 ref: 000001845C4ED836
LeaveCriticalSection.KERNEL32 ref: 000001845C4ED85A

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$Leave$Free$CreateInitializeThread
String ID:
API String ID: 1508740679-0
Opcode ID: 1b3e0e81731cd236f1cdf85c7afb2c4caa27aaabd1b84022f2bb5430b119c807
Instruction ID: b8aa0e9d4301da51990b98125e6ae0f56a4f644f0a2fc83d26d1dfa4eff6fb5d
Opcode Fuzzy Hash: 1b3e0e81731cd236f1cdf85c7afb2c4caa27aaabd1b84022f2bb5430b119c807
Instruction Fuzzy Hash: 97418E32210B81CBEB54CF22E94069EB7A4FB88F94F448125EF5A43B54DF38C565CB44

Function 000001845C4F3119 Relevance: 10.6, APIs: 7, Instructions: 102memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F31A2
VirtualAlloc.KERNEL32 ref: 000001845C4F31E8
NetUserSetInfo.NETAPI32 ref: 000001845C4F322B
VirtualFree.KERNEL32 ref: 000001845C4F323C
lstrcmpiW.KERNEL32 ref: 000001845C4F3255
VirtualFree.KERNEL32 ref: 000001845C4F326E
VirtualFree.KERNEL32 ref: 000001845C4F33C1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Free$Alloc$InfoUserlstrcmpi
String ID:
API String ID: 2840552451-0
Opcode ID: 60893066e3bbf6b45f4eeb8daf225cdee7bfb0fcc925a5af3644fbef4d97a442
Instruction ID: 6fc57d462450a6fbbcb10b92037aef265d8ed9d64c8b1151508bca33e0d6f70f
Opcode Fuzzy Hash: 60893066e3bbf6b45f4eeb8daf225cdee7bfb0fcc925a5af3644fbef4d97a442
Instruction Fuzzy Hash: F8415E31715A5187EB74CF22E84479EA3A0F79AF84F449219CE8A43B54DF3CE2498B04

Function 000001845C4EDC50 Relevance: 10.6, APIs: 7, Instructions: 102memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4EDCEA
VirtualFree.KERNEL32 ref: 000001845C4EDD14
CreateThread.KERNEL32 ref: 000001845C4EDD40
IsBadReadPtr.KERNEL32 ref: 000001845C4EDD64
EnterCriticalSection.KERNEL32 ref: 000001845C4EDD77
VirtualAlloc.KERNEL32 ref: 000001845C4EDD8E
LeaveCriticalSection.KERNEL32 ref: 000001845C4EDDB2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$Leave$Free$CreateInitializeThread
String ID:
API String ID: 1508740679-0
Opcode ID: 33e1a942eb179548a12bd386c64c40eaa7ac80ee1b1c8749cbcaf6457b593539
Instruction ID: 85124277117ca72bdca0af5d8c0732814ff8fc30fcf3a6eaf0ae9d0443eb54b4
Opcode Fuzzy Hash: 33e1a942eb179548a12bd386c64c40eaa7ac80ee1b1c8749cbcaf6457b593539
Instruction Fuzzy Hash: A7417936711B4187EB58CF22E54469DB7A4FB88F84F88822ADF4943B14DF38D665CB44

Function 000001845C500AF0 Relevance: 10.6, APIs: 7, Instructions: 82memoryfilestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000001845C500B3E
VirtualAlloc.KERNEL32 ref: 000001845C500B5C

Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC907
Part of subcall function 000001845C4FC8D0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,000001845C4F0EBE), ref: 000001845C4FC92F

lstrlenA.KERNEL32 ref: 000001845C500B8A
WriteFile.KERNEL32 ref: 000001845C500BA4
VirtualFree.KERNEL32 ref: 000001845C500BB5
VirtualFree.KERNEL32 ref: 000001845C500BDA
VirtualFree.KERNEL32 ref: 000001845C500C04

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$ByteCharFreeMultiWide$AllocFileWritelstrlen
String ID:
API String ID: 2835453980-0
Opcode ID: 2ccbba1d97933468815318aad32eba688173e7f35fa5392403b466c644259abf
Instruction ID: 85663dcb2571f80e464df6aa7a1c5b93c21b1fdf1be8aa61e03d12da3617c74a
Opcode Fuzzy Hash: 2ccbba1d97933468815318aad32eba688173e7f35fa5392403b466c644259abf
Instruction Fuzzy Hash: A0316F31308B5583EB58DF67A99465EB3A1FB99FC0F448125DE8A53F24DF38D1228748

Function 000001845C4ED5B0 Relevance: 10.6, APIs: 7, Instructions: 76COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4ED5F7
memset.NTDLL ref: 000001845C4ED60C
memcpy.NTDLL ref: 000001845C4ED627
memcpy.NTDLL ref: 000001845C4ED641
VirtualFree.KERNEL32 ref: 000001845C4ED656
VirtualFree.KERNEL32 ref: 000001845C4ED680
SHFileOperationW.SHELL32 ref: 000001845C4ED6C7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtualmemcpymemset$FileOperation
String ID:
API String ID: 467530429-0
Opcode ID: 14cb9642c533215b7a2e2bfcfdb6d7d7cadd70b785f3dc976475013d93c55a53
Instruction ID: b9604e9747e6906363e870a84f82c7ccec0fd1850b2c5af743268e4633527b03
Opcode Fuzzy Hash: 14cb9642c533215b7a2e2bfcfdb6d7d7cadd70b785f3dc976475013d93c55a53
Instruction Fuzzy Hash: E4317E32214B9587DB24CF12F48068EF3A4FB85B84F548615DB9D03B28DF38D216CB44

Function 000001845C502B20 Relevance: 10.6, APIs: 7, Instructions: 75networkCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 000001845C502B75
WSASend.WS2_32 ref: 000001845C502BBB
WSAGetLastError.WS2_32 ref: 000001845C502BC1
WaitForMultipleObjects.KERNEL32 ref: 000001845C502BEA
WSAGetLastError.WS2_32 ref: 000001845C502C23
CloseHandle.KERNEL32 ref: 000001845C502C35

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandleMultipleObjectsSendWait
String ID:
API String ID: 248740593-0
Opcode ID: 3d6319584adb544b58c2476fc8f8a49f60c538f7d4a53f43cd1c7f5bcbecd3ed
Instruction ID: c1c01372e2f8ecbf838a257cb68b6781e1a5b43bb6c7580a4f1f8788adb76725
Opcode Fuzzy Hash: 3d6319584adb544b58c2476fc8f8a49f60c538f7d4a53f43cd1c7f5bcbecd3ed
Instruction Fuzzy Hash: 5C315232608B9997E7608FA4F8407DEF760F794B54F508226EB8883B54DF78D698CB44

Function 000001845C4F7FA0 Relevance: 10.6, APIs: 7, Instructions: 71memoryfilepipeCOMMON

Download Yara Rule

APIs

PeekNamedPipe.KERNEL32 ref: 000001845C4F7FCF
VirtualAlloc.KERNEL32 ref: 000001845C4F7FFC
ReadFile.KERNEL32 ref: 000001845C4F8024
VirtualFree.KERNEL32 ref: 000001845C4F8047
FlushFileBuffers.KERNEL32 ref: 000001845C4F8051
GetLastError.KERNEL32 ref: 000001845C4F805B
GetLastError.KERNEL32 ref: 000001845C4F807D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: ErrorFileLastVirtual$AllocBuffersFlushFreeNamedPeekPipeRead
String ID:
API String ID: 1637252459-0
Opcode ID: 7caf67ba2c754cc6c7e94bd91c5a8169c82a3c47d0c13808e784c8b6e6b47a5f
Instruction ID: e1c0d42a47bb69554df49266af5f241abd5def3180e5487f8351703e3561ef67
Opcode Fuzzy Hash: 7caf67ba2c754cc6c7e94bd91c5a8169c82a3c47d0c13808e784c8b6e6b47a5f
Instruction Fuzzy Hash: 36215136304A5587E7208FA2F40069EF3A0F789BE5F488225DE4D47B54DF78D5958B18

Function 000001845C4E7E90 Relevance: 10.6, APIs: 7, Instructions: 69threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4E7EA0
ProcessIdToSessionId.KERNEL32 ref: 000001845C4E7EAD
WTSEnumerateSessionsW.WTSAPI32 ref: 000001845C4E7EDC
WTSQuerySessionInformationW.WTSAPI32 ref: 000001845C4E7F2D
WTSFreeMemory.WTSAPI32 ref: 000001845C4E7F52

Part of subcall function 000001845C4E76E0: memset.NTDLL ref: 000001845C4E7709
Part of subcall function 000001845C4E76E0: GetSystemDirectoryW.KERNEL32 ref: 000001845C4E771A
Part of subcall function 000001845C4E76E0: GetLastError.KERNEL32 ref: 000001845C4E7724
Part of subcall function 000001845C4E76E0: lstrcatW.KERNEL32 ref: 000001845C4E78FB

WTSFreeMemory.WTSAPI32 ref: 000001845C4E7F6A
CreateThread.KERNEL32 ref: 000001845C4E7F8C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeMemoryProcessSession$CreateCurrentDirectoryEnumerateErrorInformationLastQuerySessionsSystemThreadlstrcatmemset
String ID:
API String ID: 3188162108-0
Opcode ID: a0f1e4af9b35d422d03ebaa43e648843dcc74811eb2673a9a5bc5e68af15dc2a
Instruction ID: 0f5d1f2f89b9f584f77750c9495a8e917ae2141c8517d25c65ce40fcda1e3b5c
Opcode Fuzzy Hash: a0f1e4af9b35d422d03ebaa43e648843dcc74811eb2673a9a5bc5e68af15dc2a
Instruction Fuzzy Hash: 12315C32218B55D7D7508F61F88068FB7B1F388B94F94821AEB8A43B28DF38D655CB44

Function 000001845C4F0360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66processthreadinjectionCOMMON

Download Yara Rule

APIs

CreateProcessWithTokenW.ADVAPI32 ref: 000001845C4F03F4
GetLastError.KERNEL32 ref: 000001845C4F03FE
CloseHandle.KERNEL32 ref: 000001845C4F0410
CloseHandle.KERNEL32 ref: 000001845C4F0425
SuspendThread.KERNEL32 ref: 000001845C4F0434

Strings

h, xrefs: 000001845C4F03EC

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcessSuspendThreadTokenWith
String ID: h
API String ID: 1678065097-2439710439
Opcode ID: 34fa300228c636eaa0f0248c957d63175a617a8d2a4f03bc85cdcff5c74062eb
Instruction ID: cac6ec860a7db5146aa0228ea8147076769b5d805b2b14c0f58591c977d2ad08
Opcode Fuzzy Hash: 34fa300228c636eaa0f0248c957d63175a617a8d2a4f03bc85cdcff5c74062eb
Instruction Fuzzy Hash: DD314E33A18B9183E710CF91E4846AEB3A4F7D8B94F119226EA9803B15DFB9C5D4CB40

Function 000001845C4FD2A0 Relevance: 10.5, APIs: 7, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(?,?,00001000,000001845C4E24E2), ref: 000001845C4FD2B7
OpenServiceW.ADVAPI32(?,?,00001000,000001845C4E24E2), ref: 000001845C4FD2E6
GetLastError.KERNEL32(?,?,00001000,000001845C4E24E2), ref: 000001845C4FD2F4
CloseServiceHandle.ADVAPI32(?,?,00001000,000001845C4E24E2), ref: 000001845C4FD2FF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: OpenService$CloseErrorHandleLastManager
String ID:
API String ID: 2659350385-0
Opcode ID: be0d97674b5d01ddbad740662ad065086e858ccad381bdd0b1a3b9729ee50c89
Instruction ID: d01c5cb676d90ac7528ae45bfc1e62a0ac84dcf60144b00d2a340e9cb5c63b2a
Opcode Fuzzy Hash: be0d97674b5d01ddbad740662ad065086e858ccad381bdd0b1a3b9729ee50c89
Instruction Fuzzy Hash: 8A019E35714A0A83EF098FA6F9846AC92A1BB5CFD4F488135CE0A06711EE7CC6848B48

Function 000001845C503D80 Relevance: 10.5, APIs: 7, Instructions: 43threadnetworkCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C503D9D
EnterCriticalSection.KERNEL32 ref: 000001845C503DC2
send.WS2_32 ref: 000001845C503DD4
GetLastError.KERNEL32 ref: 000001845C503DDA
IsBadReadPtr.KERNEL32 ref: 000001845C503DEA
ExitThread.KERNEL32 ref: 000001845C503DF6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Read$CriticalEnterErrorExitLastSectionThreadsend
String ID:
API String ID: 4016372045-0
Opcode ID: d7c53ff00559cd01b286f1a6d6dd771ff59319f2d2823e378d410a2d7a4538d3
Instruction ID: c6a9d02a06c2d00e11b695d4eb797dd42b818c6ea7b72646f7cafb442fe3d628
Opcode Fuzzy Hash: d7c53ff00559cd01b286f1a6d6dd771ff59319f2d2823e378d410a2d7a4538d3
Instruction Fuzzy Hash: DD015E32324A6587D7449F61F84029DA360FB98F84F889126EF4A83B55CF39C955C784

Function 000001845C4E26B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4E26D2
GetSystemDirectoryW.KERNEL32 ref: 000001845C4E26E1
GetLastError.KERNEL32 ref: 000001845C4E26EB
lstrcatW.KERNEL32 ref: 000001845C4E26FD
VirtualFree.KERNEL32 ref: 000001845C4E2745

Strings

\svchost.exe -k netsvcs, xrefs: 000001845C4E26F1

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: DirectoryErrorFreeLastSystemVirtuallstrcatmemset
String ID: \svchost.exe -k netsvcs
API String ID: 1196864501-2993138014
Opcode ID: 4899bdc5faaa1a50a6070bd62f2c10f6be7ce4c39736347503a2d79e50c34c7c
Instruction ID: 5a1661f5af0cd8f08ce4847ce64d4970d24f4051e674d702db7a77b7d312e281
Opcode Fuzzy Hash: 4899bdc5faaa1a50a6070bd62f2c10f6be7ce4c39736347503a2d79e50c34c7c
Instruction Fuzzy Hash: 6001803121095A83EB20DF61E8547DEA361F795B54F408311DAAD436E9DF3CC349C748

Function 000001845C4EF2E0 Relevance: 10.1, APIs: 8, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4EF308
VirtualAlloc.KERNEL32 ref: 000001845C4EF32B
InitializeCriticalSection.KERNEL32 ref: 000001845C4EF33D
VirtualAlloc.KERNEL32 ref: 000001845C4EF362
VirtualAlloc.KERNEL32 ref: 000001845C4EF3B5
InitializeCriticalSection.KERNEL32 ref: 000001845C4EF3C7
VirtualFree.KERNEL32 ref: 000001845C4EF50E
VirtualFree.KERNEL32 ref: 000001845C4EF538

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$CriticalFreeInitializeSection
String ID:
API String ID: 2852478515-0
Opcode ID: 2ca86a1fc827d6d4b782268000abc3b1b2f9c80ad164c5e90495c9a43af317c5
Instruction ID: 4eb4edefc3cf701e8b4a8ca3e68f12cdb2ca65f78887cba2590c3f249fd1e1ff
Opcode Fuzzy Hash: 2ca86a1fc827d6d4b782268000abc3b1b2f9c80ad164c5e90495c9a43af317c5
Instruction Fuzzy Hash: 4C61E536201F41D7EB158F21E5807DD33A8FB09B44F95862ACA9D07768EF38C668C399

Function 000001845C513210 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 192COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C5132AD

Strings

lws_free, xrefs: 000001845C5134E9
raw, xrefs: 000001845C51326C
default, xrefs: 000001845C513277
lws_protocol_init_vhost, xrefs: 000001845C51324F
protocol %s failed init, xrefs: 000001845C513261

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memset
String ID: default$lws_free$lws_protocol_init_vhost$protocol %s failed init$raw
API String ID: 2221118986-224536676
Opcode ID: 3ca2b0dda705691ad3dfa99d16c899407311fd09951ce103c95fd508c95c4fdf
Instruction ID: c38578978c1842cea012f18f5b14a9c98bc2c95fc647e69e46e26f3d1a34e16d
Opcode Fuzzy Hash: 3ca2b0dda705691ad3dfa99d16c899407311fd09951ce103c95fd508c95c4fdf
Instruction Fuzzy Hash: A9919D76600BEA83EB698F92D0187EDB7A0F7A6B88F549216CF9943744DF35D611C308

Function 000001845C4E2910 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 143stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 000001845C4E2AF8

Strings

U:I:, xrefs: 000001845C4E2A0A
V:R:, xrefs: 000001845C4E2A00
V:_:, xrefs: 000001845C4E2954
_:B:, xrefs: 000001845C4E2A38
^:V:, xrefs: 000001845C4E29F5

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: lstrcmpi
String ID: U:I:$V:R:$V:_:$^:V:$_:B:
API String ID: 1586166983-194391922
Opcode ID: c37ba9e02582e707534a94e5af5016ab63ae1cbaf134c547084023abedeaea09
Instruction ID: 712c738359a5a1c45be75745e36351c2ab1b3242ec0b4494c5a6f49898cc714e
Opcode Fuzzy Hash: c37ba9e02582e707534a94e5af5016ab63ae1cbaf134c547084023abedeaea09
Instruction Fuzzy Hash: 05617933B04781CFF321CFB5C400AED3BB1E79A788F169619DE8466A49EE789655C344

Function 000001845C4FF2B0 Relevance: 9.1, APIs: 6, Instructions: 86memorystringCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4FF316
VirtualAlloc.KERNEL32 ref: 000001845C4FF356
NetUserSetInfo.NETAPI32 ref: 000001845C4FF390
VirtualFree.KERNEL32 ref: 000001845C4FF3A3
lstrcmpiW.KERNEL32 ref: 000001845C4FF3B8
VirtualFree.KERNEL32 ref: 000001845C4FF3CD

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree$InfoUserlstrcmpi
String ID:
API String ID: 4244901044-0
Opcode ID: 4bb39a4d54623631dae1162540759efd2fad283e37046eba1ed0997ae9d8ff27
Instruction ID: b1698ab126fe25a96d45fba1dba61ae8ad5e561dc90fbbf69a80cc2858243933
Opcode Fuzzy Hash: 4bb39a4d54623631dae1162540759efd2fad283e37046eba1ed0997ae9d8ff27
Instruction Fuzzy Hash: ED31D375314B5543FB148F62E84479EA7A1EB49FC1F448128DD4A83B98DFBCD649CB04

Function 000001845C4FE790 Relevance: 9.1, APIs: 6, Instructions: 72memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,00000000,00000000,000001845C4FEBC5), ref: 000001845C4FE7CD
GetDC.USER32 ref: 000001845C4FE827
CreateCompatibleBitmap.GDI32 ref: 000001845C4FE839
GetDIBits.GDI32 ref: 000001845C4FE85D
ReleaseDC.USER32 ref: 000001845C4FE868
DeleteObject.GDI32 ref: 000001845C4FE871

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: AllocBitmapBitsCompatibleCreateDeleteObjectReleaseVirtual
String ID:
API String ID: 1942853633-0
Opcode ID: d610f2210541b487ea599f3beb68992543fe9b84b09e2f87d6652d28e22b4989
Instruction ID: 98c59d93091d9eed0e4a93d3a7b08bdcd17b313ef8cad185dfe52055d2f46f95
Opcode Fuzzy Hash: d610f2210541b487ea599f3beb68992543fe9b84b09e2f87d6652d28e22b4989
Instruction Fuzzy Hash: 2C21DE72210B9587EB089F26B81425DBAA0FB89FD0F45862EDE4653B60CF38C1018B08

Function 000001845C4F7EB0 Relevance: 9.1, APIs: 6, Instructions: 56filesleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001845C4F7ED0
CreateFileW.KERNEL32 ref: 000001845C4F7EFF
GetLastError.KERNEL32 ref: 000001845C4F7F10
GetTickCount.KERNEL32 ref: 000001845C4F7F24
Sleep.KERNEL32 ref: 000001845C4F7F38
CreateFileW.KERNEL32 ref: 000001845C4F7F62

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CountCreateFileTick$ErrorLastSleep
String ID:
API String ID: 2478964991-0
Opcode ID: 44fd06d3c223e048c4d0489ead7cd8fe85b8e69849f9c6ee32731d4873113aa6
Instruction ID: dedbafb659897397ebc30922c3f665251df8f99f8427e5809956ecec19ba128d
Opcode Fuzzy Hash: 44fd06d3c223e048c4d0489ead7cd8fe85b8e69849f9c6ee32731d4873113aa6
Instruction Fuzzy Hash: 0C216A31204B5187F3608F60E84475EB6A0F388BB8F544721EAA943BD8CF3CCA45CB48

Function 000001845C4E0320 Relevance: 8.9, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 000001845C4E037C
free.MSVCRT ref: 000001845C4E03CC
free.MSVCRT ref: 000001845C4E041C
free.MSVCRT ref: 000001845C4E046C
free.MSVCRT ref: 000001845C4E049B
free.MSVCRT ref: 000001845C4E04BD
free.MSVCRT ref: 000001845C4E04FB

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 086ef2399a2b39805725e1e66e9ffec4bc1c65bc9c079221ec383ecf087ce0d7
Instruction ID: 25daf245f3fa1e2d5d7b4d4a5885b0c66eb2161192c14660b557197cccba95b1
Opcode Fuzzy Hash: 086ef2399a2b39805725e1e66e9ffec4bc1c65bc9c079221ec383ecf087ce0d7
Instruction Fuzzy Hash: AE513736202B59C3EB408F99E6807AC73A5F788F84F59C622CA5D03364DF74C6A2C315

Function 000001845C4ED990 Relevance: 8.9, APIs: 7, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4ED9B9
VirtualFree.KERNEL32 ref: 000001845C4EDA86
VirtualFree.KERNEL32 ref: 000001845C4EDAB0
CloseHandle.KERNEL32 ref: 000001845C4EDAC5
VirtualFree.KERNEL32 ref: 000001845C4EDAF8
VirtualFree.KERNEL32 ref: 000001845C4EDB22
VirtualFree.KERNEL32 ref: 000001845C4EDB37

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E442D
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E445F
Part of subcall function 000001845C4E4410: InitializeCriticalSection.KERNEL32 ref: 000001845C4E4474
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E4490
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E44A3
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E44BA
Part of subcall function 000001845C4E4410: LeaveCriticalSection.KERNEL32 ref: 000001845C4E44E9
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E44FE
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E4511
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E4528
Part of subcall function 000001845C4E4410: LeaveCriticalSection.KERNEL32 ref: 000001845C4E4557
Part of subcall function 000001845C4E4410: IsBadReadPtr.KERNEL32 ref: 000001845C4E456C
Part of subcall function 000001845C4E4410: EnterCriticalSection.KERNEL32 ref: 000001845C4E457F
Part of subcall function 000001845C4E4410: VirtualAlloc.KERNEL32 ref: 000001845C4E4596

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$Free$Leave$Initialize$CloseHandle
String ID:
API String ID: 1803526796-0
Opcode ID: 2389004f1622c871db37be869d3889ec8ed68640e4297f82caa4ce24a07498eb
Instruction ID: 42ef902c05b430c41ac76b11e393b06e52416f0e7058e47bc29f390ca43620bc
Opcode Fuzzy Hash: 2389004f1622c871db37be869d3889ec8ed68640e4297f82caa4ce24a07498eb
Instruction Fuzzy Hash: C8513931301F5287EB64CF52F49469EB3A8FB59B80F048225CB9A43BA4DF38C250C349

Function 000001845C504A90 Relevance: 8.8, APIs: 7, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001845C504ACD
EnterCriticalSection.KERNEL32 ref: 000001845C504B04
LeaveCriticalSection.KERNEL32 ref: 000001845C504B2D
LeaveCriticalSection.KERNEL32 ref: 000001845C504B54
EnterCriticalSection.KERNEL32 ref: 000001845C504B95
LeaveCriticalSection.KERNEL32 ref: 000001845C504BCE
LeaveCriticalSection.KERNEL32 ref: 000001845C504BE0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: f64cf19514c4a9b2708fe76cc4375897a169406fda7ea7ef4dfe89a5c2b49c5b
Instruction ID: 8a7ff6c76f249587da4f663bc0d76ec93547d6fc01d7cc797f87542622aefdb5
Opcode Fuzzy Hash: f64cf19514c4a9b2708fe76cc4375897a169406fda7ea7ef4dfe89a5c2b49c5b
Instruction Fuzzy Hash: FD417E36310A66C3E7108F61E80039EB3A5FB94F94F888226DE5A97754DF78CA05C788

Function 000001845C4E5973 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4E5973

Part of subcall function 000001845C4FCC60: CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4FCC76
Part of subcall function 000001845C4FCC60: malloc.MSVCRT ref: 000001845C4FCC84
Part of subcall function 000001845C4FCC60: Process32FirstW.KERNEL32 ref: 000001845C4FCCA2
Part of subcall function 000001845C4FCC60: free.MSVCRT ref: 000001845C4FCCB7
Part of subcall function 000001845C4FCC60: CloseHandle.KERNEL32(?,?,00000000,000001845C4F6D46), ref: 000001845C4FCCC5

Part of subcall function 000001845C4FD140: OpenSCManagerW.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD165
Part of subcall function 000001845C4FD140: EnumServicesStatusExW.ADVAPI32 ref: 000001845C4FD1B1
Part of subcall function 000001845C4FD140: malloc.MSVCRT ref: 000001845C4FD1C6
Part of subcall function 000001845C4FD140: memset.NTDLL ref: 000001845C4FD1DC
Part of subcall function 000001845C4FD140: EnumServicesStatusExW.ADVAPI32 ref: 000001845C4FD21B
Part of subcall function 000001845C4FD140: CloseServiceHandle.ADVAPI32(?,?,?,?,?,00000000,00001000,00000000,?,000001845C4E264E), ref: 000001845C4FD228
Part of subcall function 000001845C4FD140: free.MSVCRT ref: 000001845C4FD231

ExitProcess.KERNEL32 ref: 000001845C4E5998
VirtualFree.KERNEL32 ref: 000001845C4E5BA8
VirtualFree.KERNEL32 ref: 000001845C4E5BD2

Strings

Schedule, xrefs: 000001845C4E5980

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CloseEnumFreeHandleProcessServicesStatusVirtualfreemalloc$CreateCurrentExitFirstManagerOpenProcess32ServiceSnapshotToolhelp32memset
String ID: Schedule
API String ID: 2593299425-2739827629
Opcode ID: d2ede1c26b53fc35dc056e9d6b3441cc13192b8f0a26bde5ec17dc0c8f87d235
Instruction ID: 0ff8d722de702730b161c23f923254f9ebac40ddd2a296ef60eb3ee39c2f398e
Opcode Fuzzy Hash: d2ede1c26b53fc35dc056e9d6b3441cc13192b8f0a26bde5ec17dc0c8f87d235
Instruction Fuzzy Hash: FA01D631300B5283FB78AFB1E9907EDA260AB91B80F40C216CA8A027D1DE3CC285430D

Function 000001845C4E0720 Relevance: 7.7, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 000001845C4E07F2
memcpy.NTDLL ref: 000001845C4E0810
memcpy.NTDLL ref: 000001845C4E08F3

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b36940c9134db9debb5434aae0f74bffe43cbb9a5314d30aa24a6dee75e394a3
Instruction ID: dd593b2d9bfcac789202ae1b7e77c19b74a92308c3d2d29a30747c8b6bc5dc69
Opcode Fuzzy Hash: b36940c9134db9debb5434aae0f74bffe43cbb9a5314d30aa24a6dee75e394a3
Instruction Fuzzy Hash: 7561CD32200B81CBEB20CF26E544BAC77A4FB89B94F5A8625CE6D47B94EF34C640D745

Function 000001845C4F42A0 Relevance: 7.6, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F42F3
VirtualFree.KERNEL32 ref: 000001845C4F431D
VirtualAlloc.KERNEL32 ref: 000001845C4F4334
InitializeCriticalSection.KERNEL32 ref: 000001845C4F43BE
VirtualFree.KERNEL32 ref: 000001845C4F4443
VirtualFree.KERNEL32 ref: 000001845C4F446D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$InitializeLeave
String ID:
API String ID: 2124124174-0
Opcode ID: ce30a7c37a809ab6b36126a6c5df061884de53dfa42c463ff1a9a8109802fa83
Instruction ID: a8e427942c35cec85f2793ef9c5189df9fe1f9dee50e364628768ae85526dbf1
Opcode Fuzzy Hash: ce30a7c37a809ab6b36126a6c5df061884de53dfa42c463ff1a9a8109802fa83
Instruction Fuzzy Hash: 7C513B32311F5187EB64DF52E448A9DB3A8FB99B84F458225DE8E43B14EF38D254C744

Function 000001845C4FEF20 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4FC760: WTSEnumerateSessionsW.WTSAPI32 ref: 000001845C4FC79F

Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34EB
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E34FD
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3510
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3527
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3556
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3568
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E357B
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3592
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35C1
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E35D3
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35E6
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35FD
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E362C
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E363E
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3654

VirtualFree.KERNEL32 ref: 000001845C4FEFC4
VirtualFree.KERNEL32 ref: 000001845C4FEFEE
VirtualFree.KERNEL32 ref: 000001845C4FF026
VirtualFree.KERNEL32 ref: 000001845C4FF050

Strings

@, xrefs: 000001845C4FEF77

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterRead$Leave$Free$EnumerateInitializeSessions
String ID: @
API String ID: 3635408051-3454712805
Opcode ID: e5ffd8acee62a3162d13eb417bf543901fc6efb17b9c23c1632ba5cdd8a3b5f2
Instruction ID: fe2a1b11a244d2460e220219cc061c55bcb0dccc338f4f97a8c8c9840a149f08
Opcode Fuzzy Hash: e5ffd8acee62a3162d13eb417bf543901fc6efb17b9c23c1632ba5cdd8a3b5f2
Instruction Fuzzy Hash: 98316A32715B4187EB64DF23E594A6EB3A5FB89F80B048125DF8A43F24CF39D1668B44

Function 000001845C526140 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 000001845C52621D

Strings

lws_set_proxy, xrefs: 000001845C52624D
http_proxy needs to be ads:port, xrefs: 000001845C52623A
proxy auth too long, xrefs: 000001845C5261F0
http://, xrefs: 000001845C52617A

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: strchr
String ID: http://$http_proxy needs to be ads:port$lws_set_proxy$proxy auth too long
API String ID: 2830005266-175238664
Opcode ID: d1ab9b85537000d759f710dae04c861439685c4e7ab67b200bb48c131c9f798f
Instruction ID: 9f2d23f7384d2047ac6b813f2f486d51783b7fad88cd278b84496e990a2613f4
Opcode Fuzzy Hash: d1ab9b85537000d759f710dae04c861439685c4e7ab67b200bb48c131c9f798f
Instruction Fuzzy Hash: 3C31A5313047A687EA54DBA1E5503DEE390A765B84F848321DE8D0778AEF28C71AC348

Function 000001845C4E573B Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E57CB
VirtualFree.KERNEL32 ref: 000001845C4E57F5
VirtualFree.KERNEL32 ref: 000001845C4E5BA8
VirtualFree.KERNEL32 ref: 000001845C4E5BD2

Part of subcall function 000001845C4FBC20: memcpy.NTDLL ref: 000001845C4FBC45
Part of subcall function 000001845C4FBC20: memset.NTDLL ref: 000001845C4FBCDA
Part of subcall function 000001845C4FBC20: wsprintfW.USER32 ref: 000001845C4FBCF9
Part of subcall function 000001845C4FBC20: SetFileAttributesW.KERNEL32 ref: 000001845C4FBD09
Part of subcall function 000001845C4FBC20: DeleteFileW.KERNEL32 ref: 000001845C4FBD14
Part of subcall function 000001845C4FBC20: CreateFileW.KERNEL32 ref: 000001845C4FBD44
Part of subcall function 000001845C4FBC20: GetLastError.KERNEL32 ref: 000001845C4FBD53
Part of subcall function 000001845C4FBC20: SetFileAttributesW.KERNEL32 ref: 000001845C4FBDA0

Strings

18.139.89.40, xrefs: 000001845C4E57AF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$FileFree$EnterRead$AttributesLeave$CreateDeleteErrorInitializeLastmemcpymemsetwsprintf
String ID: 18.139.89.40
API String ID: 3047218378-3059993899
Opcode ID: 4748c9799fc4aab539902931fc7cd806f5684b6e31aa09dd6eb953e43b6e7f72
Instruction ID: a391221028da52a931ab5245a941d8779cb48e5165278a6034237c40aa5b18d1
Opcode Fuzzy Hash: 4748c9799fc4aab539902931fc7cd806f5684b6e31aa09dd6eb953e43b6e7f72
Instruction Fuzzy Hash: A3318432715A5183EB64DF63E454BAEA3A5FB9AF80F42C215DE8A03B54DE38C2858704

Function 000001845C4E3180 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 000001845C4E31D5
VirtualAlloc.KERNEL32 ref: 000001845C4E31F2
memcpy.NTDLL ref: 000001845C4E3221
memcpy.NTDLL ref: 000001845C4E3266

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memcpy$AllocVirtualceil
String ID:
API String ID: 311976409-0
Opcode ID: ed14ec51c383a9a13ba0ce0240a1051b4facac114c8e2550c0a0b869aba092f1
Instruction ID: e910bb324fda9891ad99681a985b866267f775c39579cf1d786137f05ab0db0b
Opcode Fuzzy Hash: ed14ec51c383a9a13ba0ce0240a1051b4facac114c8e2550c0a0b869aba092f1
Instruction Fuzzy Hash: 2831D631705A51C7EB498F56E64066CB3A0F795FC0F10C629EB59A3B44DF34E5718709

Function 000001845C4E5668 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4E5706
VirtualFree.KERNEL32 ref: 000001845C4E5730
VirtualFree.KERNEL32 ref: 000001845C4E5BA8
VirtualFree.KERNEL32 ref: 000001845C4E5BD2

Strings

18.139.89.40, xrefs: 000001845C4E56C2

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leave$Initialize
String ID: 18.139.89.40
API String ID: 696443088-3059993899
Opcode ID: 7078d51f2a842d056aef008d8b9e0584b22a38109fb0f17c7c38043e1d6e8ae5
Instruction ID: 95cc61d044d32f3f46f1d9e5549131e888fe6ea168b391ad97ffcfcc51993111
Opcode Fuzzy Hash: 7078d51f2a842d056aef008d8b9e0584b22a38109fb0f17c7c38043e1d6e8ae5
Instruction Fuzzy Hash: 1E317C36701B4183EB64DF52E558BAEA3A5FB96B80F41C205DE8603B54CF39C2848B44

Function 000001845C4ED880 Relevance: 7.6, APIs: 5, Instructions: 76memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

CreateThread.KERNEL32 ref: 000001845C4ED907
IsBadReadPtr.KERNEL32 ref: 000001845C4ED928
EnterCriticalSection.KERNEL32 ref: 000001845C4ED93B
VirtualAlloc.KERNEL32 ref: 000001845C4ED952
LeaveCriticalSection.KERNEL32 ref: 000001845C4ED976

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocVirtual$EnterRead$Leave$CreateInitializeThread
String ID:
API String ID: 986707815-0
Opcode ID: 13fe9d48963e991135e2c963f540b907288d56d1b03b0de4579185a6b58a6942
Instruction ID: 1e259b2579f232f141b4b700cbbbef7d9d55310bfd01888a2678eaa85867c06a
Opcode Fuzzy Hash: 13fe9d48963e991135e2c963f540b907288d56d1b03b0de4579185a6b58a6942
Instruction Fuzzy Hash: DB317F72310B5187EB189F62E80429DB7A4FB89FD4F888125DE4A47B64DF3CC655C744

Function 000001845C4EDB60 Relevance: 7.6, APIs: 5, Instructions: 57stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000001845C4EDB85
lstrcatW.KERNEL32 ref: 000001845C4EDBAC

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4EC850: memset.NTDLL ref: 000001845C4EC895
Part of subcall function 000001845C4EC850: lstrcatW.KERNEL32 ref: 000001845C4EC8A4
Part of subcall function 000001845C4EC850: lstrcatW.KERNEL32 ref: 000001845C4EC8B8
Part of subcall function 000001845C4EC850: memset.NTDLL ref: 000001845C4EC8CB
Part of subcall function 000001845C4EC850: FindFirstFileW.KERNEL32 ref: 000001845C4EC8DC
Part of subcall function 000001845C4EC850: FindNextFileW.KERNEL32 ref: 000001845C4EC935
Part of subcall function 000001845C4EC850: FindNextFileW.KERNEL32 ref: 000001845C4EC999

VirtualFree.KERNEL32 ref: 000001845C4EDBF3
VirtualFree.KERNEL32 ref: 000001845C4EDC1D
free.MSVCRT ref: 000001845C4EDC26

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterFileFindReadlstrcat$FreeLeaveNextmemset$FirstInitializefreemalloc
String ID:
API String ID: 2817660952-0
Opcode ID: e62f3b6bb31d4131cbf3e8879ad1a17dd29e8ffe2323acf7510d4be1f2a2089e
Instruction ID: b48555a1e507ca90de4ff69cd7640c4b4d7d15249ca8b55e30fdcf33e6bd1bbb
Opcode Fuzzy Hash: e62f3b6bb31d4131cbf3e8879ad1a17dd29e8ffe2323acf7510d4be1f2a2089e
Instruction Fuzzy Hash: 4721C031311A9187EB58DF53E85469EA364F789FC0F89C125DE8A47B18CE3CC2458784

Function 000000018002B9A8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002B9D0
_set_statfp.LIBCMT ref: 000000018002B9EB
_set_statfp.LIBCMT ref: 000000018002BA07
_set_statfp.LIBCMT ref: 000000018002BA43

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 3b9bd57b40fff3d8961f464b14179896b260d9c17b5d0c480fa0c6cf32fa7499
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: CB117732690A4D01F7E72129D4553F93340AB6D3F4F45C634BA76976D6CE248BC94302

Function 000001845BF5ADA8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001845BF5ADD0
_set_statfp.LIBCMT ref: 000001845BF5ADEB
_set_statfp.LIBCMT ref: 000001845BF5AE07
_set_statfp.LIBCMT ref: 000001845BF5AE43

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction ID: 7b68062c370480586a6b508ff13b72486563f8fde28c0239a908538b01f45b2f
Opcode Fuzzy Hash: a2ede21bcdb1ffc6f849cceea62f3b27e54c7ac4f1c2c35b27aa84f998c663a0
Instruction Fuzzy Hash: 8B11A333A54E0313F7641125E8513ED10C06B59374F18C62DAAF6866DACF388AE24F28

Function 000001845C4F3810 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000001845C4F3832
CloseHandle.KERNEL32 ref: 000001845C4F3840
WaitForSingleObject.KERNEL32 ref: 000001845C4F384F
GetCurrentProcess.KERNEL32 ref: 000001845C4F3859
TerminateProcess.KERNEL32 ref: 000001845C4F3864

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleObjectSingleTerminateThreadWait
String ID:
API String ID: 603326088-0
Opcode ID: 7c3f9b570a8332205efd3d9421a3c14b2d654208f283a85a9c5ac44cbca20012
Instruction ID: e8a733c98860d828c4e881522a557ab8aec600fba57fa482a208463610fd1cd6
Opcode Fuzzy Hash: 7c3f9b570a8332205efd3d9421a3c14b2d654208f283a85a9c5ac44cbca20012
Instruction Fuzzy Hash: 40F0827271160683EB18CFB2AC043AE63E1BB9DF58F48C6258C1987350EF3CC2418368

Function 000001845C5127A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C51281C
_unlink.MSVCRT ref: 000001845C512A30
memset.NTDLL ref: 000001845C512A77

Strings

lws_free, xrefs: 000001845C512945, 000001845C512988, 000001845C51299D, 000001845C5129D0, 000001845C512A7C

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memset$_unlink
String ID: lws_free
API String ID: 1884818752-2419506585
Opcode ID: f671c1c9dc5f9f1ecd93fd6c90e8a55de8e0b5723c060ba0bceb813fd88c5dd0
Instruction ID: 961f78dc67d522834d6e4e051e95b36232c01d273b4c17b1e012325992ba1541
Opcode Fuzzy Hash: f671c1c9dc5f9f1ecd93fd6c90e8a55de8e0b5723c060ba0bceb813fd88c5dd0
Instruction Fuzzy Hash: 0F815F32201B9A97EB558F65D8583EDA3A0F794F88F988636DE8D17394DF38C641C318

Function 000000018001F660 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001F698
_invalid_parameter_noinfo.LIBCMT ref: 000000018001F8D2

Strings

ko-KR, xrefs: 000000018001F6B7
*, xrefs: 000000018001F7A5

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: 247b425bc4075f99800c1718c7ffe54540729addd1f222e63731e205efc231c0
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: B0718F72504E58C6E7FA9F2980443BC3BA0F34DBD8F649216EA4646399DF31CA8AC750

Function 000001845BF4EA60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF4EA98
_invalid_parameter_noinfo.LIBCMT ref: 000001845BF4ECD2

Strings

ko-KR, xrefs: 000001845BF4EAB7
*, xrefs: 000001845BF4EBA5

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$ko-KR
API String ID: 3215553584-1095117856
Opcode ID: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction ID: f16193010dff068c7ed84621fe4ca362c5b18af2dab87b3d1b5dacbfb3e3261e
Opcode Fuzzy Hash: 86bec7efc410530c5bc9a2fbb52b1d77945cde645c424444667ef471f83eee53
Instruction Fuzzy Hash: 47718E7350465287E76CDF288144ABE3BA0F309B58F249226DBC6C2299DF71CA82DF55

Function 000001845C516000 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C516058
_time64.MSVCRT ref: 000001845C5160AC

Strings

%s: calling service, xrefs: 000001845C5160E7
__lws_header_table_reset, xrefs: 000001845C5160D9

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: _time64memset
String ID: %s: calling service$__lws_header_table_reset
API String ID: 899224009-1639372703
Opcode ID: a9f15bdc1dc03cd649ae2c0efe04c1451751ae562199952308a362106ea05dd7
Instruction ID: 93a65627a9c360136896e09135f0ea258f8ed4bf1bb53ee7a0b0ea1bd9c3b330
Opcode Fuzzy Hash: a9f15bdc1dc03cd649ae2c0efe04c1451751ae562199952308a362106ea05dd7
Instruction Fuzzy Hash: 8931CD32A00BC583E745CF21D5803ECA764F7A9F48F589236AF980B29ADF34D2A1C314

Function 000001845C4E2EA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 000001845C4E2EC7
GetLastError.KERNEL32 ref: 000001845C4E2F3F
SysAllocString.OLEAUT32 ref: 000001845C4E2F5D

Strings

\Microsoft\Windows, xrefs: 000001845C4E2F56

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: AllocErrorInitLastStringVariant
String ID: \Microsoft\Windows
API String ID: 3210815728-1732172413
Opcode ID: 599da941f33650f59f8f3f7e0017e75b387ef8ec1697d5cd213f2b80ee50dc4f
Instruction ID: af6746e59624137da2ee34cee92c03131493390368ff673fb739a5d9955add89
Opcode Fuzzy Hash: 599da941f33650f59f8f3f7e0017e75b387ef8ec1697d5cd213f2b80ee50dc4f
Instruction Fuzzy Hash: 70212C22A18FC983D7218F65F4043EEA371FBE9B94F449312EA8952619EF39C185CB00

Function 000001845C4F5EB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 000001845C4F5EF8
VirtualFree.KERNEL32 ref: 000001845C4F5F0E
VirtualFree.KERNEL32 ref: 000001845C4F5F44

Strings

boom..., xrefs: 000001845C4F5EEC

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: FreeVirtual$Message
String ID: boom...
API String ID: 3815264287-1338744694
Opcode ID: 38ffc653ece4430fce8646697b0d6fa537691b56c7ca04926ed4d985620e0bfa
Instruction ID: 2d1b95ced4d00adeb8fb56d451ecaee6b362fc4598eabfc0c3ae258d53673476
Opcode Fuzzy Hash: 38ffc653ece4430fce8646697b0d6fa537691b56c7ca04926ed4d985620e0bfa
Instruction Fuzzy Hash: 0211AD32714B4083FB649F62E8543AEA3A1FBADF48F44D215DA8A06658EF3DC2C4C744

Function 000001845C507F50 Relevance: 6.5, APIs: 5, Instructions: 299COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,00000000,000001845C509458,?,00000000,?,000001845C506506), ref: 000001845C50808C
memcpy.NTDLL ref: 000001845C508111
memcpy.NTDLL(?,?,00000000,000001845C509458,?,00000000,?,000001845C506506), ref: 000001845C50814D
memcpy.NTDLL(?,?,00000000,000001845C509458,?,00000000,?,000001845C506506), ref: 000001845C508189
memcpy.NTDLL(?,?,00000000,000001845C509458,?,00000000,?,000001845C506506), ref: 000001845C50823D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: f3cc9281a8ca6978993dbb056fb31bd63bef0cb429795cc02bd43722efd32982
Instruction ID: 6e2f8722be242c9693fde34e80ae3bcb337e74a725c9c68e32019f628c3beee6
Opcode Fuzzy Hash: f3cc9281a8ca6978993dbb056fb31bd63bef0cb429795cc02bd43722efd32982
Instruction Fuzzy Hash: CAD16C32704A699BDB18DF69C680BEDB7A1F798B84F108219CB1A93751DF30E971CB44

Function 000001845C4ECBD0 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 000001845C4ECBFA

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4ECC35
VirtualFree.KERNEL32 ref: 000001845C4ECC5F
VirtualFree.KERNEL32 ref: 000001845C4ECC89
VirtualFree.KERNEL32 ref: 000001845C4ECCB3

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leave$Initializememset
String ID:
API String ID: 3460648485-0
Opcode ID: 2e3307218b09c89e9c461952443fd9212c3d484f2fdb84382dce19c2a9132c91
Instruction ID: 4b4f2f0c69269e69e380a2e8796ecb7daf7cbb273a8b84d6c7038131b7cc48a1
Opcode Fuzzy Hash: 2e3307218b09c89e9c461952443fd9212c3d484f2fdb84382dce19c2a9132c91
Instruction Fuzzy Hash: EA317632315B1183EB68DFA7E5546AEA3A1FB89F80F48C125CF8A43B54CF38D2258745

Function 000001845C50CEC0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 315COMMON

Download Yara Rule

Strings

lws_free, xrefs: 000001845C50D37E
ctx destroy, xrefs: 000001845C50CFE7
free, xrefs: 000001845C50D31D

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID:
String ID: ctx destroy$free$lws_free
API String ID: 0-48050916
Opcode ID: c79e9a5b3c5bd1239040c7372c3514e6a6eb692877582e33914cb575e8c015d2
Instruction ID: 6c38439df13aa206ad39362956e5cd5a9ab1febe43f32c77d95b2d5721cd5529
Opcode Fuzzy Hash: c79e9a5b3c5bd1239040c7372c3514e6a6eb692877582e33914cb575e8c015d2
Instruction Fuzzy Hash: 27D1223A3007AA83EA5C9FA185543EDE7A0F765B88F44C225CF5993386DF38D652C748

Function 0000000180017B98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_2, xrefs: 0000000180017D34
__swift_1, xrefs: 0000000180017D10

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: e36f902788c0381efdc077c6dc949100de42eee437ea8b415927d241f746463c
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: CF618E32300A8882EF96DB29E5447E963A1FB4CBD4F488525EF6D4779ADF38D645C340

Function 000001845BF46F98 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

__swift_2, xrefs: 000001845BF47134
__swift_1, xrefs: 000001845BF47110

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: __swift_1$__swift_2
API String ID: 0-2914474356
Opcode ID: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction ID: eedcba72b94e8455cf12a778523fd45130f16c321118e2a38ffc4f48c2386725
Opcode Fuzzy Hash: 032175703d403af43845841e7270c54589e151d9aabe520c8013fad0eb530d90
Instruction Fuzzy Hash: 0C617833300B4283EE14DF29E94479DB3A1FB85B94F4885259FA987B99DF38D681CB40

Function 000001845C4FDE70 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

WaitForMultipleObjects.KERNEL32 ref: 000001845C4FDEC1
WaitForMultipleObjects.KERNEL32 ref: 000001845C4FDF8D
VirtualFree.KERNEL32 ref: 000001845C4FDFCC
VirtualFree.KERNEL32 ref: 000001845C4FDFF6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeaveMultipleObjectsWait$Initialize
String ID:
API String ID: 1197094596-0
Opcode ID: a128fd323118e7b58d08c31b868d147948c3dda6663b584a6b7ab4b22ceeec38
Instruction ID: 46d03c28b81d713b62dc0ee3c19c2ea336c73226b8fd242c926eefdebbd266bb
Opcode Fuzzy Hash: a128fd323118e7b58d08c31b868d147948c3dda6663b584a6b7ab4b22ceeec38
Instruction Fuzzy Hash: 3A419372714B8183E764CF22E444B9EB3A1FB8AF84F449225DE4A43B58DF39D585CB44

Function 000001845C4FF080 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4FF0A4
ProcessIdToSessionId.KERNEL32 ref: 000001845C4FF0B1

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4FF164
VirtualFree.KERNEL32 ref: 000001845C4FF18E

Part of subcall function 000001845C4E6F60: GetCurrentProcessId.KERNEL32 ref: 000001845C4E6FDB
Part of subcall function 000001845C4E6F60: ProcessIdToSessionId.KERNEL32 ref: 000001845C4E6FEB
Part of subcall function 000001845C4E6F60: CreateToolhelp32Snapshot.KERNEL32 ref: 000001845C4E7014
Part of subcall function 000001845C4E6F60: GetProcessHeap.KERNEL32 ref: 000001845C4E7023
Part of subcall function 000001845C4E6F60: HeapAlloc.KERNEL32 ref: 000001845C4E7036
Part of subcall function 000001845C4E6F60: CloseHandle.KERNEL32 ref: 000001845C4E7047
Part of subcall function 000001845C4E6F60: WTSGetActiveConsoleSessionId.KERNEL32 ref: 000001845C4E7056
Part of subcall function 000001845C4E6F60: VirtualFree.KERNEL32 ref: 000001845C4E71B6
Part of subcall function 000001845C4E6F60: VirtualFree.KERNEL32 ref: 000001845C4E71E0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$Process$Free$EnterReadSession$CurrentHeapLeave$ActiveCloseConsoleCreateHandleInitializeSnapshotToolhelp32
String ID:
API String ID: 1320018004-0
Opcode ID: 219dca6d74f5f01e876d51951d5a85646c7e832a6bf75ab04d447e85a6392336
Instruction ID: 7420d9b516cc9deb25acfb55635c1f6d44fa2edc544d09a0e64d928ddb7144fa
Opcode Fuzzy Hash: 219dca6d74f5f01e876d51951d5a85646c7e832a6bf75ab04d447e85a6392336
Instruction Fuzzy Hash: 81318076320B9183FB64DF22E95069D73A0FB89F84F449225EE4A43B58DF38D944CB44

Function 000001845C4FDA00 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

SetEvent.KERNEL32 ref: 000001845C4FDB49
CloseHandle.KERNEL32 ref: 000001845C4FDB58
ResetEvent.KERNEL32 ref: 000001845C4FDB66
VirtualFree.KERNEL32 ref: 000001845C4FDB85

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSectionVirtual$Alloc$EnterRead$EventLeave$CloseFreeHandleInitializeReset
String ID:
API String ID: 4208512464-0
Opcode ID: ca07846258ba37867d244566e482efccc0d3ec0fcc94a16ac108a6f4784184ef
Instruction ID: 6705fd6d2a8541dd6c27418da88626eb42734a23867f9b9124a49dacb94b8bd2
Opcode Fuzzy Hash: ca07846258ba37867d244566e482efccc0d3ec0fcc94a16ac108a6f4784184ef
Instruction Fuzzy Hash: 78318F36314B4183EB58CF62E89466DA7A1FB89F80F098225DF4A43B59CF38D151C708

Function 000001845C4F35C0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001845C4F35DD
ProcessIdToSessionId.KERNEL32 ref: 000001845C4F35EA

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F367E
VirtualFree.KERNEL32 ref: 000001845C4F36A8

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeaveProcess$CurrentInitializeSession
String ID:
API String ID: 3327369976-0
Opcode ID: f98e4ae98b7e11fca3d4a9eee25e402cb3ff29b46a0d4ad6d7052e7fc59a9eec
Instruction ID: 7196dadce2c0905dc7dad1aea6b02bc194bb81c3b001215d31666647237d63d3
Opcode Fuzzy Hash: f98e4ae98b7e11fca3d4a9eee25e402cb3ff29b46a0d4ad6d7052e7fc59a9eec
Instruction Fuzzy Hash: CC316932714B5587EB24DF66E44465EB3A0FB88F80F54822AEB8A43B18DF3DD645CB44

Function 000001845C4E2FC0 Relevance: 6.1, APIs: 4, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 000001845C4E2FF0
VirtualAlloc.KERNEL32 ref: 000001845C4E3022
memcpy.NTDLL ref: 000001845C4E3066
VirtualFree.KERNEL32 ref: 000001845C4E3076

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocFreeceilmemcpy
String ID:
API String ID: 941304502-0
Opcode ID: b42a51ca5293a3dee87d5691d064886e3cec9dc4675c393a7935541609b8591d
Instruction ID: 03d8d04eefa4f88c2af919b14a714cbbbcc34e481a278beb3efaa3deaa601ccb
Opcode Fuzzy Hash: b42a51ca5293a3dee87d5691d064886e3cec9dc4675c393a7935541609b8591d
Instruction Fuzzy Hash: 1D212832714A50CBDB55DF3AF45069DA361EBC9F84F19D221EA0A9374DCE38C9818B48

Function 000001845C4FA710 Relevance: 6.1, APIs: 4, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

CreateThread.KERNEL32 ref: 000001845C4FA782
CloseHandle.KERNEL32 ref: 000001845C4FA790
VirtualFree.KERNEL32 ref: 000001845C4FA7AC
VirtualFree.KERNEL32 ref: 000001845C4FA7D6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeave$CloseCreateHandleInitializeThread
String ID:
API String ID: 4031785131-0
Opcode ID: 46f8680c48a87c550885bc35dd8c9f8526c11e3e393dc63d790dd5bf2b061a43
Instruction ID: d141c33c1d52ef5d229e11d6843b61b1bf05e92c2042a35a69b650b747ac969b
Opcode Fuzzy Hash: 46f8680c48a87c550885bc35dd8c9f8526c11e3e393dc63d790dd5bf2b061a43
Instruction Fuzzy Hash: 90213A76704A5183EB28DF63E45465EA3A1FB8EFD0F448129DF8A43B18DF38D2558744

Function 000001845C4F6140 Relevance: 6.1, APIs: 4, Instructions: 52threadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F6188
VirtualFree.KERNEL32 ref: 000001845C4F61B2
CreateThread.KERNEL32 ref: 000001845C4F61CF
CloseHandle.KERNEL32 ref: 000001845C4F61DD

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$EnterRead$FreeLeave$CloseCreateHandleInitializeThread
String ID:
API String ID: 4031785131-0
Opcode ID: 9906d6a9ce0f7f254b3389b28713ac5881b4f0dc512eb4610b511277353699d5
Instruction ID: 510e9499f5cc28d9af2dbd49f79e28911d199451cf4eadb52fad4193c3bd6a31
Opcode Fuzzy Hash: 9906d6a9ce0f7f254b3389b28713ac5881b4f0dc512eb4610b511277353699d5
Instruction Fuzzy Hash: 30118F32715B5283EB18CFA3E64469EA3A1FB89FC0F48C225CB4A43B54DF38D2618744

Function 000001845C505340 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 000001845C505368
WaitForSingleObject.KERNEL32 ref: 000001845C505389
SetEvent.KERNEL32 ref: 000001845C5053A9
SetEvent.KERNEL32 ref: 000001845C5053C0

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Event$ObjectSingleWait
String ID:
API String ID: 2127046782-0
Opcode ID: de6cca13531ef7be6a56a105a458a4c89b63c3fe75a489721cd85d5858837fa3
Instruction ID: d171baca4dfdd28b7a0fb397c1e9a91fbc1745542710ced2c475a9aeb32a851d
Opcode Fuzzy Hash: de6cca13531ef7be6a56a105a458a4c89b63c3fe75a489721cd85d5858837fa3
Instruction Fuzzy Hash: 7E01887171455DC3DBA58F66F98469DA3E0F7E8FD0F888215CA0987758DD34C9888708

Function 000001845C4F2FB0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCursorInfo.USER32 ref: 000001845C4F2FD5
GetCursorPos.USER32 ref: 000001845C4F2FE2
GetTickCount.KERNEL32 ref: 000001845C4F2FE8
OpenProcess.KERNEL32 ref: 000001845C4F3011

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Cursor$CountInfoOpenProcessTick
String ID:
API String ID: 1051838312-0
Opcode ID: 367ce5d8dd7bc755535d42e0695e3db5e97519ce22b5c81c9f6c4a96f8940a8e
Instruction ID: c08fd90f93898ae8ac595b90b36deeb78f2546420467600c66ceae41a3f07c27
Opcode Fuzzy Hash: 367ce5d8dd7bc755535d42e0695e3db5e97519ce22b5c81c9f6c4a96f8940a8e
Instruction Fuzzy Hash: D4F0A472610A4A83E7049F71E8042ADB3A1FBA5B4DF448326C64A06755EF38C6D4CB88

Function 000001845BF41C08 Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

SleepConditionVariableCS, xrefs: 000001845BF41E8E
InitializeConditionVariable, xrefs: 000001845BF41E2E
WakeAllConditionVariable, xrefs: 000001845BF41ECE
h-l1-2-0.dll, xrefs: 000001845BF41DEE

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$h-l1-2-0.dll
API String ID: 0-1747795296
Opcode ID: 0f20d8eddffe02f4355215346de876ec0be27590aef8c60f560b2699b0830f65
Instruction ID: a2a64c9656dbf3ac80e007cf1625033fad391ae153a40853377359a67ab715bb
Opcode Fuzzy Hash: 0f20d8eddffe02f4355215346de876ec0be27590aef8c60f560b2699b0830f65
Instruction Fuzzy Hash: 0DE15B73301B4693EF14EB2DD54029C27A0F745FA0F848129DA9D977A2DF38CAA5CB80

Function 0000000180023FE4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024027

Strings

o-l1-2-1, xrefs: 00000001800240CC
gfff, xrefs: 0000000180024149

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 4e08fe91d50fd43471445e9309ac5ad4362738dffbe45d8770cad9fb3b789804
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: 5951F4737147C886E7A78B35E9413997B91E399BD0F48D221EB944BAD6CE38C698C700

Function 000001845BF533E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF53427

Strings

o-l1-2-1, xrefs: 000001845BF534CC
gfff, xrefs: 000001845BF53549

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfff$o-l1-2-1
API String ID: 3215553584-1082851355
Opcode ID: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction ID: 35f44d6248e26576cf52ff3a087703af49e5567ca7485271ac6f2982216cf897
Opcode Fuzzy Hash: 12dcbdbdd5235fb1b6ab94a0cc892e5fb23d71a1fe9ba5ecef1039a303d64847
Instruction Fuzzy Hash: CC5115737147C687E7258F29A94139DAB91E381B90F48E225D7D987AD6CF38D644CB00

Function 0000000180024430 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018002459E

Strings

synch-l1-2-0, xrefs: 00000001800244A4
api-ms-win-core-sysinfo-l1-2-1, xrefs: 00000001800244D1

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: 9d4985de47fc3aa1ddc341b920f7898ed377652abc42465d74999370fa1411ca
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: 86418E72705F888AE782CF65E8507CE73A5F7193C8F518126EA9807B99DF38C629C340

Function 000001845BF53830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001845BF5399E

Strings

synch-l1-2-0, xrefs: 000001845BF538A4
api-ms-win-core-sysinfo-l1-2-1, xrefs: 000001845BF538D1

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: api-ms-win-core-sysinfo-l1-2-1$synch-l1-2-0
API String ID: 3215553584-688204690
Opcode ID: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction ID: fcc4e98753c76f204dac5035a5fdf26dc6fcf29de7bff09a069ead2da3181eff
Opcode Fuzzy Hash: 0f102de843e7ec0c7a5e751bb160ca61ca373fda3eee5e3f3a8aa3db407457e4
Instruction Fuzzy Hash: CD416873A01B459BE700CF25E8417DD33E5E719388F40C626AA9987B98DF39C625CB84

Function 000000018001D646 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000000018001C478: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000000018001C47C

__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D66E
__DestructExceptionObject.LIBVCRUNTIME ref: 000000018001D6F8

Strings

csm, xrefs: 000000018001D6CB

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 011c5e600e2baba1b5aebe761702f78806dc8dec4a9d5acc90072a234146c346
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: 40212D76204A4887E7B2DF15E05079E7760F39DBE4F008206EEA943795CF39DA8ACB01

Function 000001845BF4CA46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 000001845BF4B878: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 000001845BF4B87C

__DestructExceptionObject.LIBVCRUNTIME ref: 000001845BF4CA6E
__DestructExceptionObject.LIBVCRUNTIME ref: 000001845BF4CAF8

Strings

csm, xrefs: 000001845BF4CACB

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: DestructExceptionObject$__vcrt_getptd_noexit
String ID: csm
API String ID: 3780691363-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 68cf5074ba69b881289d54ed96a6c5298438dc51312a792323b2b4b7cd58f0c1
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: BB21283760464287E631DF16E05039EB760F388BA9F408211DED983BA5DF39DA86CF11

Function 000001845C4EA9A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetRawInputData.USER32 ref: 000001845C4EA9EC

Part of subcall function 000001845C4E9EC0: __chkstk.NTDLL ref: 000001845C4E9ED2
Part of subcall function 000001845C4E9EC0: lstrlenW.KERNEL32 ref: 000001845C4E9EEB
Part of subcall function 000001845C4E9EC0: memset.NTDLL ref: 000001845C4E9F13
Part of subcall function 000001845C4E9EC0: memset.NTDLL ref: 000001845C4E9F33
Part of subcall function 000001845C4E9EC0: GetForegroundWindow.USER32 ref: 000001845C4E9F38
Part of subcall function 000001845C4E9EC0: GetWindowTextW.USER32 ref: 000001845C4E9F53
Part of subcall function 000001845C4E9EC0: GetWindowThreadProcessId.USER32 ref: 000001845C4E9F67
Part of subcall function 000001845C4E9EC0: ProcessIdToSessionId.KERNEL32 ref: 000001845C4E9F90
Part of subcall function 000001845C4E9EC0: memset.NTDLL ref: 000001845C4E9FA5
Part of subcall function 000001845C4E9EC0: lstrlenW.KERNEL32 ref: 000001845C4E9FC3
Part of subcall function 000001845C4E9EC0: GetLocalTime.KERNEL32 ref: 000001845C4E9FD6
Part of subcall function 000001845C4E9EC0: wsprintfW.USER32 ref: 000001845C4EA03E
Part of subcall function 000001845C4E9EC0: lstrlenW.KERNEL32 ref: 000001845C4EA04B
Part of subcall function 000001845C4E9EC0: lstrlenA.KERNEL32 ref: 000001845C4EA091
Part of subcall function 000001845C4E9EC0: MultiByteToWideChar.KERNEL32 ref: 000001845C4EA0AA

DefWindowProcW.USER32 ref: 000001845C4EAA2A

Strings

0, xrefs: 000001845C4EA9CF

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Windowlstrlen$memset$Process$ByteCharDataForegroundInputLocalMultiProcSessionTextThreadTimeWide__chkstkwsprintf
String ID: 0
API String ID: 780575994-4108050209
Opcode ID: 8004b3049ace1bb0400474f1a69768e4362440f1312b9a8d3f505a6f2555652d
Instruction ID: 9f6b42212236260f1e306e0f24ef2dbb705a372d8fadfbebe11887c0835667bb
Opcode Fuzzy Hash: 8004b3049ace1bb0400474f1a69768e4362440f1312b9a8d3f505a6f2555652d
Instruction Fuzzy Hash: BB01AD316142A6C3F6108F61E6087EEAAA0F7A1B94F548321EE8003AD9CF38C640CB85

Function 000000018001A972 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000018001A99B

Strings

nt delete closure', xrefs: 000000018001A9A0
`vector destructor iterator', xrefs: 000000018001A980

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: c8ada3eb98077b3e77d28a4839308a809c4d6d91d1a7368aad5ed78790c858ba
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 9EE01AB1200B0490DB068F65E8513E873A4EB4CB90F48C032AA5C47354EF38C6A9C301

Function 000001845BF49D72 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001845BF49D9B

Strings

`vector destructor iterator', xrefs: 000001845BF49D80
nt delete closure', xrefs: 000001845BF49DA0

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector destructor iterator'$nt delete closure'
API String ID: 592178966-1611991873
Opcode ID: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction ID: 3043ecb2c8399d8b9c14b74e94f74efd8f5ba6a037f6f9b56c79e4a541fbf60e
Opcode Fuzzy Hash: 180211b27f776a29354646e6639c5d344605f4a19a09db6ac079198205e274bc
Instruction Fuzzy Hash: 59E04F73200B0092DF158F55F8501EC73A4EB4CB50B48D0229A9C87355EF38C6E9C704

Function 000000018001AA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000018001AA55
_CxxThrowException.LIBVCRUNTIME ref: 000000018001AA66

Strings

File, xrefs: 000000018001AA5A

Memory Dump Source

Source File: 00000002.00000002.2924508884.0000000180001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000002.00000002.2924420756.0000000180000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924902224.0000000180119000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2924991283.000000018011D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2925086635.0000000180121000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 9145d171dbcecb2188c45693134888adfda474ee1ae56853841174419c243042
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 49C08C3221488D91EB62EB10E8917DA5330B7A8384F818111F19C824B69F1CC30ECB00

Function 000001845BF49E4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000001845BF49E55
_CxxThrowException.LIBVCRUNTIME ref: 000001845BF49E66

Strings

File, xrefs: 000001845BF49E5A

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: File
API String ID: 932687459-749574446
Opcode ID: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction ID: 4ee1287ad15bde44113e449cd526210951ad5c3771337bd71063dc856ee1dd59
Opcode Fuzzy Hash: 5cc107604c7e858ffc48b5ed233f99d9330b9e91bd1076a405a7e456ecbb9fc9
Instruction Fuzzy Hash: 8EC04C7321458797DA20EB15D8921DD6331B7A8344F908551A2DD829B7DF19C719CF00

Function 000001845C4EC6E0 Relevance: 5.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34EB
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E34FD
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3510
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3527
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3556
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3568
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E357B
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3592
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35C1
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E35D3
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35E6
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E35FD
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E362C
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E363E
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3654

VirtualFree.KERNEL32 ref: 000001845C4EC7B5
VirtualFree.KERNEL32 ref: 000001845C4EC7DF
VirtualFree.KERNEL32 ref: 000001845C4EC7F5
VirtualFree.KERNEL32 ref: 000001845C4EC81F

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Virtual$Alloc$EnterRead$Leave$Free$Initialize
String ID:
API String ID: 3420869360-0
Opcode ID: 617031c2d221066431aaff11be6c94ed0690b72a67014eff584da1fe74eb40db
Instruction ID: 1949ad6ce855557eb9f2fdda37de7fbcb8374af68fccec7940809157b0e3c1ee
Opcode Fuzzy Hash: 617031c2d221066431aaff11be6c94ed0690b72a67014eff584da1fe74eb40db
Instruction Fuzzy Hash: F7416632715B4187EB68CF63E458A5EB7A5FB89F80F058629DF8A03B18DF39C5458B04

Function 000001845C503A40 Relevance: 5.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C503B10
VirtualFree.KERNEL32 ref: 000001845C503B3A
VirtualFree.KERNEL32 ref: 000001845C503B50
VirtualFree.KERNEL32 ref: 000001845C503B7A

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$CriticalSection$Alloc$Free$EnterRead$Leave$Initialize
String ID:
API String ID: 696443088-0
Opcode ID: c9680d75c501e4054c7710036f39944100f54ecf03344763eed7e87a999867f9
Instruction ID: 8e57e9c47c0c91b85c74fdf310b37a671cc85f468b9c1bb62407fc9c17c0e00a
Opcode Fuzzy Hash: c9680d75c501e4054c7710036f39944100f54ecf03344763eed7e87a999867f9
Instruction Fuzzy Hash: EA416D32315B5183EB58CF52E458A6EB3A5FB89F80F46C125DE9A43B08DF39C145CB04

Function 000001845C4F81A0 Relevance: 5.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F8213

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F8258
VirtualFree.KERNEL32 ref: 000001845C4F828E
VirtualFree.KERNEL32 ref: 000001845C4F829F

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 1d1b306bf3c46ccf6e7229351797aac4dc12f87dd746d871babab7f5bc255a71
Instruction ID: b021d3e20db22dc384ed840fdd73e1c0644c1e2c31e5f928e516ccf68f1c1b8a
Opcode Fuzzy Hash: 1d1b306bf3c46ccf6e7229351797aac4dc12f87dd746d871babab7f5bc255a71
Instruction Fuzzy Hash: 89319171311E4183FB988FA2E9547AD63A0FB9AFD0F09C225CE1A4BB85DF38D5918744

Function 000001845C4F1210 Relevance: 5.1, APIs: 4, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F1274

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F12B9
VirtualFree.KERNEL32 ref: 000001845C4F12EF
VirtualFree.KERNEL32 ref: 000001845C4F1300

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 5944f9928c617558d6447f66ff93bef18e990b1e2edeae30f48a59bf0b4b3e49
Instruction ID: 503629a583d82f2db71ad6f6d26cd3434a3095504a4ab20d434b4ab9767f3ece
Opcode Fuzzy Hash: 5944f9928c617558d6447f66ff93bef18e990b1e2edeae30f48a59bf0b4b3e49
Instruction Fuzzy Hash: 5D31C131300A4283FB588F67E554BAD63A0FB8AFC4F08C220CE0A47B48DF38C6418B48

Function 000001845C501EA0 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C501F04

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C501F49
VirtualFree.KERNEL32 ref: 000001845C501F7F
VirtualFree.KERNEL32 ref: 000001845C501F90

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: f4df4a3ac5e6fb09ea1b5c184ea8ce42575441d447ce80640701a34ba3f7fd77
Instruction ID: 49f9329188b9d6abe498b2bca3c8d2890d877e615598e4e10f98194f18bdf9cd
Opcode Fuzzy Hash: f4df4a3ac5e6fb09ea1b5c184ea8ce42575441d447ce80640701a34ba3f7fd77
Instruction Fuzzy Hash: 6231D231310A5683EB588FA3E5543AEA3A1FB98FC0F08C220DE0A87B48DF38C6408345

Function 000001845C4F6FA0 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4F7004

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4F7049
VirtualFree.KERNEL32 ref: 000001845C4F707F
VirtualFree.KERNEL32 ref: 000001845C4F7090

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 68638a45072214ee0e893a58682f264645d2bfca7efd773f1cf6502fd29ef5f2
Instruction ID: b75bfda7276ca02bfb281d32dc2c110b5e880e542f52a4f3397260d3f8504fba
Opcode Fuzzy Hash: 68638a45072214ee0e893a58682f264645d2bfca7efd773f1cf6502fd29ef5f2
Instruction Fuzzy Hash: AB318931310A4287EB588F62E554BAE63B1AF89FD4F088225DE0A47B88DF29D6518744

Function 000001845C503030 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C503094

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C5030D9
VirtualFree.KERNEL32 ref: 000001845C50310F
VirtualFree.KERNEL32 ref: 000001845C503120

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: b8f4db6db1d0367102d5a07de2158188bc80ba2991919440e33211faedfcd802
Instruction ID: 6fb94a90e37f9765f0c36bf6e74c400f00e152602e08781c553fa173a7744c00
Opcode Fuzzy Hash: b8f4db6db1d0367102d5a07de2158188bc80ba2991919440e33211faedfcd802
Instruction Fuzzy Hash: 03318F71310A5683EB58CFA3E55479DA3A1FB99FC4F08D225CF0A87B88DF28C6558744

Function 000001845C4FD8D0 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4FD93A

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4FD97F
VirtualFree.KERNEL32 ref: 000001845C4FD9B5
VirtualFree.KERNEL32 ref: 000001845C4FD9C6

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: ec5b1167f005ac1d8a69da9b77871cfdf6301f2a7abf43893b2e18070580acd4
Instruction ID: 68cb259764e527b6eb98e7c7e5c3ed4dd9c869c01c1d1295c362145bb3e2d0a8
Opcode Fuzzy Hash: ec5b1167f005ac1d8a69da9b77871cfdf6301f2a7abf43893b2e18070580acd4
Instruction Fuzzy Hash: 41319131310A4283EB58CFA3E554BAD63A0FB49FD4F08C225CE0A47B88DF28D6558744

Function 000001845C4EC150 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4EC1B4

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4EC1F9
VirtualFree.KERNEL32 ref: 000001845C4EC22F
VirtualFree.KERNEL32 ref: 000001845C4EC240

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 62c558665775160bff6bd4cbced2f3b4a28216fdecb6bb590b6097234b34c5f5
Instruction ID: 899d251949dcb9c1b32abb36f5aa85d0ed3e3affb51f980d8e97e13321565c8b
Opcode Fuzzy Hash: 62c558665775160bff6bd4cbced2f3b4a28216fdecb6bb590b6097234b34c5f5
Instruction Fuzzy Hash: 9D31A231710A4283EB588FA7E6547AE63A0FB89FC4F08C225CE1A47B88DF38C6418745

Function 000001845C4EB170 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001845C4EB1D4

Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3347
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E338F
Part of subcall function 000001845C4E3330: InitializeCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33A3
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E33BC
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33CF
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E33E6
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3415
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3427
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E343A
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3451
Part of subcall function 000001845C4E3330: LeaveCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E3480
Part of subcall function 000001845C4E3330: IsBadReadPtr.KERNEL32 ref: 000001845C4E3492
Part of subcall function 000001845C4E3330: EnterCriticalSection.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34A5
Part of subcall function 000001845C4E3330: VirtualAlloc.KERNEL32(?,?,?,000001845C4E2014), ref: 000001845C4E34BC

VirtualFree.KERNEL32 ref: 000001845C4EB219
VirtualFree.KERNEL32 ref: 000001845C4EB24F
VirtualFree.KERNEL32 ref: 000001845C4EB260

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: Virtual$AllocCriticalSection$EnterFreeRead$Leave$Initialize
String ID:
API String ID: 1953590826-0
Opcode ID: 6a0dbe3a0a406c02cb2e4d729dffdfe30f5f50d64f32219fd7338cec30936ee1
Instruction ID: 5fec0cda7ae777088ad95f40a280965e1a684259b3dd82eeb8ee7aa317baa579
Opcode Fuzzy Hash: 6a0dbe3a0a406c02cb2e4d729dffdfe30f5f50d64f32219fd7338cec30936ee1
Instruction Fuzzy Hash: EE31D231310A0283EB549F67E658BAD63A1FF89FC0F08C220CE0A47B58DF38C6448309

Function 000001845BF48974 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

`vector constructor iterator', xrefs: 000001845BF48A25
ctor closure', xrefs: 000001845BF489DB
deleting destructor', xrefs: 000001845BF4899A
deleting destructor', xrefs: 000001845BF48A00

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction ID: 2112eeed5991ed57b2554ea9d727f45c05c098cfdd79fe416daec37c3b6cbcc5
Opcode Fuzzy Hash: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction Fuzzy Hash: 9421C537612A0397FE54DF55F859BAC23A0AB58F40F48C52888CA833A4EF78D248CB05

Function 000001845BF48874 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

`vector constructor iterator', xrefs: 000001845BF48925
ctor closure', xrefs: 000001845BF488DB
deleting destructor', xrefs: 000001845BF4889A
deleting destructor', xrefs: 000001845BF48900

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction ID: ffb873e33f24ff64d72577ffc472100e7d24292a4ee4940022bad741f5a5994a
Opcode Fuzzy Hash: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction Fuzzy Hash: E621D637612A0387FE54DF55F859BAC23A0AB59F51F48C428C8CA833A0EF38D248CB05

Function 000001845BF48774 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

`vector constructor iterator', xrefs: 000001845BF48825
ctor closure', xrefs: 000001845BF487DB
deleting destructor', xrefs: 000001845BF4879A
deleting destructor', xrefs: 000001845BF48800

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction ID: 2b3f0a30c1259a21c04e86109ef383670515a3d33997fa5eeeaeab5e64445a9a
Opcode Fuzzy Hash: 318f5717511456cabe01ac0f45910221d27ad42c297a2242a16efb7a4ad3622b
Instruction Fuzzy Hash: A521E737612B0387FE54DF55F859BAC23A0AB58B50F48C428C88A833A0EF3CD248CB05

Function 000001845BF48674 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

`vector constructor iterator', xrefs: 000001845BF48725
ctor closure', xrefs: 000001845BF486DB
deleting destructor', xrefs: 000001845BF4869A
deleting destructor', xrefs: 000001845BF48700

Memory Dump Source

Source File: 00000002.00000002.2931170899.000001845BF30000.00000004.00000001.00020000.00000000.sdmp, Offset: 000001845BF30000, based on PE: true

Associated: 00000002.00000002.2931240789.000001845C050000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931259361.000001845C051000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845bf30000_svchost.jbxd

Similarity

API ID:
String ID: `vector constructor iterator'$ctor closure'$deleting destructor'$deleting destructor'
API String ID: 0-4293706295
Opcode ID: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction ID: cde2585cf13153271a4d7d089664989d999627a01a63d61e9ea037d58361e748
Opcode Fuzzy Hash: 8c09dbcfe2dae1ad0642468bfe82c4cc15e963c79359e8f814b649e352f9735f
Instruction Fuzzy Hash: E221D837612B0387FE54DF55F859BAC23A0A758B90F48C428C88E833A0EF38D248CB15

Function 000001845C4E6BC0 Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001845C4E6BE3
EnterCriticalSection.KERNEL32(?,?,00000038,000001845C4E71A6), ref: 000001845C4E6BFE
LeaveCriticalSection.KERNEL32(?,?,00000038,000001845C4E71A6), ref: 000001845C4E6C21
LeaveCriticalSection.KERNEL32(?,?,00000038,000001845C4E71A6), ref: 000001845C4E6C41

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$EnterRead
String ID:
API String ID: 2917996470-0
Opcode ID: 6195ae99069b8bbc5e0251264d858f2dafa8f2920a2e3fbeb294cc83daa5f249
Instruction ID: d9bfd439dff9fa79519ca88b2dbdd50b297465e9d56f1929ae0f24ce4bae92ba
Opcode Fuzzy Hash: 6195ae99069b8bbc5e0251264d858f2dafa8f2920a2e3fbeb294cc83daa5f249
Instruction Fuzzy Hash: 2B118C32305A45C7EB589F22F5402EDA7A0FB99F84F4E9621EF4A47749CF38C9918709

Function 000001845C504840 Relevance: 5.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001845C504878
LeaveCriticalSection.KERNEL32 ref: 000001845C50488F
EnterCriticalSection.KERNEL32 ref: 000001845C5048AA
LeaveCriticalSection.KERNEL32 ref: 000001845C5048C7

Memory Dump Source

Source File: 00000002.00000002.2931527423.000001845C4D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001845C4D0000, based on PE: true

Associated: 00000002.00000002.2931507591.000001845C4D0000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931562398.000001845C538000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931583634.000001845C54C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2931602590.000001845C552000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1845c4d0000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7d424a39128fc79d423e685d07f3b0557c8311698411645ac54d4061eb6ffd6c
Instruction ID: a58cf18c0dbcabda73001a2cea1a3739616d347a3a1cb37d0de3244666e895dd
Opcode Fuzzy Hash: 7d424a39128fc79d423e685d07f3b0557c8311698411645ac54d4061eb6ffd6c
Instruction Fuzzy Hash: 1A11E531700F95C7D7149F62A94829DA321FF58FC4F888221EF5667B55CF38C5558348

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R2-Signed.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Mail\ParphaCrashReport64.exe

C:\Program Files\Windows Mail\arphaDump64.bin

C:\Program Files\Windows Mail\arphaDump64.dll

C:\Windows\System32\Tasks\Microsoft\Windows\MicrosoftMailUpdateTask

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

Windows Analysis Report
R2-Signed.exe

Function 00000001800015B0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 211
servicestringCOMMON

Function 00000001800080F2 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
memorynativeinjectionCOMMON

Function 0000000180009BC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109
memoryCOMMON

Function 0000000180005824 Relevance: 3.0, APIs: 2, Instructions: 40
nativeCOMMON

Function 00000001800054D5 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 0000000180001920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
COMMON

Function 000000018000AD3E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
memoryCOMMON

Function 000000018000A9BE Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 0000000180008E30 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Function 0000000180005A0D Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Function 000000018000AF22 Relevance: 1.5, APIs: 1, Instructions: 31
injectionCOMMON

Function 000000018000A8B2 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Function 000000018000B100 Relevance: 1.5, APIs: 1, Instructions: 30
injectionCOMMON

Function 0000000180001010 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 317
filesleepmemoryCOMMON

Function 0000000180001A10 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 162
comCOMMON

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre